Site 103 has two edges and one LAN
Site 103 is the larger branch. It has two WAN Edge routers, BR-03A and BR-03B, so that one router can fail without taking the site off the network. Both connect to the same user LAN in service VPN 10. Hosts need one default gateway address, and a host cannot know which edge is healthy. VRRP gives it a single virtual address that has an owner as long as one edge is alive on the LAN.
Part 1 builds VRRP and the checks around it. Part 2 covers service-side EIGRP, which suits a site whose LAN core already runs it. Site IDs, colours and prefixes in this lab are examples.
The lab network
| Item | BR-03A | BR-03B |
|---|---|---|
| System IP | 10.255.2.3 | 10.255.2.4 |
| Site ID | 103 | 103 |
| LAN interface address (VPN 10) | 10.10.3.2/24 | 10.10.3.3/24 |
| VRRP group and virtual address | 1, 10.10.3.1 | 1, 10.10.3.1 |
| VRRP priority | 110 | 100 |
| Remote sites that reach it | HUB-01 (site 10), HUB-02 (site 20), BR-01 (101), BR-02 (102) | |
Both edges advertise the connected prefix 10.10.3.0/24 into OMP (the Overlay Management Protocol, which carries routes between edges through the SD-WAN Controller, formerly vSmart). Remote sites therefore see two routes to site 103 and pick one. That choice is the heart of the lab.
On small screens, swipe sideways or focus the diagram and use the arrow keys.
The ingress and egress must agree
VRRP decides which edge the hosts use for traffic leaving the site. OMP decides which edge the remote sites use for traffic entering it. These are two separate decisions made by two separate mechanisms, and nothing links them.
- A host at 10.10.3.50 sends to HUB-01. Its gateway is the virtual address, so BR-03A (master) forwards it.
- HUB-01 replies. It holds two OMP routes to 10.10.3.0/24, one per edge, and prefers BR-03B.
- The reply enters the site at BR-03B, which delivers it on the connected LAN.
The path out used BR-03A and the path back used BR-03B. For plain traffic that works. For anything that keeps state on the edge, such as a firewall feature, NAT or a security policy that tracks sessions, the edge that sees only half a connection drops it. The fix is to make the preferred ingress edge the VRRP master. In practice most VRRP trouble at dual-edge sites turns out to be this mismatch, not VRRP itself.
Choosing the ingress edge is the same tool as the dual-hub lesson used: a higher OMP route preference on the routes you want chosen, applied by a control policy on the Controller. The policy matches site 103's routes from BR-03A and raises their preference. The exact match fields differ by release, so verify what your policy builder offers.
Configure VRRP on the LAN interface
VRRP runs on the service-side interface, the one in VPN 10, not on a transport interface. In SD-WAN Manager the setting lives in the interface feature template for the VPN. The fragment below shows the idea in IOS XE style.
interface GigabitEthernet5
vrf forwarding 10
ip address 10.10.3.2 255.255.255.0
vrrp 1 address-family ipv4
address 10.10.3.1 primary
priority 110
track omp
exitSketch for BR-03A. BR-03B uses 10.10.3.3 and priority 100, with the same group number and virtual address. The structure and the track keyword are written from memory and not tested on a lab. In Manager the option is called Track OMP and the CLI form is track-omp in some releases. Check your release's syntax before copying.
- Group number. Both edges must use the same group (1 here). A different group is a different virtual router.
- Virtual address. Both edges must configure the same one, and it must sit in the LAN subnet. Hosts use it as their default gateway.
- Priority. The higher value wins the master election. 110 against 100 makes BR-03A the master. The values are examples.
- Preemption. With preemption on, BR-03A takes the role back after it recovers. Without it, BR-03B keeps the role until it fails. Preemption is normally on by default in VRRP, but confirm for your release.
- Tracking the overlay. A master with a healthy LAN port and a dead overlay is a black hole: it owns the gateway but has no tunnels to send into. Tracking OMP lowers the master's priority when it loses its OMP session, so the backup wins. There is also a way to track a prefix list on some releases; its availability is not confirmed here.
One more point: tracking OMP reacts to the loss of the Controller session, which can happen while data tunnels still work (the Controller down, not the WAN). Decide whether you want the master to step down in that case, and test it.
Tasks
Task 1: bring up VRRP
Configure the interface on both edges as in the table. Which edge should be master, and which command shows it?
Show answer
BR-03A, because its priority is higher. On either edge:
show vrrp briefThe state column should read Master on BR-03A and Backup on BR-03B.
BR-03A#show vrrp brief Interface Grp Pri Time Own Pre State Master addr/Group addr Gi5 1 110 3570 Y Master 10.10.3.2 10.10.3.1
Task 2: check what remote sites prefer
From HUB-01, look at the routes to 10.10.3.0/24. Which edge is chosen, and does it match the VRRP master?
