Re: VRRP: how to move specific MAC from one router to the other on failover?

Hello,

I do not believe VRRP is able to do such a thing natively.

I have a solution to offer you, but at your own risks as it is non-standard.

I strongly suggest you test it in a lab first (and tell me if I got anything wrong).

You can use notify_master, notify_slave and notify_fault this way
(provided 00:26:18:82:8b:07 is the mac address you want to move, and eth1 is your interface):

notify_master "/usr/bin/macchanger -m 00:26:18:82:8b:07 eth1"
notify_slave "/usr/bin/macchanger -p eth1"
notify_fault /usr/bin/macchanger -p eth1"

This way, the master instance will have the defined MAC address and go back to its defaut when slave/fault.
You will probably need to do a gratuitous arp after each movement, not for the upstream router, but for the switch to know on which physical port the
MAC address is located.

Hope this helps,

On Tue, 2018-04-10 at 18:17 +0200, Andras Korn wrote:
> On Tue, Apr 10, 2018 at 03:46:41PM +0000, Damien Clabaut wrote:
> 
> Hi,
> 
> > > My problem is that the next hop upstream router has a static ARP table; it
> > > ignores the gratuitous ARP replies keepalived sends. The only way of making
> > > it talk to my backup router is to move the MAC address it has in its ARP
> > > table from the master to the backup on failover.
> > > 
> > > What's a good way of doing this? ebtables NAT? Or use a script to set up a
> > > macvlan interface on the master, with the requisite MAC address?
> > > 
> > > (I thought use_vmac would be a mechanism for this, but apparently it's not.)
> > 
> > You can use the use_vmac to have a virtual interface with a VRRP mac.
> > 
> > You can find example templates in the beta branch of Keepalived: https://github.com/acassen/keepalived/blob/beta/tools/json_tracking/template_vrrp
> > _instance
> 
> I think I didn't explain my problem properly.
> 
> I realize I can use use_vmac to have *a* magical MAC address for my router
> (although, after trying it, I don't understand how it works and may ask
> about it later); the problem is that I need the MASTER to have a *specific*
> MAC address (00:26:18:82:8b:07 -- so, not one of those 00:00:5e VRRP MACs).
> 
> Andras
> 
-- 
Damien Clabaut
R&D vRouter
OVH
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot