# High Availability in VyOS

> High availability with VRRP in VyOS - failover, state synchronization and health checks with Active-Standby and Active-Active examples

Source: https://opennix.org/en/docs/vyos/ha/


VRRP (Virtual Router Redundancy Protocol) provides automatic router redundancy for uninterrupted network operation.

## Overview

**VRRP** (RFC 3768, RFC 5798) is a protocol for creating a virtual router from multiple physical devices.

**How it works**:
- Several routers are combined into a VRRP group
- One router becomes the **Master** (active)
- The remaining routers are **Backup** (standby)
- If the Master fails, a Backup automatically becomes the Master
- Clients use a virtual IP address (which does not change during failover)

**Use cases**:
- Default gateway redundancy for clients
- High Availability for critical services
- Eliminating a Single Point of Failure
- Continuity during maintenance
- Enterprise network redundancy

**Advantages**:
- Automatic failover (without administrator intervention)
- Transparency for clients (a single IP address)
- Fast switchover (seconds)
- Support for multiple VRRP groups
- Standard protocol (RFC)

## VRRP Concepts

### Virtual Router ID (VRID)

A unique identifier for the VRRP group (1-255).

**Important**: The VRID must be unique within an L2 segment (broadcast domain).

### Priority

The router priority used to elect the Master (1-255).

- **Higher priority** = greater chance of becoming Master
- Default: 100
- A router with priority 255 is always the Master (owner)

### Preemption

Automatic reclaiming of the Master role when a router with higher priority recovers.

- **Enabled by default** - a router with higher priority takes over the Master role
- **Disabled** (no-preempt) - the current Master remains active

### Virtual IP Address

The IP address used by clients as their default gateway.

- A group can have multiple virtual addresses
- The Master answers ARP requests for the virtual IP
- The Backup does not use the virtual IP

### MAC Address

VRRP uses a special virtual MAC address:
- **IPv4**: `00:00:5e:00:01:XX` (XX = VRID)
- **IPv6**: `00:00:5e:00:02:XX`

## Basic Configuration

### Simple VRRP Group

**Router 1 (Master - priority 200)**:
```bash
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 200

commit
save
```

**Router 2 (Backup - priority 100)**:
```bash
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 100

commit
save
```

**Verification**:
```bash
run show vrrp
```

Clients use `192.168.1.1` as their default gateway.

### Multiple Virtual IPs

```bash
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN address 192.168.1.254/24
set high-availability vrrp group LAN priority 200

commit
```

Both addresses will be active on the Master.

## Priority and Preemption

### Setting Priority

```bash
set high-availability vrrp group LAN priority 200
commit
```

Values:
- **1-254** - regular routers
- **255** - owner (the physical IP matches the virtual IP)

### Disabling Preemption

```bash
set high-availability vrrp group LAN no-preempt
commit
```

A router with higher priority **will not** reclaim the Master role automatically.

**Use case**: Preventing frequent switchovers (flapping).

### Preemption Delay

The delay before reclaiming the Master role:

```bash
set high-availability vrrp group LAN preempt-delay 180
commit
```

The router waits 180 seconds after boot before becoming Master.

**Use case**: Allowing time for services to stabilize.

## Authentication

Protecting VRRP against unauthorized routers.

### Plaintext Authentication

**Not recommended** (password stored in plaintext):

```bash
set high-availability vrrp group LAN authentication type plaintext-password
set high-availability vrrp group LAN authentication password 'MyPassword'
commit
```

### AH Authentication

**Recommended** - uses IPsec AH:

```bash
set high-availability vrrp group LAN authentication type ah
set high-availability vrrp group LAN authentication password 'SecurePassword123!'
commit
```

The password must match on all routers in the group.

## Health Check

Monitoring the router's state and automatically lowering priority when problems occur.

### Track Interface

Monitoring the state of an interface:

```bash
set high-availability vrrp group LAN track interface eth0
set high-availability vrrp group LAN track interface eth0 weight -50

commit
```

When eth0 goes down, priority is reduced by 50.

If priority drops below that of the Backup, a failover occurs.

### Health Check Script

A custom script for checking availability:

```bash
set high-availability vrrp group LAN health-check script '/config/scripts/check-connectivity.sh'
set high-availability vrrp group LAN health-check interval 10
set high-availability vrrp group LAN health-check failure-count 3

commit
```

**Script** `/config/scripts/check-connectivity.sh`:
```bash
#!/bin/bash
# Check ISP connectivity
ping -c 1 -W 2 8.8.8.8 > /dev/null 2>&1
exit $?
```

Parameters:
- **interval** - check interval (seconds)
- **failure-count** - number of failures before failover
- Exit code 0 - success, non-zero - error

Do not forget to make the script executable:
```bash
chmod +x /config/scripts/check-connectivity.sh
```

## Transition Scripts

Running actions when the VRRP state changes.

