That should work, in theory (although in theory, everything works).
And it all seems doable inside transition scripts.

Looks like first do "insmod macvlan" followed by:

# ip link add link eth0 name eth0_macalias type macvlan
# ip link set eth0_macalias address 00:00:5e:00:01:XX

where XX is the hex number of the VRRP group.

Then we need another transition script to destroy the macvlan when the master resigns, which might be this code:

# ip link delete eth0_macalias

The above examples seem to work on the command line, but I haven't built the lab environment yet to test it. Will let you know.

Speaking of transition scripts, it doesn't look like there's a way to put parameters in the transition scripts, or any kind of environment vars that tell you what the virtual IP or interface is? As it stands now I have to write a separate transition script for each VRRP group (which gets old quickly, I've got a dozen or more), or do dirty tricks with the name of the script and symlinks.

Yes, that works very well! Thanks!

Yes, it all seems to work, except I also had to do "ip link set eth0_macalias up". So it should be possible to provide Cisco compatibility by adding or removing the VRRP virtual MAC address in a transition script, where the transition script also does "arping -U -I eth0_macalias -s " for every TARGET-IP on different network switch segments (i.e. you don't need to bop every host on the LAN, just send out enough packets so that all your switches map the VRRP virtual MAC to the correct port).

This is still an awful kludge - hopefully the keepalived folks will make this unnecessary by adding the necessary functionality to keepalived.

Will the very effective and highly desirable patch above go into Larkspur? Wasn't there when I checked a couple of weeks ago.

I don't think so - nothing in the keepalived change log that says they've added MAC address functionality.

And the Vyatta HAref documentation for 6.1 still talks about changing MAC addresses and using gratuitous ARP. VRRP implementations that use the virtual MAC address do not need to do that.

Can you recover connectivity with those devices with the "arping -U" or "arping -a" command? If so, that can be automated with a VRRP transition script.

Another path is to try a bleeding edge version of keepalived - version 1.2.0
has the "use_vmac" option according to their developer mailing list.

The scheme I outlined earlier in the thread is still that, just a scheme, I haven't actually implemented that, I just proved to my satisfaction that it is workable. However, I did build a framework for VRRP transition scripts that should make building that scheme possible, I will release that code in a few days after I've had the chance to double-check it.

I think you will need to assign another IP to the Vyatta pair just for the MACVLAN scheme, and point the errant devices to that IP. If the "arping" command works, it will be easier to use that.

Hey Vyatta folks, is keepalived 1.2 in the pipeline? If not, how hard will it be to port it ourselves?

1) Perhaps there's something time-dependent going on, and vyatta-vrrp-state.pl is sending the ARP stuff too early. You can experiment with VRRP transition scripts, have them start a job which sleeps for 5 seconds and then runs arping again. Ugly but it might be reliable enough untili the Vyatta gang get the latest keepalived integrated.

2) My framework for VRRP transition scripts is attached. It works in Mendocino - it might need slight adjustment for Napa, depending on whether the bootup process changed. The issue is that when a Vyatta router with VRRP enabled boots up, there are VRRP transitions at boot, one after the other, and if the transition script tries to run Vyatta config commands during bootup, it could stop the system from coming up properly. So the script tries to detect bootup state and sleeps until it's over.

3) The original intent of these scripts was to do a failover for an IP address that couldn't be shared via VRRP - for example, an IP in a /30 subnet where there are no spare IPs to run the VRRP protocol. But you can pretty much expand it as necessary - whenever there is a VRRP state change, it can be configured to run a sequence of shell commands, Vyatta op-mode commands, and Vyatta config commands.

4) The documentation is in comments in the script. Basically, set up /etc/vrrp-triggers.conf with the descriptions of your interface and your VRRP group, and then the commands you want to run. Typically, you'll create one set of commands for actions to take during "master" state, and another set of commands for actions in "non-master" (backup or fault) state(s).

vrrp-triggers.sh follows below.

