Assigning interfaces to a FHRP group in the UI

[devon-mar]

I'm not sure if I'm missing something, but I can't figure out how to assign an interface (device or VM) to a FHRP group in the UI.
I've looked in the edit interface page, the FHRP page, but can't find anywhere to do it.

Looking through #7714, it doesn't seem like any of the pages have an Assign button (or anything of the sort).

Am I missing something? Or was the feature left out?

[candlerb]

You are testing v3.1-beta1, correct? Same as https://beta-demo.netbox.dev/ ?

I see the same as you. I can create an IP and assign it to an interface or an FHRP Group, but I can't see how to associate the FHRP group with one or more interfaces ("members").

Even navigating manually to /ipam/fhrp-group-assignments/add/ fails, even though code suggests it should be there.

[jeremystretch]

The assign button only appears if you've assigned an IP address to the interface. NetBox relies on the assigned IP(s) to determine which groups to present as options.

Even navigating manually to /ipam/fhrp-group-assignments/add/ fails, even though code suggests it should be there.

This view requires that the interface be specified via query parameters. Accessing it without these will return a 404.

[candlerb]

That's what Jeremy appeared to say, but it doesn't seem to be true. Tested on beta-demo.netbox.dev:

• Create FHRP group - it was VRRPv2 id 123
• Under this FHRP group, add IP address 192.0.2.1/24
• Go to a device interface - I chose dmi01-akron-rtr01 GigabitEthernet0/1/3
• Under FHRP groups, click "assign group"
• Select the group created earlier

This works fine; there was no need to assign any IP address to the interface before adding it to the FHRP group.

[jeremystretch]

Sorry, my comment above was unclear and partially incorrect. If the interface has an IP address assigned, the "assign FHRP group" form will filter the list of available FHRP groups by that IP address. If there's no IP assigned, you'll see a list of all groups, which isn't terribly helpful.

I thought we had disabled the button if no IP address is assigned, but it still appears. Should we disable it?

[candlerb]

If the interface has an IP address assigned, the "assign FHRP group" form will filter the list of available FHRP groups by that IP address

Do you mean: filter to addresses to those matching the same subnet as any IP address assigned to the interface? Or exactly matching an IP address assigned to the interface? The latter would cause problems with uniqueness enforcement which seems to be what FHRG was meant to avoid.

I have seen setups which use private IPs as the "primary" address on an interface, but a public IP as the floating address.

WIth VRRPv3, there is no need for the virtual IP to be in the same subnet as the primary IP. Indeed, with IPv6 on Cisco VRRPv3, the primary virtual IP must be link-local, and it's optional whether you have a secondary virtual IP.

  vrrpv3 1 address-family ipv6
    priority 200
    address fe80::1 primary    << only link-local address can be chosen here
    address 2001:db8::1        << optional

I suppose it would be possible to scope them by VLAN, but then it would be even harder to work out why a particular FHRG isn't selectable on an interface (and people may be using IPAM features without using VLANs, or without assigning VLANs to prefixes and interfaces)

I thought we had disabled the button if no IP address is assigned, but it still appears. Should we disable it?

I don't think so, unless there's a big tooltip which explains why the button is disabled.

[devon-mar]

I agree with @candlerb. It would force the user to understand the restrictions that NetBox imposes and would cause more confusion.

There's too many assumptions that have to be made in order to restrict assignment to interfaces with IPs.
For example, on IOS devices, IPv6 HSRP can use an link local or autoconfig address as the virtual IP, meaning that the FHRP group in NetBox wouldn't even have an address assigned to it. I haven't tried it, but you could probably even use HSRP IPv6 with no global addresses at all.

[candlerb]

It would be useful to allow the user to search for an IP when assigning an FHRP group, the same way that they search for an IP when assigning an existing IP address. The problem would be that this wouldn't let you select an FHRP group which has no IP address.

I just realised there is a wider problem: identifying the FHRP group just by its ID is not sufficient. In my own network, I use the same VRRP ID (1) for the router, across many subnets; this means there would be many FHRP objects with protocol VRRPv3 ID 1, and it's impossible to distinguish them when assigning them. I have now raised this separately as #7880.

I think my preferred solution to this would be to be able to search for an FHRP group by IP address+VRF when assigning it. This would be the same as searching for an IP address when assigning an existing IP address (just filtered to IP addresses which are linked to FHRP groups).

That just leaves FHRP groups with no assigned IP address. They could be shown when the address search box is empty.