KEEPALIVED.CONF(5)            File Formats Manual           KEEPALIVED.CONF(5)

       keepalived.conf - configuration file for Keepalived

       keepalived.conf is the configuration file which describes all the
       Keepalived keywords.  Keywords are placed in hierarchies of blocks and
       subblocks, each layer being delimited by '{' and '}' pairs.

       Comments start with '#' or '!' to the end of the line and can start
       anywhere in a line.

       The keyword 'include' allows inclusion of other configuration files
       from within the main configuration file, or from subsequently included

       The format of the include directive is:

       include FILENAME

       FILENAME can be a fully qualified or relative pathname, and can include
       wildcards, including csh style brace expressions such as
       "{foo/{,cat,dog},bar}" if glob() supports them.

       After opening an included file, the current directory is set to the
       directory of the file itself, so any relative paths included from a
       file are relative to the directory of the including file itself.

       <BOOL> is one of on|off|true|false|yes|no

Conditional configuration and configuration id
       The config-id defaults to the first part of the node name as returned
       by uname, and can be overridden with the -i or --config-id command line

       Any configuration line starting with '@' is a conditional configuration
       line.  The word immediately following (i.e. without any space) the '@'
       character is compared against the config-id, and if they don't match,
       the configuration line is ignored.

       Alternatively, '@^' is a negative comparison, so if the word
       immediately following does NOT match the config-id, the configuration
       line IS included.

       The purpose of this is to allow a single configuration file to be used
       for multiple systems, where the only differences are likely to be the
       router_id, vrrp instance priorities, and possibly interface names and
       unicast addresses.

       For example:

        @main   router_id main_router
        @backup router_id backup_router
        vrrp_instance VRRP1 {
        @main    unicast_src_ip
        @backup  unicast_src_ip
        @backup2 unicast_src_ip
                 unicast_peer {

       If keepalived is invoked with -i main, then the router_id will be set
       to main_router, if invoked with -i backup, then backup_router, if not
       invoked with -i, or with -i anything else, then the router_id will not
       be set. The unicast peers for main will be and

Parameter substitution
       Substitutable parameters can be specified. The format for defining a
       parameter is:


       where there must be no space before the '=' and only whitespace may
       preceed to '$'.  Empty values are allowed.

       Parameter names can be made up of any combination of A-Za-z0-9 and _,
       but cannot start with a digit.

       After a parameter is defined, any occurrence of $PARAMETER followed by
       whitespace, or any occurrence of ${PARAMETER} (which need not be
       followed by whitespace) will be replaced by VALUE.

       Replacement is recursive, so that if a parameter value itself includes
       a replaceable parameter, then after the first substitution, the
       parameter in the value will then be replaced; the substitution is done
       at replacement time and not at definition time, so for example:

           ${ADDRESS_BASE}.100/32 $ADDRESS_BASE_SUB=10

       will produce:

       Note in the above examples the use of both ADDRESS_BASE and
       ADDRESS_BASE_SUB required braces ({}) since the parameters were not
       followed by whitespace (after the first substitution which produced
       10.2.${ADDRESS_BASE_SUB}.100/32 the parameter is still not followed by

       If a parameter is not defined, it will not be replaced at all, so for
       example ${UNDEF_PARAMETER} will remain in the configuration if it is
       undefined; this means that existing configuration that contains a '$'
       character (for example in a script definition) will not be changed so
       long as no new parameter definitions are added to the configuration.

       Parameter substitution works in conjunction with conditional
       configuration.  For example:

           @main $PRIORITY=240
           @backup $PRIORITY=200
           vrrp_instance VI_0 {
               priority $PRIORITY

       will produce:
           vrrp_instance VI_0 }
               priority 240

       if the config_id is main.

           $IF_MAIN priority 240

       will produce:

           priority 240

       if the config_id is main and nothing if the config_id is not main,
       although why anyone would want to use this rather than simply

           @main priority 240

       is not known.

       Multiline definitions are also supported, but when used there must be
       nothing on the line after the parameter name. A multiline definition is
       specified by ending each line except the last with a 'ยด character.