#!/bin/sh


# usage:
#
# create /etc/vrrp-triggers.conf with lines like this:
#
# interface eth2.100 group 100
# state master     delete interface ethernet eth1 disable
# state nonmaster  set    interface ethernet eth1 disable
# state fault      shell  logger -t vrrp-eth2.100 "ouch!"
# state backup     run    clear vrrp master interface eth2.100 group 100
#
# interface eth3 group 150
# [...]
#
# link this script to a VRRP group with something like :
#  set interface ethernet eth0 vif 10 vrrp vrrp-group 10 run-transition-scripts backup /usr/local/sbin/vrrp-triggers.sh
#  set interface ethernet eth0 vif 10 vrrp vrrp-group 10 run-transition-scripts fault /usr/local/sbin/vrrp-triggers.sh
#  set interface ethernet eth0 vif 10 vrrp vrrp-group 10 run-transition-scripts master /usr/local/sbin/vrrp-triggers.sh
#
# then this script will run the commands associated with the above states
# whenever a transition occurs.

# documentation for /etc/vrrp-triggers.conf
#
# interface  group 
#  is the name of the interface that VRRP is running on.  Must
# match Linux syntax, i.e. "eth2.100" for Vyatta "eth2 vif 100".
#  is the VRRP group number.  All "state" lines listed after
# this statement, until the next "interface" line, will be run
# for VRRP transitions for this interface and VRRP group.
#
# state   
#  is one of "backup", "fault", "master", or "nonmaster".
# "nonmaster" matches states other than "master".
#
#  is one of "set" (run Vyatta "set" command in config mode), "delete"
# (run Vyatta "delete" command in config mode), "run" (run Vyatta op-mode
# command), and "shell" (run shell command).
#
#  is the rest of the command you want run, as in the examples
# above.


# how many seconds to wait for system startup to complete.  doing config
# changes while /etc/init.d/vyatta-router is running may cause damage 
maxinitwait=30

# how old a lockdir can be (in seconds) - if it is too old remove it and
# proceed anyway
maxlockdelay=60




LOGOPT=

debug=false
if [ ${DEBUG:-no} = YES ]
then
	set -x
	LOGOPT=-s
	debug=true
fi


bomb() {
	logger $LOGOPT -t "${ID}-$PIDSTR" "$1"
	exit 23
}

log() {
	logger $LOGOPT -t "${ID}-$PIDSTR" "$1"
}

vyattacfg() {
CFGWRAP=/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper

$CFGWRAP begin
while read cmdline
do
        eval $CFGWRAP $cmdline
done
$CFGWRAP commit
$CFGWRAP end

}

vyattarun() {
unset _OFR_CONFIGURE
while read cmdline
do
	echo $cmdline | vbash --noediting --noprofile -i
done
}

run_action() {
action=$1
case $action in
set*|delete*) echo $action | vyattacfg ; log "$action" ;;
run*) echo ${action##run}  | vyattarun ; log "$action" ;;
shell*) echo ${action##shell} | sh ;     log "$action" ;;
*) log "unrecognized action in $configfile: $action" ;;
esac
}

# trim leading space/tabs
trim_line() {
line=$1
while [ "${line:0:1}" = " " -o "${line:0:1}" = "	" ]
do
	line=${line## }
	line=${line##	}
done
echo $line
}


set -u

PIDSTR="[$$]"

trap 'logger -t ${ID:-$0}-$PIDSTR "error exit - temp file in ${TMPFILE:-XXX}"' EXIT

ID=vrrp-triggers
CONFIGFILE=/etc/vrrp-triggers.conf

log "args: ${*:-missing, pre VC6.1 systems need vyatta-vrrp-state.pl patch}"
state=${1}; shift
interface=${1}; shift
vrrpgroup=${1}; shift

PIDSTR="$state[$$]"

if [ ! -s $CONFIGFILE ]
then
	bomb "please put desired actions in $CONFIGFILE, read $0 for details"
fi

