Fail over a default gateway and time the outage

applied · 50 min · Objective 3.3

Task

Build a redundant default gateway with VRRP, kill the active router, and measure exactly how long traffic stops. First-hop redundancy is the concrete answer to "the gateway is a single point of failure", and the measurement is what makes the design defensible.

Steps

  1. Configure keepalived on router 1 as MASTER with priority 150 and on router 2 as BACKUP with priority 100, both in the same virtual router ID, both advertising the virtual IP 192.168.10.1/24.
  2. Start both and confirm which holds the virtual address: ip addr show eth0 | grep 192.168.10.1. It must appear on exactly one router. Two is a split brain and means the two cannot hear each other.
  3. Point Host A's default route at 192.168.10.1 and confirm connectivity to Host B.
  4. Start a continuous ping from Host A with timestamps: ping -D -i 0.2 192.168.20.10 | tee /tmp/failover.log. Then stop keepalived on the master.
  5. Count the missed replies in the log and multiply by the interval. That is your failover time. Then start the master again and measure the failback — which, with preemption on, is a second outage nobody expects.

Verify

ip addr show eth0 | grep -c "192.168.10.1/"
sudo systemctl stop keepalived
sleep 5
grep -c "no answer\|Destination Host Unreachable" /tmp/failover.log || true
python3 -c "
import re
lines = open('/tmp/failover.log').read().splitlines()
seqs = [int(m.group(1)) for l in lines if (m := re.search(r'icmp_seq=(\d+)', l))]
missing = sorted(set(range(min(seqs), max(seqs)+1)) - set(seqs)) if seqs else []
print('missed replies:', len(missing), '-> outage about', round(len(missing)*0.2, 1), 'seconds')
"

Exactly one router may hold the virtual address at a time. The missed-reply count converts directly into an outage duration, and on a default keepalived configuration it should be around three seconds — one advertisement per second with a three-interval timeout.

Notes

Three seconds is fine for a file share and unacceptable for a voice call, and that is the design conversation. Tightening the advertisement interval shortens the outage and increases the risk of a false failover when the network is briefly busy, which produces two outages instead of none.

Preemption is the setting worth understanding. With it on, the original master takes the address back when it returns, causing a second brief outage; with it off, the backup keeps serving until it fails. For a stable pair, turning preemption off is usually right, and the exam expects you to know the trade rather than a single correct answer.

The protocol names are interchangeable for exam purposes: VRRP is the open standard, HSRP and GLBP are Cisco's. All solve the same problem — a gateway address that survives the loss of the device holding it.

The split-brain check in step 2 is not optional. Two routers both claiming the virtual address produce duplicate-address symptoms that look nothing like a redundancy fault, and the cause is almost always a firewall blocking the multicast advertisements between them.