       $INSTANCE= \ vrrp_instance VI_${NUM} { \
           interface eth0.${NUM} \
           use_vmac vrrp${NUM}.1 \
           virtual_router_id 1 \
        @high priority 130 \
        @low priority 120 \
           advert_int 1 \
           virtual_ipaddress { \
               10.0.${NUM}.254/24 \
           } \
           track_script { \
               offset_instance_${NUM} \
           } \ }






       contains subblocks of Global definitions, Static routes, and Static

Global definitions
        global_defs           # Block id
        notification_email    # To:
        # From: from address that will be in the header (default
       keepalived@<local host name>)
        smtp_server [<PORT>]
                                     # IP address or domain name
                                     #  with optional port number (default 25)
        smtp_helo_name <HOST_NAME>   # name to use in HELO messages
                                     #  defaults to local host name
        smtp_connect_timeout 30      # integer, seconds
        router_id my_hostname        # string identifying the machine,
                                     # (doesn't have to be hostname).
                                     # default: local host name
        vrrp_mcast_group4 # optional, default
        vrrp_mcast_group6 ff02::12   # optional, default ff02::12
        default_interface p33p1.3    # sets the default interface for static
       addresses, default eth0

        lvs_sync_daemon <INTERFACE> <VRRP_INSTANCE> [id <SYNC_ID>] [maxlen
       <LEN>] [port <PORT>] [ttl <TTL>] [group <IP ADDR>]
                                     # Binding interface, vrrp instance and
                                     #  syncid for lvs syncd
                                     #  syncid (0 to 255) for lvs syncd
                                     #  maxlen (1..65507) maximum packet
                                     #  port (1..65535) UDP port number to use
                                     #  ttl (1..255)
                                     #  group - multicast group address (IPv4
       or IPv6)
                                     # NOTE: maxlen, port, ttl and group are
       only available on Linux 4.3 or later.
        lvs_flush                    # flush any existing LVS configuration at

        # delay for second set of gratuitous ARPs after transition to MASTER
        vrrp_garp_master_delay 10    # seconds, default 5, 0 for no second set

        # number of gratuitous ARP messages to send at a time after transition
       to MASTER
        vrrp_garp_master_repeat 1    # default 5

        # delay for second set of gratuitous ARPs after lower priority advert
       received when MASTER
        vrrp_garp_lower_prio_delay 10

        # number of gratuitous ARP messages to send at a time after lower
       priority advert received when MASTER
        vrrp_garp_lower_prio_repeat 1

        # minimum time interval for refreshing gratuitous ARPs while MASTER
        vrrp_garp_master_refresh 60  # secs, default 0 (no refreshing)

        # number of gratuitous ARP messages to send at a time while MASTER
        vrrp_garp_master_refresh_repeat 2 # default 1

        # Delay in ms between gratuitous ARP messages sent on an interface
        vrrp_garp_interval 0.001          # decimal, seconds (resolution
       usecs). Default 0.

        # Delay in ms between unsolicited NA messages sent on an interface
        vrrp_gna_interval 0.000001        # decimal, seconds (resolution
       usecs). Default 0.

        # If a lower priority advert is received, don't send another advert.
       This causes
        # adherence to the RFCs. Defaults to false, unless strict_mode is set.
        vrrp_lower_prio_no_advert [<BOOL>]

        # If we are master and receive a higher priority advert, send an
       advert (which will be
        # lower priority than the other master), before we transition to
       backup. This means
        # that if the other master has garp_lower_priority_repeat set, it will
       resend garp messages.
        # This is to get around the problem of their having been two
       simultaneous masters, and the
        # last GARP messages seen were from us.
        vrrp_higher_prio_send_advert [<BOOL>]

        # Set the default VRRP version to use
        vrrp_version <2 or 3>        # default version 2

        # Specify the iptables chain for ensuring a version 3 instance
        # doesn't respond on addresses that it doesn't own.
        # Note: it is necessary for the specified chain to exist in
        # the iptables and/or ip6tables configuration, and for the chain
        # to be called from an appropriate point in the iptables
        # It will probably be necessary to have this filtering after accepting
        # any ESTABLISHED,RELATED packets, because IPv4 might select the VIP
        # the source address for outgoing connections.
        vrrp_iptables keepalived     # default INPUT

        # or for outbound filtering as well
        # Note, outbound filtering won't work with IPv4, since the VIP can be
       selected as the source address
        # for an outgoing connection. With IPv6 this is unlikely since the
       addresses are deprecated.
        vrrp_iptables keepalived_in keepalived_out

        # or to not add any iptables rules:

        # Keepalived may have the option to use ipsets in conjunction with
        # If so, then the ipset names can be specified, defaults as below.
        # If no names are specified, ipsets will not be used, otherwise any
        # names will be constructed by adding "_if" and/or "6" to previously
        # names.
        vrrp_ipsets [keepalived [keepalived6 [keepalived_if6]]]

        # The following enables checking that when in unicast mode, the source
        # address of a VRRP packet is one of our unicast peers.

