Why cannot VRRP traffic be forwarded after MFF is enabled

If MFF is enabled on a device for Layer 2 isolation, an MFF entry is generated after a DHCP user gets online. The Gateway IP field in the MFF entry is the real gateway address.

VRRP has been enabled on the device, so the Layer 3 gateway is a virtual VRRP gateway address.

The destination MAC address and gateway IP address of the outgoing user packet are the virtual MAC address and virtual gateway address, which are different from those in the MFF entry. Therefore, VRRP traffic cannot be forwarded.

To solve this problem, change the gateway list of the DHCP server as the VRRP virtual gateway address. After a DHCP user re-logs in, its MFF entry is updated. The gateway IP address and MAC address in the MFF entry are the virtual gateway address and virtual MAC address, so VRRP traffic can be forwarded.

Scroll to top