VRRP Master Fights the OSPF Best Path
Two EX4650 distribution switches, DIST-A and DIST-B, serve 20 VLANs with VRRP groups 10–29. DIST-A is master for all groups with priority 200 and preempt; DIST-B is backup with priority 100. DIST-A has a 10G uplink to the core, while DIST-B has a 40G uplink. OSPF costs are bandwidth-derived, so DIST-B is the preferred next hop toward the core. The 2×40G ISL between DIST-A and DIST-B is at 72% utilization, while DIST-A's core uplink is at 15% and DIST-B's is at 55%. Users on VLAN 10 report high latency to core services. show vrrp summary shows DIST-A master. show ospf interface shows DIST-A cost 100 and DIST-B cost 25. show route 10.20.0.0/16 on DIST-A points to DIST-B over the ISL.
1. Prove the forwarding path causing the latency and recommend a fix that aligns VRRP with the IGP.
Read the worked answer
The VRRP master and the OSPF best path disagree. Hosts send off-subnet traffic to the VLAN 10 virtual MAC, which DIST-A owns because it is VRRP master. DIST-A then looks up the destination, sees OSPF cost 100 on its 10G uplink versus cost 25 via DIST-B, and forwards the packet over the ISL. The packet crosses the ISL and leaves through DIST-B's 40G uplink. Return traffic may also be asymmetric, compounding latency.
Confirm with:
show vrrp summary
show ospf interface detail
show route 10.20.0.0/16
show interfaces ae0 statistics
The ISL at 72% and DIST-A uplink at 15% are the signature. Either make DIST-B the VRRP master for these VLANs by raising its priority above DIST-A, or adjust OSPF cost on DIST-A so its uplink is preferred. Do not do both blindly; choose the node with the better core path. If DIST-B has the 40G uplink, prefer DIST-B as master. Verify after the change that show route points out the local uplink and ISL utilization drops.
2. A colleague proposes adding `accept-data` to both VRRP groups. Will that solve the latency? Explain.
Read the worked answer
No. accept-data controls whether a VRRP master accepts packets destined to the virtual IP and virtual MAC. It does not change which switch owns the virtual MAC, nor does it change OSPF path selection. Both switches may already accept data correctly; the problem is that the master is not the best exit point.
Adding accept-data can be useful in some designs where a backup must receive traffic for the virtual address, but it does not resolve a VRRP/IGP topology mismatch. It may even hide the symptom while traffic still crosses the ISL. Keep the focus on aligning VRRP priority with the OSPF cost or uplink capacity.
3. How would you prevent a newly added VLAN from reintroducing the same problem?
Read the worked answer
Make the relationship explicit and auditable. Define a standard that VRRP priority is derived from the uplink capacity or OSPF cost toward the core: the switch with the better core path is master. For example, if DIST-B has the 40G uplink, set DIST-B priority 200 and DIST-A priority 100 for all core-bound VLANs. Avoid using preempt with priorities that are not maintained.
Use a commit script or configuration audit to check that for each VLAN, the VRRP master has the lower OSPF cost to the core. Include show vrrp summary, show ospf interface, and ISL utilization in the post-change validation. If uplinks are upgraded later, revisit the priority mapping rather than assuming the original design still holds.