        # Checking all the addresses in a received VRRP advert can be time
        # Setting this flag means the check won't be carried out if the advert
        # from the same master router as the previous advert received.
        vrrp_skip_check_adv_addr     # Default - don't skip

        # Enforce strict VRRP protocol compliance. This will prohibit:
        #   0 VIPs
        #   unicast peers
        #   IPv6 addresses in VRRP version 2

        # The following 4 options can be used if vrrp or checker processes
        #   are timing out. This can be seen by a backup vrrp instance
        #   master even when the master is still running because the master or
        #   backup system is too busy to process vrrp packets.
        vrrp_priority <-20 to 19>    # Set the vrrp child process priority
                                     #   Negative values increase priority.
        checker_priority <-20 to 19> # Set the checker child process priority
        vrrp_no_swap                 # Set the vrrp child process non
        checker_no_swap              # Set the checker child process non

        # If Keepalived has been build with SNMP support, the following
       keywords are available
        # Note: Keepalived, checker and RFC support can be individually
        snmp_socket udp:  # specify socket to use for connecting to
       SNMP master agent (default unix:/var/agentx/master)
                                     # unless using a network namespace, when
       the default is udp:localhost:705
        enable_snmp_keepalived       # enable SNMP handling of vrrp element of
        enable_snmp_checker          # enable SNMP handling of checker element
        enable_snmp_rfc              # enable SNMP handling of RFC2787 and
       RFC6527 VRRP MIBs
        enable_snmp_rfcv2            # enable SNMP handling of RFC2787 VRRP
        enable_snmp_rfcv3            # enable SNMP handling of RFC6527 VRRP
        enable_traps                 # enable SNMP traps

        # If Keepalived has been build with DBus support, the following
       keywords are available
        enable_dbus                       # enable the DBus interface
        dbus_service_name SERVICE_NAME    # Name of DBus service (default
                                          # Useful if you want to run multiple
       keepalived processes with DBus enabled

        # Specify the default username/groupname to run scripts under.
        # If this option is not specified, the user defaults to
        #   if that user exists, otherwise root.
        script_user username [groupname] # If groupname is not specified, it
       defaults to the user's group
        enable_script_security       # Don't run scripts configured to be run
       as root if any part of the path
                                     #   is writable by a non-root user.

        # Rather than using notify scripts, specifying a fifo allows more
       efficient processing of notify events, and guarantees that they will be
       delivered in the correct sequence.
        # NOTE: the FIFO names must all be different
        notify_fifo FIFO_NAME        # FIFO to write notify events to
                                     # See vrrp_notify_fifo and
       lvs_notify_fifo for format of output
                                     # For further details, see the
       description under vrrp_sync_group see
                                     # doc/samples/ for
       sample usage.
        notify_fifo_script STRING [username [groupname]]
                                     # script to be run by keepalived to
       process notify events
                                     # The FIFO name will be passed to the
       script as the last parameter
        vrrp_notify_fifo FIFO_NAME   # FIFO to write vrrp notify events to
                                     # The string written will be a line of
       the form: INSTANCE "VI_1" MASTER 100
                                     # and will be terminated with a new line
                                     # For further details of the output, see
       the description under vrrp_sync_group
                                     # and doc/samples/
       for sample usage.
        vrrp_notify_fifo_script STRING [username [groupname]]
                                     # script to be run by keepalived to
       process vrrp notify events
                                     # The FIFO name will be passed to the
       script as the last parameter
        lvs_notify_fifo FIFO_NAME    # FIFO to write notify healthchecker
       events to
                                     # The string written will be a line of
       the form:
                                     #   VS []:tcp:80 {UP|DOWN}
                                     #   RS []:tcp:80
       []:tcp:80 {UP|DOWN}
                                     # and will be terminated with a new line
        lvs_notify_fifo_script STRING [username [groupname]]
                                     # script to be run by keepalived to
       process healthchecher notify events
                                     # The FIFO name will be passed to the
       script as the last parameter

