Two routers as one gateway (VRRP)

One router means that when it fails, the whole building stops. VRRP gives two routers one shared address. The master holds that address while it is alive, the backup takes it over as soon as the hello packets stop arriving. For clients nothing changes: their gateway is still the same IP.

Where it lives in the tool

The section is called High availability (VRRP, Netwatch). It is off by default and no role switches it on, so you enable it per device: in a site you click the router, choose Configure, and switch the section on there. You do that for each of the two routers separately.

Per VRRP instance you fill in the interface (the bridge, a VLAN or a port), the VRID (1 to 255), the priority (100 by default), the virtual address, and whether preempt and VRRPv3 are on. The password field only appears when you put an instance on v2, because VRRPv3 has no authentication.

What the script produces

/interface vrrp
add name=vrrp10 interface=vlan10-lan vrid=10 priority=200 preemption-mode=yes version=3
/ip address
add address=10.1.10.254/32 interface=vrrp10 comment="virtual gateway VRID 10"

That is all of it: a virtual interface and an address on it. The address is only live on whichever router is master at that moment.

What has to match on both routers

With several VLANs you need a VRRP instance per VLAN, each with its own VRID. Two instances sharing a VRID on the same layer 2 segment fight over the same address.

The honest part: the tool generates one device at a time

There is no "make this a VRRP pair" button. The tool builds one script per device and has no notion of two routers being one thing together. Everything in the "same" column above you have to type identically on both routers, and everything in the "different" column you have to make different on purpose. In practice that means three things you do yourself:

• Give the backup its own addresses. The shared VLAN table hands every router in the site the same addresses, so without a change both routers get 10.1.10.1/24. The site checks say so too: two devices with the same address. Open gw-02, go to VLANs and move each router address up by one: 10.1.10.2, 10.1.20.2, and so on.
• Switch DHCP off on the backup. Two DHCP servers in one subnet hand out addresses against each other, and RouterOS does not synchronise leases. Turn the DHCP toggle off per VLAN on gw-02. The price: during a failure a new device gets no address, while existing leases keep working. If that is not acceptable, give the backup its own non-overlapping pool.
• Point DHCP at the virtual address. The tool writes /ip dhcp-server network with gateway and dns-server set to that router's own address. That is exactly what you do not want: clients then get 10.1.10.1 as their gateway, and that address disappears during a failure. Change the line after pasting:

  /ip dhcp-server network set [find address=10.1.10.0/24] gateway=10.1.10.254 dns-server=10.1.10.254

Those three steps belong on the handover sheet. They are not difficult, but they are invisible: without them the scripts look perfectly normal and the network works, right up to the day you need it not to.

What VRRP does not solve

• Sessions do not survive. VRRP moves an address, not state. Connection tracking, NAT sessions, live VPN tunnels and queues start over on the backup. A phone call drops, a file transfer breaks, a browser reloads. Recovery takes seconds instead of a working day, but it is not seamless.
• Configurations drift apart. A firewall rule you add on the master is not on the backup. There is no synchronisation. The calmest shape in this tool: change it in the site or on both devices, generate again, and paste both scripts.
• The WAN side stays a separate problem. VRRP on your LAN does not help when the internet line is down. For that you need two uplinks with a distance setting, or Netwatch flipping something on failure. See Multiple internet connections and Netwatch.
• It notices a dead router, not a broken one. A master that still sends hellos but has lost its uplink stays master. Pair it with Netwatch if you want to catch that.

Preempt, and what you mean by it

With preempt on, the router with the highest priority takes the address back as soon as it comes up again. That is predictable: you always know which router is normally active. The drawback is that a router rebooting twice an hour makes the network switch over twice an hour. Turn preempt off in that case and move the address back by hand when you are done.

Checking it

• /interface vrrp print on both routers: exactly one of the two should be master.
• Ping the virtual address and then pull the power on the master. The ping may lose a few packets and has to come back.
• Confirm your clients really have the virtual address as their gateway, not the master's: ipconfig /all or ip route on a workstation.
• Run that test for real, once. A failover that exists only on paper is not a failover.

Further reading: High availability, Netwatch and Replacing a live network without downtime.