### Master Transition Script

Runs when transitioning to the Master state:

```bash
set high-availability vrrp group LAN transition-script master '/config/scripts/become-master.sh'
commit
```

**Example** `/config/scripts/become-master.sh`:
```bash
#!/bin/bash
logger "VRRP: Became Master"
# Start additional services
# systemctl start my-service
```

### Backup Transition Script

Runs when transitioning to the Backup state:

```bash
set high-availability vrrp group LAN transition-script backup '/config/scripts/become-backup.sh'
commit
```

### Fault Transition Script

Runs when transitioning to the Fault state:

```bash
set high-availability vrrp group LAN transition-script fault '/config/scripts/become-fault.sh'
commit
```

### Stop Transition Script

Runs when VRRP is stopped:

```bash
set high-availability vrrp group LAN transition-script stop '/config/scripts/vrrp-stop.sh'
commit
```

## Sync Groups

Synchronizing the state of multiple VRRP groups.

### Creating a Sync Group

```bash
set high-availability vrrp sync-group SYNC-GROUP member LAN-INSIDE
set high-availability vrrp sync-group SYNC-GROUP member LAN-DMZ

commit
```

**Effect**: When one group transitions to Backup, all groups in the sync-group transition as well.

**Use case**: Coordinating failover across multiple networks.

### Sync Group Transition Scripts

```bash
set high-availability vrrp sync-group SYNC-GROUP transition-script master '/config/scripts/sync-master.sh'
set high-availability vrrp sync-group SYNC-GROUP transition-script backup '/config/scripts/sync-backup.sh'

commit
```

## Unicast VRRP

VRRP over unicast instead of multicast.

**Use case**: When multicast is not supported (some cloud providers).

```bash
set high-availability vrrp group LAN peer-address 10.0.0.2
set high-availability vrrp group LAN peer-address 10.0.0.3

commit
```

VRRP messages are sent directly to the specified peers (unicast).

## Global Parameters

### VRRP Version

```bash
set high-availability vrrp global-parameters version 3
commit
```

Versions:
- **2** - RFC 3768 (default, IPv4)
- **3** - RFC 5798 (IPv4 and IPv6)

### Startup Delay

The delay before starting VRRP after boot:

```bash
set high-availability vrrp global-parameters startup-delay 60
commit
```

Allows time for the network to initialize before VRRP.

### Gratuitous ARP

Parameters for ARP announcement:

```bash
set high-availability vrrp global-parameters garp interval 5
set high-availability vrrp global-parameters garp master-refresh 60

commit
```

- **interval** - interval between GARPs (seconds)
- **master-refresh** - GARP refresh interval from the Master

## Conntrack Sync

Synchronizing connection tracking between routers for stateful failover.

### Basic Configuration

```bash
set service conntrack-sync accept-protocol 'tcp'
set service conntrack-sync accept-protocol 'udp'
set service conntrack-sync accept-protocol 'icmp'

set service conntrack-sync failover-mechanism vrrp sync-group SYNC-GROUP

set service conntrack-sync interface eth2
set service conntrack-sync mcast-group 225.0.0.50

commit
```

### Parameters

**Accept Protocol** - which protocols to synchronize:
```bash
set service conntrack-sync accept-protocol tcp
set service conntrack-sync accept-protocol udp
```

**Ignore Address** - do not synchronize connections from/to addresses:
```bash
set service conntrack-sync ignore-address ipv4 192.168.1.0/24
```

**Interface** - interface for sync traffic (a dedicated one is recommended):
```bash
set service conntrack-sync interface eth2
```

**Multicast Group**:
```bash
set service conntrack-sync mcast-group 225.0.0.50
```

## Configuration Examples

### Simple HA Gateway

**Topology**:
```
ISP --- [Router1] ---+
                     |--- 192.168.1.0/24 (LAN)
ISP --- [Router2] ---+
```

**Router 1 (Master)**:
```bash
# WAN Interface
set interfaces ethernet eth0 address 203.0.113.10/24

# LAN Interface
set interfaces ethernet eth1 address 192.168.1.2/24

# VRRP
set high-availability vrrp group WAN vrid 10
set high-availability vrrp group WAN interface eth0
set high-availability vrrp group WAN address 203.0.113.1/24
set high-availability vrrp group WAN priority 200

set high-availability vrrp group LAN vrid 20
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 200

# Sync Groups
set high-availability vrrp sync-group FAILOVER member WAN
set high-availability vrrp sync-group FAILOVER member LAN

# NAT
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

# Firewall
set firewall ipv4 input filter default-action drop
set firewall ipv4 input filter rule 10 action accept
set firewall ipv4 input filter rule 10 state established
set firewall ipv4 input filter rule 10 state related

set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 protocol vrrp

commit
save
```