        # For running keepalived in a separate network namespace
        net_namespace NAME           # Set the network namespace to run in
                                     # The directory /var/run/keepalived will
       be created as an unshared mount point,
                                     #   for example for pid files.
                                     # syslog entries will have _NAME appended
       to the ident.
                                     # Note: the namespace cannot be changed
       on a configuration reload
        namespace_with_ipsets        # ipsets wasn't network namespace aware
       until Linux 3.13, and so if running with
                                     # an earlier version of the kernel, by
       default use of ipsets is disabled if using
                                     # a namespace and vrrp_ipsets has not
       been specified. This options overrides the
                                     # default and allows ipsets to be used
       with a namespace on kernels prior to 3.13.

        instance NAME                # If multiple instances of keepalived are
       run in the same namespace, this will
                                     #   create pid files with NAME as part of
       the file names, in /var/run/keepalived.
                                     # Note: the instance name cannot be
       changed on a configuration reload

        use_pid_dir                  # Create pid files in /var/run/keepalived

        linkbeat_use_polling         # Poll to detect media link failure
       otherwise attempt to use ETHTOOL or MII interface

Static routes/addresses/rules
       Keepalived can configure static addresses, routes, and rules. These
       addresses are NOT moved by vrrpd, they stay on the machine.  If you
       already have IPs and routes on your machines and your machines can ping
       each other, you don't need this section.  The syntax for rules and
       routes is that same as for ip rule add/ip route add.

       The syntax is the same for virtual addresses and virtual routes. If no
       dev element is specified, it defaults to default_interface (default
       eth0).  Note: the broadcast address may be specified as '-' or '+' to
       clear or set the host bits of the address.

        <IPADDR>[/<MASK>] [brd <IPADDR>] [dev <STRING>] [scope <SCOPE>] [label
       <LABEL>] [home] [-nodad] [mngtmpaddr] [noprefixroute] [autojoin] dev eth0 scope global

        { via dev eth0 table 6909 nexthop via dev wlan0 onlink
       weight 1 nexthop via dev wlan0 onlink weight 2 dev p33p1.2 table 6909 tos 0x04 protocol bird scope
       link priority 12 mtu 1000 hoplimit 100 advmss 101 rtt 102 rttvar 103
       reordering 104 window 105 cwnd 106 ssthresh lock 107 realms PQA/0x14
       rto_min 108 initcwnd 109 initrwnd 110 features ecn
        2001:470:69e9:1:2::4 dev p33p1.2 table 6909 tos 0x04 protocol bird
       scope link priority 12 mtu 1000 hoplimit 100 advmss 101 rtt 102 rttvar
       103 reordering 104 window 105 cwnd 106 ssthresh lock 107 rto_min 108
       initcwnd 109 initrwnd 110 features ecn

        from table 1
        to table 1
        from to table small iif p33p1 oif
       wlan0 tos 22 fwmark 24/12 preference 39 realms 30/20 goto 40
        to 1:2:3:4:5:6:7:0/112 from 7:6:5:4:3:2::/96 table 6908 uidrange

       contains subblocks of VRRP script(s), VRRP synchronization group(s),
       VRRP gratuitous ARP and unsolicited neighbour advert delay group(s) and
       VRRP instance(s)

VRRP script(s)
        # Adds a script to be executed periodically. Its exit code will be
        # recorded for all VRRP instances which are monitoring it.
        vrrp_script <SCRIPT_NAME> {
           script <STRING>|<QUOTED-STRING> # path of the script to execute
           interval <INTEGER>  # seconds between script invocations, default 1
           timeout <INTEGER>   # seconds after which script is considered to
       have failed
           weight <INTEGER:-254..254>  # adjust priority by this weight,
       default 0
           rise <INTEGER>              # required number of successes for OK
           fall <INTEGER>              # required number of successes for KO
           user USERNAME [GROUPNAME]   # user/group names to run script under
                                       #   group default to group of user
           init_fail                   # assume script initially is in failed

VRRP synchronization group(s)
        #string, name of group of IPs that failover together
        vrrp_sync_group VG_1 {
           group {
             inside_network   # name of the vrrp_instance (see below)
             outside_network  # One for each movable IP