HUB-01#show sdwan omp routes 10.10.3.0/24 VPN PREFIX FROM PEER PATH ID LABEL STATUS TLOC IP COLOR PREF 10 10.10.3.0/24 10.255.0.11 101 1002 C,I,R 10.255.2.4 biz-internet - 10 10.10.3.0/24 10.255.0.11 102 1002 R 10.255.2.3 biz-internet -
Show answer: how to align them
Either raise the OMP route preference for site 103's routes from BR-03A with a control policy, or move the VRRP priority so BR-03B is master. A control policy changes what every remote site prefers in one place, which is why many designs fix it there. After the change, repeat the command: the 10.255.2.3 route should now carry the higher preference and be the chosen one.
Task 3: check the tunnels from the master
BR-03A#show sdwan bfd sessions SYSTEM IP SITE ID STATE SOURCE TLOC REMOTE TLOC DST PUBLIC IP ENCAP MULT TX INTERVAL 10.255.1.1 10 up biz-internet biz-internet 198.51.100.20 ipsec 7 1000 10.255.1.2 20 up biz-internet biz-internet 198.51.100.40 ipsec 7 1000 10.255.2.1 101 up biz-internet biz-internet 203.0.113.10 ipsec 7 1000 10.255.2.2 102 up biz-internet biz-internet 203.0.113.20 ipsec 7 1000
Task 4: test failover
Shut the LAN interface on BR-03A. Predict what BR-03B does, and what a ping from a host to HUB-01 shows.
Show answer
BR-03B stops hearing advertisements and becomes master after the master-down interval. A continuous ping pauses for a few seconds and recovers. With preemption, BR-03A takes the role back when the port returns, which causes a second short pause. Plan that second pause rather than being surprised by it.
Break and fix
Fault 1: the master is not the preferred ingress
Symptom: a file transfer between a host at site 103 and HUB-01 starts, then stalls. Pings work. A security feature on the edges tracks sessions.
Diagnosis and fix
Compare show vrrp brief on both edges with show sdwan omp routes 10.10.3.0/24 on a remote site. If the VRRP master and the chosen OMP route are different edges, the connection uses one edge to leave and the other to arrive. Fix it by aligning the two as in Task 2, then retest in both directions.
Fault 2: the overlay is down, VRRP stays master
Symptom: the internet circuit on BR-03A fails. Users at site 103 lose all remote access, although BR-03B is healthy.
Diagnosis and fix
BR-03A's LAN port is up, so VRRP does not see a problem and it keeps the gateway. Its BFD list is empty. Enable the overlay-tracking option on the VRRP configuration so the priority drops when OMP is lost, then repeat the failure. Verify with show vrrp brief that BR-03B becomes master.
Fault 3: group or virtual address does not match
Symptom: show vrrp brief shows Master on both edges.
Diagnosis and fix
Two edges that use different group numbers, or the same group with different virtual addresses, do not form one virtual router. Each believes it is alone and wins. Hosts then see two owners of the gateway role. Compare the group, virtual address and VLAN on both edges, correct the mismatch, and confirm one Master and one Backup.
Part 2: EIGRP on the service side
If the LAN core at site 103 already runs EIGRP (Enhanced Interior Gateway Routing Protocol), the edges can join it instead of using VRRP and static host gateways. Service-side EIGRP is described as supported on IOS XE SD-WAN edges, but verify support for your router model and release before you design around it.
- Into OMP. Routes the edge learns from EIGRP can be advertised into OMP so remote sites can reach them. Check which route types your release advertises by default.
- Out of OMP. OMP routes can be redistributed into EIGRP so the LAN core reaches remote sites. EIGRP needs a metric for redistributed routes. A missing or unsuitable metric is a common reason redistributed routes do not appear.
- Two edges, two redistribution points. This is the loop risk. A route taken from OMP into EIGRP by BR-03A can be learned by BR-03B and sent back into OMP. The next lab shows the tag-based fix for OSPF and BGP; the same idea applies to EIGRP. Check how your release supports tagging or filtering for it.
- Metrics decide the exit. The core chooses between the edges using EIGRP metrics, so the edge you prefer should present the better metric. This is the EIGRP version of aligning ingress and egress.
What to record
For the lab notebook: which edge was master before and after each failure; the OMP route chosen by a remote site before and after your preference change; how long a ping to HUB-01 paused in each test; and the release and model you tested on, since tracking and EIGRP options differ.
Test yourself on dual-edge sites
BR-03A is VRRP master. HUB-01 chooses BR-03B for 10.10.3.0/24. A session-aware feature on the edges drops some connections. What is the most likely cause?
BR-03A loses both transports. Its LAN port is up. Users have no remote access and BR-03B is healthy. Which setting was missing?
show vrrp brief shows Master on both BR-03A and BR-03B. What do you check first?
BR-03A redistributes OMP routes into EIGRP. BR-03B learns them from EIGRP and advertises them back into OMP. What is the risk?