**Router 2 (Backup)**:
```bash
# WAN Interface
set interfaces ethernet eth0 address 203.0.113.11/24

# LAN Interface
set interfaces ethernet eth1 address 192.168.1.3/24

# VRRP (lower priority)
set high-availability vrrp group WAN vrid 10
set high-availability vrrp group WAN interface eth0
set high-availability vrrp group WAN address 203.0.113.1/24
set high-availability vrrp group WAN priority 100

set high-availability vrrp group LAN vrid 20
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 100

# Sync Groups
set high-availability vrrp sync-group FAILOVER member WAN
set high-availability vrrp sync-group FAILOVER member LAN

# NAT (same as Router 1)
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

# Firewall (same as Router 1)
set firewall ipv4 input filter default-action drop
set firewall ipv4 input filter rule 10 action accept
set firewall ipv4 input filter rule 10 state established
set firewall ipv4 input filter rule 10 state related

set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 protocol vrrp

commit
save
```

### HA with Health Check

```bash
# VRRP Group
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 200

# Track WAN interface
set high-availability vrrp group LAN track interface eth0
set high-availability vrrp group LAN track interface eth0 weight -100

# Health check script
set high-availability vrrp group LAN health-check script '/config/scripts/check-wan.sh'
set high-availability vrrp group LAN health-check interval 10
set high-availability vrrp group LAN health-check failure-count 3

commit
```

**Health Check Script** `/config/scripts/check-wan.sh`:
```bash
#!/bin/bash

# Check internet connectivity
ping -c 2 -W 2 8.8.8.8 > /dev/null 2>&1
PING1=$?

ping -c 2 -W 2 1.1.1.1 > /dev/null 2>&1
PING2=$?

# Success if at least one ping works
if [ $PING1 -eq 0 ] || [ $PING2 -eq 0 ]; then
    exit 0
else
    exit 1
fi
```

### HA with Conntrack Sync

```bash
# Router 1
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 200

set high-availability vrrp sync-group SYNC member LAN

# Conntrack sync
set service conntrack-sync accept-protocol tcp
set service conntrack-sync accept-protocol udp
set service conntrack-sync failover-mechanism vrrp sync-group SYNC
set service conntrack-sync interface eth2
set service conntrack-sync mcast-group 225.0.0.50

# Dedicated sync interface
set interfaces ethernet eth2 address 10.255.255.1/30

commit
```

**Router 2**:
```bash
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 100

set high-availability vrrp sync-group SYNC member LAN

set service conntrack-sync accept-protocol tcp
set service conntrack-sync accept-protocol udp
set service conntrack-sync failover-mechanism vrrp sync-group SYNC
set service conntrack-sync interface eth2
set service conntrack-sync mcast-group 225.0.0.50

set interfaces ethernet eth2 address 10.255.255.2/30

commit
```

### Enterprise HA with OSPF

```bash
# Router 1
# Physical IPs
set interfaces ethernet eth0 address 203.0.113.2/24
set interfaces ethernet eth1 address 192.168.1.2/24
set interfaces loopback lo address 10.255.255.1/32

# VRRP
set high-availability vrrp group WAN vrid 10
set high-availability vrrp group WAN interface eth0
set high-availability vrrp group WAN address 203.0.113.1/24
set high-availability vrrp group WAN priority 200
set high-availability vrrp group WAN no-preempt

set high-availability vrrp group LAN vrid 20
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 200
set high-availability vrrp group LAN no-preempt

# OSPF
set protocols ospf parameters router-id 10.255.255.1
set protocols ospf area 0 network 192.168.1.0/24
set protocols ospf interface eth1 priority 200

# NAT
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

commit
```

**Router 2**:
```bash
# Physical IPs
set interfaces ethernet eth0 address 203.0.113.3/24
set interfaces ethernet eth1 address 192.168.1.3/24
set interfaces loopback lo address 10.255.255.2/32

# VRRP (lower priority, no preempt)
set high-availability vrrp group WAN vrid 10
set high-availability vrrp group WAN interface eth0
set high-availability vrrp group WAN address 203.0.113.1/24
set high-availability vrrp group WAN priority 100
set high-availability vrrp group WAN no-preempt

set high-availability vrrp group LAN vrid 20
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 100
set high-availability vrrp group LAN no-preempt

# OSPF
set protocols ospf parameters router-id 10.255.255.2
set protocols ospf area 0 network 192.168.1.0/24
set protocols ospf interface eth1 priority 100

# NAT (same configuration)
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

commit
```

