Redundant VRRP setup

Hi,

I have 2 catalyst switches, acting as failover; I want to create 2 firewall boxes from linux with vrrp so the firewalls become redundant. Each firewall has 2 LAN interfaces (eth1 and eth2). I want to create redundant fabric so eth1 of firewall A connects to switch 1 and eth2 of firewall A connect to switch 2. Firewall B has the same wiring config in regards to LAN wiring.

What I want is to make VIP starts on firewall A - eth1; when this interface is down, VIP has to 'jump' to firewall B - eth1. If this interface is also down; then VIP has to 'jump' back to firewall A - eth2, and finally jump to firwall B - eth2.

If:
firewall A - eth1 = VI1
firewall A - eth2 = VI2
firewall B - eth1 = VI3
firewall B - eth2 = VI4

I sync group {VI1,VI3} and {VI2,VI4}.

In firewall A:
VI1 = Master
VI2, VI3, VI4 = Backup
VI1 priority = 400
VI2 priority = 300
VI3 priority = 150
VI4 priority = 50

In fireawll B:
VI3 = Master
VI1, VI2, VI4 = Backup
VI1 priority = 200
VI2 priority = 100
VI3 priority = 350
VI4 priority = 250

This config still works when VI1 went down (properly failover to VI3); but when VI3 went down, VRRP can't allocate the VIP to VI2.

Any help would be much appreciated.

Regards,
Lito




      

------------------------------------------------------------------------------
Register Now for Creativity and Technology (CaT), June 3rd, NYC. CaT 
is a gathering of tech-side developers & brand creativity professionals. Meet
the minds behind Google Creative Lab, Visual Complexity, Processing, & 
iPhoneDevCamp as they present alongside digital heavyweights like Barbarian 
Group, R/GA, & Big Spaceship. http://p.sf.net/sfu/creativitycat-com