Description
This article explains how to configure VRRP between a FortiGate unit and a Cisco router.
Scope
FortiOS firmware version 4.0 MR3
FortiOS firmware version 5.0.x
Solution
VRRP can only be configured in the CLI.
FortiGate configuration:
config system interface
edit "port1"
set vdom "root"
set ip 192.168.40.3 255.255.255.0
set allowaccess ping ssh http
set type physical
set vrrp-virtual-mac enable
config vrrp
edit 40
set vrip 192.168.40.1
next
end
end
Cisco router configuration:
Note: For an authoritative guidance on configuration of a Cisco equipment, please refer to the product documentation of that equipment. Please note, that Fortinet Technical Support can not provide any assistance with configuration, operation and troubleshooting of a 3rd party equipment.
interface FastEthernet0/0
ip address 192.168.40.2 255.255.255.0
duplex auto
speed auto
vrrp 40 ip 192.168.40.1
When configuring VRRP, it is important to ensure Group-IDs are the same. In the FortiGate configuration, this is the “edit 40” settings. It is the same Group-ID, configured on the Cisco router as “vrrp 40 ip…”. If these values do not match, VRRP will not negotiate correctly.
It is also important to ensure the following command is issued on the FortiGate network interface. This enables the VRRP virtual MAC address between the two devices:
set vrrp-virtual-mac enable
Troubleshooting:
The following debug command will show the error below, when the Group-IDs do not match.
diagnose debug application vrrpd -1
[vrrp_vrt_leave_master:995]: internal, vrid 40, vrip 192.168.40.1, (255 1 1)
[vrrp_vrt_goto_master:963]: internal, vrid 40, vrip 192.168.40.1, (255 1 1)
[vrrp_packet_proc:1411]: cannot find vrt (11, 39)
[vrrp_packet_proc:1411]: cannot find vrt (11, 39)
[vrrp_packet_proc:1411]: cannot find vrt (11, 39) <- Group-ID 39 is misconfigured on the router
Other related commands:
This monitors a next hop address. Should this monitoring fail, the FortiGate unit will go into a Backup State. This is similar to the track function on a Cisco router.
config vrrp
edit 40
set vrdst <ip address>
VRRP “preempt” and “priority” are also available:
config vrrp
edit 40
set preempt <enable/disable> (enabled is the default)
set priority <1-255> (100 is the default)
To display the VRRP configuration and status:
get router info vrrp
Interface: internal, primary IP address: 192.168.40.3
UseVMAC: 1, SoftSW: 0, BrPortIdx: 0, PromiscCount: 0
VRID: 40
vrip: 192.168.40.1, priority: 255, state: MASTER
adv_interval: 1, preempt: 1, start_time: 3
vrdst: 0.0.0.0
For more details on the VRRP configuration options, please refer to the FortiOS CLI Reference guide.