           # notify scripts and alerts are optional
           # filenames of scripts to run on transitions
           # can be unquoted (if just filename)
           # or quoted (if it has parameters)
           # The username and groupname specify the user and group
           # under which the scripts should be run. If username is
           # specified, the group defaults to the group of the user.
           # If username is not specified, they default to the
           # global script_user and script_group
           # to MASTER transition
           notify_master /path/ [username [groupname]]
           # to BACKUP transition
           notify_backup /path/ [username [groupname]]
           # FAULT transition
           notify_fault "/path/ VG_1" [username [groupname]]

           # for ANY state transition.
           # "notify" script is called AFTER the
           # notify_* script(s) and is executed
           # with 4 arguments provided by Keepalived
           # (so don't include parameters in the notify line).
           # arguments
           # $1 = "GROUP"|"INSTANCE"
           # $2 = name of the group or instance
           # $3 = target state of transition (stop only applies to instances)
           #     ("MASTER"|"BACKUP"|"FAULT"|"STOP")
           # $4 = priority value
           notify /path/ [username [groupname]]

           # Send email notification during state transition,
           # using addresses in global_defs above.

           global_tracking     # All VRRP share the same tracking config

VRRP gratuitous ARP and unsolicited neighbour advert delay group(s)
       specifies the setting of delays between sending gratuitous ARPs and
       unsolicited neighbour advertisements. This is intended for when an
       upstream switch is unable to handle being flooded with ARPs/NAs.

       Use interface when the limits apply on the single physical interface.
       Use interfaces when a group of interfaces are linked to the same switch
       and the limits apply to the switch as a whole.

       If the global vrrp_garp_interval and/or vrrp_gna_interval are set, any
       interfaces that aren't specified in a garp_group will inherit the
       global settings.

       garp_group {
           # Sets the interval between Gratuitous ARP (in seconds, resolution
           garp_interval <DECIMAL>
           # Sets the default interval between unsolicited NA (in seconds,
       resolution microseconds)
           gna_interval <DECIMAL>
           # The physical interface to which the intervals apply
           interface <STRING>
           # A list of interfaces accross which the delays are aggregated.
           interfaces {

VRRP instance(s)
       describes the movable IP for each instance of a group in
       vrrp_sync_group.  Here are described two IPs (on inside_network and on
       outside_network), on machine "my_hostname", which belong to the group
       VG_1 and which will transition together on any state change.

        #You will need to write another block for outside_network.
        vrrp_instance inside_network {
           # Initial state, MASTER|BACKUP
           # As soon as the other machine(s) come up,
           # an election will be held and the machine
           # with the highest priority will become MASTER.
           # So the entry here doesn't matter a whole lot.
           state MASTER

           # interface for inside_network, bound by vrrp
           interface eth0

           # Use VRRP Virtual MAC.
           # NOTE: If sysctl net.ipv4.conf.all.rp_filter is set,
           # and this vrrp_instance is an IPv4 instance, using
           # this option will cause the individual interfaces to be
           # updated to the greater of their current setting, and
           # all.rp_filter, as will default.rp_filter, and all.rp_filter
           # will be set to 0.
           # The original settings are restored on termination.
           use_vmac [<VMAC_INTERFACE>]

           # Send/Recv VRRP messages from base interface instead of
           # VMAC interface

           native_ipv6         # force instance to use IPv6 (this option is
       deprecated since the virtual ip addresses determine whether IPv4 or
       IPv6 is used).

           # Ignore VRRP interface faults (default unset)

           # optional, monitor these as well.
           # go to FAULT state if any of these go down.
           track_interface {
             eth2 weight <-254..254>

           # add a tracking script to the interface (<SCRIPT_NAME> is the name
       of the vrrp_script entry)
           track_script {
               <SCRIPT_NAME> weight <-254..254>

           # default IP for binding vrrpd is the primary IP
           # on interface. If you want to hide the location of vrrpd,
           # use this IP as src_addr for multicast or unicast vrrp
           # packets. (since it's multicast, vrrpd will get the reply
           # packet no matter what src_addr is used).
           # optional
           mcast_src_ip <IPADDR>
           unicast_src_ip <IPADDR>

           version <2 or 3>            # VRRP version to run on interface
                                       #  default is global parameter