## Operational Commands

### VRRP Status

```bash
run show vrrp
```

Example output:
```
Name        Interface      VRID  State    Last Transition
----------  -----------  ------  -------  -----------------
LAN         eth1             10  MASTER   2m30s
WAN         eth0             20  MASTER   2m30s
```

Group details:
```bash
run show vrrp detail
```

### Conntrack Sync Status

```bash
run show conntrack-sync statistics
```

### Force Failover

Stop VRRP on the Master for testing:

```bash
restart vrrp
```

Or temporarily lower the priority:
```bash
set high-availability vrrp group LAN priority 50
commit
```

Restore it:
```bash
set high-availability vrrp group LAN priority 200
commit
```

## Integration with Cloud Platforms

### Yandex Cloud

When deploying VyOS HA in Yandex Cloud, keep the cloud platform's specifics in mind:

**Architecture for Yandex Cloud**:
```
Yandex Cloud VPC
├── Subnet A (ru-central1-a)
│   └── VyOS-1 (MASTER)
│       eth0: 10.0.1.10 (internal)
│       eth1: 192.168.1.2
└── Subnet B (ru-central1-b)
    └── VyOS-2 (BACKUP)
        eth0: 10.0.2.10 (internal)
        eth1: 192.168.1.3
```

**Unicast VRRP for Yandex Cloud**:
```bash
# Router 1 (in the ru-central1-a zone)
set interfaces ethernet eth0 address 10.0.1.10/24
set interfaces ethernet eth1 address 192.168.1.2/24

# VRRP with unicast (multicast is not supported between zones)
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 200
set high-availability vrrp group LAN peer-address 192.168.1.3

# Firewall for VRRP unicast
set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 source address 192.168.1.3
set firewall ipv4 input filter rule 20 destination port 112
set firewall ipv4 input filter rule 20 protocol udp

commit
```

**Router 2 (in the ru-central1-b zone)**:
```bash
set interfaces ethernet eth0 address 10.0.2.10/24
set interfaces ethernet eth1 address 192.168.1.3/24

set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 100
set high-availability vrrp group LAN peer-address 192.168.1.2

set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 source address 192.168.1.2
set firewall ipv4 input filter rule 20 destination port 112
set firewall ipv4 input filter rule 20 protocol udp

commit
```

**Yandex Cloud Network Load Balancer alternative**:

For a public IP, use a Network Load Balancer instead of VRRP:
```bash
# Configure a health check endpoint on each router
set service https listen-address 10.0.1.10
set service https port 443

# In the Yandex Cloud Console:
# 1. Create a Network Load Balancer
# 2. Target Group: add both VyOS instances
# 3. Health Check: HTTPS :443 path /
# 4. Listener: public IP
```

### VK Cloud

Integrating HA in VK Cloud (Mail.ru Cloud Solutions):

**Architecture for VK Cloud**:
```bash
# Router 1
set interfaces ethernet eth0 address 10.0.1.10/24
set interfaces ethernet eth1 address 192.168.1.2/24

# VRRP on internal interfaces
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 192.168.1.1/24
set high-availability vrrp group LAN priority 200

# Health check for VK Cloud
set high-availability vrrp group LAN health-check script '/config/scripts/check-vk-cloud.sh'
set high-availability vrrp group LAN health-check interval 10

commit
```

**Health Check for VK Cloud**:
```bash
#!/bin/bash
# /config/scripts/check-vk-cloud.sh

# Check VK Cloud metadata service
curl -f -m 2 http://169.254.169.254/latest/meta-data/ > /dev/null 2>&1
META=$?

# Check internet connectivity
ping -c 1 -W 2 8.8.8.8 > /dev/null 2>&1
PING=$?

# Success if both work
if [ $META -eq 0 ] && [ $PING -eq 0 ]; then
    exit 0
else
    exit 1
fi
```

**Floating IP management via the VK Cloud API**:
```bash
# Transition script for switching the Floating IP
# /config/scripts/vk-floating-ip.sh

#!/bin/bash

FLOATING_IP="203.0.113.100"
NEW_PORT_ID="port-uuid-of-new-master"
VK_CLOUD_TOKEN="your-auth-token"

# Reassign floating IP to new master
curl -X PUT "https://infra.mail.ru:9696/v2.0/floatingips/${FLOATING_IP}" \
  -H "X-Auth-Token: ${VK_CLOUD_TOKEN}" \
  -H "Content-Type: application/json" \
  -d "{\"floatingip\": {\"port_id\": \"${NEW_PORT_ID}\"}}"
```

## Troubleshooting

### VRRP group in BACKUP state on both routers

**Causes**:

1. **Different VRID**:
   ```bash
   show configuration commands | grep vrid
   ```

2. **Multicast blocked**:
   Check the switch settings (IGMP snooping may be blocking it).