TMPFILE=$(mktemp /tmp/vrrp-${interface}-${state}-${vrrpgroup}-XXXXXXXXXX)
if [ ! -w $TMPFILE ]
then
	log "mktemp fails - cannot write $TMPFILE - cannot log all errors"
	TMPFILE=""
else
	if $debug
	then
		exec >$TMPFILE
	else
		exec >$TMPFILE 2>&1
	fi
fi


ID="${ID}-${interface}-${vrrpgroup}"
LOCKDIR="/var/run/$ID.lock"

starttime=$(date +%s)

while [ $(expr $(date +%s) - $starttime) -lt $maxinitwait ]
do

	# these patterns may be Mendocino-specific - should generalize
	# with config file
	#
	if ps auxwww | egrep "/etc/init.d/vyatta-router|opt/vyatta/sbin/vyatta-boot-config-loader" | egrep -v egrep >/dev/null
	then
		log "Vyatta startup still running, will sleep a little"
		sleep 2
		continue
	fi

	# prevent re-entrancy
	if mkdir $LOCKDIR
	then
		break # we have the lock
	else
		rc=$?
		if [ ! -d $LOCKDIR ]
		then
			log "mkdir of lockdir failed, status $rc, using plan B"
			# uh oh, mkdir failed for a reason other than
			# directory exists.  something is very worng
			sleep 10
			break    # and proceed without the lock
		fi
		locktime=$(stat --format %Y $LOCKDIR)
		now=$(date +%s)
		age=$(expr $now - $locktime)
		if [ $age -gt $maxlockdelay ]
		then
			log "$LOCKDIR is $age seconds old, over $maxlockdelay seconds, ignoring"
			touch $LOCKDIR # freshen up the lock while we're using it
			break
		else
			log "$LOCKDIR exists, last modified at $locktime ($age seconds ago), will sleep a little"
			sleep 2
		fi
	fi
done

trap 'rm -rf $LOCKDIR; logger -t "${ID:-$0}-$PIDSTR" "error exit - temp file in ${TMPFILE:-XXX}"' EXIT

cfginterface=""

while read cfgline
do
	# skip blank lines
	if [ -z "$cfgline" ]
	then continue
	fi

	cfgline=$(trim_line "$cfgline")

	case $cfgline in
	"#*") continue ;;   # it's a comment
	interface*)
		set $cfgline
		if [ "${3:-XXX}" != "group" ]
		then log "syntax error in $CONFIGFILE: $cfgline"
		fi
		cfginterface=${2:-XXX}
		cfggroup=${4:-XXX}
		;;
	state*)
		if [ "$interface" = "$cfginterface" -a "$vrrpgroup" = "$cfggroup" ]
		then
			stateline=$(trim_line "${cfgline##state}")
			actionline=$(trim_line "${stateline#*[ 	]}")
			cfgstate=$(trim_line "${stateline%%[ 	]*}")
			cfgstate=${cfgstate%[ 	]*}

			case $cfgstate in
			master|backup|fault|nonmaster) ;;
			*) log "unrecognized state in $CONFIGFILE: $cfgstate";;
			esac

			if [ "$cfgstate" = "$state" ]  ||
			[ "$cfgstate" = "nonmaster" -a "$state" = "backup" ] ||
			[ "$cfgstate" = "nonmaster" -a "$state" = "fault" ]
			then
				run_action "$actionline"
			fi
		else
			continue  # ignore, not this interface
		fi
		;;
	*)
	esac
done < $CONFIGFILE

rm -rf $LOCKDIR # don't need to hold it any longer

if [ -s $TMPFILE ]
then
	log "state change actions produced output - appending to syslog"
	logger -t ${ID}-$PIDSTR -f $TMPFILE
	log "state change actions produced output, logged above"
fi

trap 'rm -f $TMPFILE; logger -t ${ID}-$PIDSTR "normal exit"' EXIT

exit 0