           # Do not send VRRP adverts over a VRRP multicast group.
           # Instead it sends adverts to the following list of
           # ip addresses using unicast. It can be cool to use
           # the VRRP FSM and features in a networking
           # environment where multicast is not supported!
           # IP addresses specified can be IPv4 as well as IPv6.
           unicast_peer {
           # The checksum calculation when using VRRPv3 changed after v1.3.6.
           #  Setting this flag forces the old checksum algorithm to be used
           #  to maintain backward compatibility, although keepalived will
           #  attempt to maintain compatibility anyway if it sees an old
           #  version checksum. Sepcifying never will turn off auto detection
           #  of old checksums. [This option may not be enabled - check output
           #  of `keepalived -v` for OLD_CHKSUM_COMPAT.]
           old_unicast_checksum [never]

           # interface specific settings, same as global parameters; default
       to global parameters
           garp_master_delay 10
           garp_master_repeat 1
           garp_lower_prio_delay 10
           garp_lower_prio_repeat 1
           garp_master_refresh 60
           garp_master_refresh_repeat 2
           garp_interval 100
           gna_interval 100

           lower_prio_no_advert [<BOOL>]
           higher_prio_send_advert [<BOOL>]

           # arbitrary unique number from 0 to 255
           # used to differentiate multiple instances of vrrpd
           # running on the same NIC (and hence same socket).
           virtual_router_id 51

           # for electing MASTER, highest priority wins.
           # to be MASTER, make this 50 more than on other machines.
           priority 100

           # VRRP Advert interval in seconds (e.g. 0.92) (use default)
           advert_int 1

           # Note: authentication was removed from the VRRPv2 specification by
       RFC3768 in 2004.
           #   Use of this option is non-compliant and can cause problems;
       avoid using if possible,
           #   except when using unicast, where it can be helpful.
           authentication {     # Authentication block
               # PASS||AH
               # PASS - Simple password (suggested)
               # AH - IPSEC (not recommended))
               auth_type PASS
               # Password for accessing vrrpd.
               # should be the same on all machines.
               # Only the first eight (8) characters are used.
               auth_pass 1234

           #addresses add|del on change to MASTER, to BACKUP.
           #With the same entries on other machines,
           #the opposite transition will be occurring.
           virtual_ipaddress {
               <IPADDR>[/<MASK>] [brd <IPADDR>] [dev <STRING>] [scope <SCOPE>]
       [label <LABEL>] [home] [-nodad] [mngtmpaddr] [noprefixroute] [autojoin]
      dev eth1
      dev eth2 label eth2:1

           #VRRP IP excluded from VRRP
           #For cases with large numbers (eg 200) of IPs
           #on the same interface. To decrease the number
           #of packets sent in adverts, you can exclude
           #most IPs from adverts.
           #The IPs are add|del as for virtual_ipaddress.
           # Can also be used if you want to be able to add
           # a mixture of IPv4 and IPv6 addresses, since all
           # addresses in virtual_ipaddress must be of the
           # same family.
           virtual_ipaddress_excluded {
               <IPADDR>[/<MASK>] [brd <IPADDR>] [dev <STRING>] [scope <SCOPE>]
       [label <LABEL>] [home] [-nodad] [mngtmpaddr] [noprefixroute] [autojoin]
               <IPADDR>[/<MASK>] ...

           # Set the promote_secondaries flag on the interface to stop other
           # addresses in the same CIDR being removed when 1 of them is
           # For example if and are both configured on
           # interface, and one is removed, unless promote_secondaries is set
           # the interface the other address will also be removed.

           # routes add|del when changing to MASTER, to BACKUP.
           # See static_routes for more details
           virtual_routes {
               # src <IPADDR> [to] <IPADDR>/<MASK> via|gw <IPADDR> [or
       <IPADDR>] dev <STRING> scope <SCOPE> table <TABLE>
               src to via dev
      via dev eth1
      dev eth2
      via or dev
      gw table 100  # To set a default gateway
       into table 100.

           # rules add|del when changing to MASTER, to BACKUP
           # See static_rules for more details
           virtual_rules {
               from table 1
               to table 1

           # VRRPv3 has an Accept Mode to allow the virtual router when not
       the address owner to
           # receive packets addressed to a VIP. This is the default setting
       unless strict mode is set.
           # As an extension, this also works for VRRPv2 (RFC 3768 doesn't
       define an accept mode).
           accept     # Accept packets to non address-owner
           no_accept  # Drop packets to non address-owner.