3. **Firewall blocking VRRP**:
   ```bash
   set firewall ipv4 input filter rule 20 action accept
   set firewall ipv4 input filter rule 20 protocol vrrp
   commit
   ```

4. **Authentication mismatch**:
   Check the passwords on both routers.

### VRRP group constantly switching (flapping)

**Solutions**:

1. **Disable preemption**:
   ```bash
   set high-availability vrrp group LAN no-preempt
   commit
   ```

2. **Add a preempt-delay**:
   ```bash
   set high-availability vrrp group LAN preempt-delay 300
   commit
   ```

3. **Check network stability**:
   ```bash
   monitor interfaces ethernet eth1
   ```

### Conntrack sync not working

Check:

1. **Sync interface is available**:
   ```bash
   show interfaces ethernet eth2
   ```

2. **The multicast group is the same** on both routers

3. **Sync traffic is not blocked**:
   ```bash
   set firewall ipv4 input filter rule 30 action accept
   set firewall ipv4 input filter rule 30 destination address 225.0.0.50
   set firewall ipv4 input filter rule 30 protocol udp
   commit
   ```

4. **Sync statistics**:
   ```bash
   run show conntrack-sync statistics
   ```

### Clients lose connections during failover

**Solution** - Conntrack Sync:

Configure conntrack-sync to preserve connection state.

See the "HA with Conntrack Sync" example above.

## Best Practices

1. **Use a sync-group** to coordinate multiple VRRP groups

2. **no-preempt** for production - prevents flapping

3. **Dedicated interface** for conntrack-sync

4. **Health check scripts** to verify actual availability (not just interface state)

5. **Authentication** - use AH for security

6. **Transition scripts** - log failover events:
   ```bash
   logger "VRRP $VRRP_GROUP_NAME became $VRRP_STATE"
   ```

7. **Test failover** regularly - perform planned switchovers

8. **Monitoring** - track VRRP state changes

9. **Documentation** - record the purpose of each VRRP group

10. **Identical configuration** - NAT, firewall, and routing must be identical on both routers

## Security

### Recommendations

1. **Authentication**:
   ```bash
   set high-availability vrrp group LAN authentication type ah
   set high-availability vrrp group LAN authentication password 'StrongPassword!'
   ```

2. **Firewall** for VRRP:
   ```bash
   set firewall ipv4 input filter rule 20 action accept
   set firewall ipv4 input filter rule 20 source address 192.168.1.0/24
   set firewall ipv4 input filter rule 20 protocol vrrp
   ```

3. **Dedicated VLAN** for HA traffic (VRRP, conntrack-sync)

4. **Logging** of transition events

5. **Secure transition scripts** - verify access permissions

## Performance

### Optimization

1. **Dedicated interface** for conntrack-sync - do not use production interfaces

2. **Health check interval** - balance detection speed against overhead:
   ```bash
   set high-availability vrrp group LAN health-check interval 10
   ```

3. **Conntrack sync protocols** - synchronize only what is necessary:
   ```bash
   set service conntrack-sync accept-protocol tcp
   # Do not synchronize UDP unless critical
   ```

4. **VRRP advertisement interval** - 1 second by default (sufficient for most cases)

## Limitations

- VRRP requires L2 connectivity between routers (broadcast domain)
- Conntrack sync increases network overhead
- Not all protocols support stateful failover
- Health check scripts must be fast (must not block VRRP)

## Additional Resources

- [VyOS VRRP Documentation](https://docs.vyos.io/en/latest/configuration/highavailability/)
- [RFC 5798 - VRRP](https://datatracker.ietf.org/doc/html/rfc5798)
- [Keepalived Documentation](https://www.keepalived.org/)

## Next Steps

- [OSPF](/docs/vyos/routing/vyos-ospf/) - dynamic routing in HA
- [BGP](/docs/vyos/routing/vyos-bgp/) - ISP connectivity in HA
- [Firewall](/docs/vyos/firewall/) - protecting HA infrastructure
- [NAT](/docs/vyos/nat/) - NAT in an HA architecture