           # VRRP will normally preempt a lower priority
           # machine when a higher priority machine comes
           # online.  "nopreempt" allows the lower priority
           # machine to maintain the master role, even when
           # a higher priority machine comes back online.
           # NOTE: For this to work, the initial state of this
           # entry must be BACKUP.
           preempt             # for backwards compatibility

           # See description of global vrrp_skip_check_adv_addr, which
           # sets the default value. Defaults to vrrp_skip_check_adv_addr
           skip_check_adv_addr [on|off|true|false|yes|no]

           # See description of global vrrp_strict
           # If vrrp_strict is not specified, it takes the value of
           # If strict_mode without a parameter is specified, it defaults to
           strict_mode [on|off|true|false|yes|no]

           # Seconds after startup or seeing a lower priority master until
           # (if not disabled by "nopreempt").
           # Range: 0 (default) to 1000
           # NOTE: For this to work, the initial state of this
           # entry must be BACKUP.
           preempt_delay 300    # waits 5 minutes

           # Debug level, not implemented yet.
           debug <LEVEL>        # LEVEL is a number in the range 0 to 4

           # notify scripts, alert as above
           notify_master <STRING>|<QUOTED-STRING> [username [groupname]]
           notify_backup <STRING>|<QUOTED-STRING> [username [groupname]]
           notify_fault <STRING>|<QUOTED-STRING> [username [groupname]]
           notify_stop <STRING>|<QUOTED-STRING> [username [groupname]]      #
       executed when stopping vrrp
           notify <STRING>|<QUOTED-STRING> [username [groupname]]

        # Parameters used for SSL_GET check.
        # If none of the parameters are specified, the SSL context will be
       auto generated.
        SSL {
           password <STRING>   # password
           ca <STRING>         # ca file
           certificate <STRING>  # certificate file
           key <STRING>        # key file

       contains subblocks of Virtual server group(s) and Virtual server(s)

       The subblocks contain arguments for ipvsadm(8).  Knowledge of
       ipvsadm(8) will be helpful here.

       Note: Where an option can be configured for a virtual server, real
       server, and possibly checker, the virtual server setting is the default
       for real servers, and the real server setting is the default for

       Note: Tunnelled real/sorry servers can differ from the address family
       of the virtual server and non tunnelled real/sorry servers, which all
       have to be the same. If a virtual server uses a fwmark, and all the
       real/sorry servers are tunnelled, the address family of the virtual
       server will be the same as the address family of the real/sorry servers
       if they are all the same, otherwise it will default to IPv4 (use
       ip_family inet6 to override this).

Virtual server group(s)
        # optional
        # this groups allows a service on a real_server
        # to belong to multiple virtual services
        # and to only be health checked once.
        # Only for very large LVSs.
        virtual_server_group <STRING> {
               #VIP port
               <IPADDR> <PORT>
               <IPADDR> <PORT>
               # <IPADDR RANGE> has the form
               # XXX.YYY.ZZZ.WWW-VVV eg
               # range includes both .1 and .10 address
               <IPADDR RANGE> <PORT># VIP range VPORT
               <IPADDR RANGE> <PORT>
               fwmark <INT>  # fwmark
               fwmark <INT>
               ...  }

Virtual server(s)
       A virtual_server can be a declaration of one of

       vip vport (IPADDR PORT pair)

       fwmark <INT>

       (virtual server) group <STRING>

                  #setup service
                  virtual_server IP port |
                  virtual_server fwmark int |
                  virtual_server group string
                  # delay timer for checker polling
                  delay_loop <INT>

                  # LVS scheduler
                  lvs_sched rr|wrr|lc|wlc|lblc|sh|dh|fo|ovf|lblcr|sed|nq

                  # Enable hashed entry
                  # Enable flag-1 for scheduler (-b flag-1 in ipvsadm)
                  # Enable flag-2 for scheduler (-b flag-2 in ipvsadm)
                  # Enable flag-3 for scheduler (-b flag-3 in ipvsadm)
                  # Enable sh-port for sh scheduler (-b sh-port in ipvsadm)
                  # Enable sh-fallback for sh scheduler  (-b sh-fallback in
                  # Enable One-Packet-Scheduling for UDP (-O in ipvsadm)
                  # Default LVS forwarding method
                  lvs_method NAT|DR|TUN
                  # LVS persistence engine name
                  persistence_engine <STRING>
                  # LVS persistence timeout in seconds, default 6 minutes
                  persistence_timeout [<INT>]
                  # LVS granularity mask (-M in ipvsadm)
                  persistence_granularity <NETMASK>
                  # L4 protocol
                  protocol TCP|UDP|SCTP
                  # If VS IP address is not set,
                  # suspend healthchecker's activity

                  lb_algo    # deprecated synonym for lvs_sched
                  lb_kind    # deprecated synonym for lvs_method

                  # Default VirtualHost string for HTTP_GET or SSL_GET
                  # eg virtualhost www.firewall.loc
                  # Overridden by virtualhost config of real server or checker
                  virtualhost <STRING>

                  # On daemon startup assume that all RSs are down
                  # and healthchecks failed. This helps to prevent
                  # false positives on startup. Alpha mode is
                  # disabled by default.

                  # On daemon shutdown consider quorum and RS
                  # down notifiers for execution, where appropriate.
                  # Omega mode is disabled by default.

                  # Minimum total weight of all live servers in
                  # the pool necessary to operate VS with no
                  # quality regression. Defaults to 1.
                  quorum <INT>

                  # Tolerate this much weight units compared to the
                  # nominal quorum, when considering quorum gain
                  # or loss. A flap dampener. Defaults to 0.
                  hysteresis <INT>

                  # Script to execute when quorum is gained.
                  quorum_up <STRING>|<QUOTED-STRING> [username [groupname]]

                  # Script to execute when quorum is lost.
                  quorum_down <STRING>|<QUOTED-STRING> [username [groupname]]

                  # IP family for a fwmark service (optional)
                  ip_family inet|inet6

                  # setup realserver(s)

                  # RS to add to LVS topology when the quorum isn't achieved.
                  #  If a sorry server is configured, all real servers will
                  #  be brought down when the quorum is not achieved.
                  sorry_server <IPADDR> <PORT>
                  # applies inhibit_on_failure behaviour to the sorry_server
                  # Sorry server LVS forwarding method
                  sorry_server_lvs_method NAT|DR|TUN

                  # Retry count to make additional checks if check
                  # of an alive server fails. Default: 1 unless specified
                  retry <INT>

                  # delay before retry
                  delay_before_retry <INT>

                  # Optional random delay to start the initial check
                  # for maximum N seconds.
                  # Useful to scatter multiple simultaneous
                  # checks to the same RS. Enabled by default, with
                  # the maximum at delay_loop. Specify 0 to disable
                  warmup <INT>

                  # delay timer for checker polling
                  delay_loop <INT>

                  # Set weight to 0 when healthchecker detects failure

                  # one entry for each realserver
                  real_server <IPADDR> <PORT>
                         # relative weight to use, default: 1
                         weight <INT>
                         # LVS forwarding method
                         lvs_method NAT|DR|TUN

                         # Script to execute when healthchecker
                         # considers service as up.
                         notify_up <STRING>|<QUOTED-STRING> [username
                         # Script to execute when healthchecker
                         # considers service as down.
                         notify_down <STRING>|<QUOTED-STRING> [username

                         uthreshold <INTEGER> # maximum number of connections
              to server
                         lthreshold <INTEGER> # minimum number of connections
              to server

                         # Default VirtualHost string for HTTP_GET or SSL_GET
                         # eg virtualhost www.firewall.loc
                         # Overridden by virtualhost config of a checker
                         virtualhost <STRING>

                         alpha <BOOL>                    # see above
                         retry <INTEGER>                 # see above
                         delay_before_retry <INTEGER>    # see above
                         warmup <INTEGER>                # see above
                         delay_loop <INTEGER>            # see above
                         inhibit_on_failure <BOOL>       # see above

                         # healthcheckers. Can be multiple of each type

                         # All checkers have the following options, except
                         # which only has options alpha onwards:
                         CHECKER_TYPE {
                             # ======== generic connection options
                             # Optional IP address to connect to.
                             # The default is the realserver IP
                             connect_ip <IP ADDRESS>

                             # Optional port to connect to
                             # The default is the realserver port
                             connect_port <PORT>

                             # Optional address to use to
                             # originate the connection
                             bindto <IP ADDRESS>

                             # Optional interface to use; needed if
                             # the bindto address is IPv6 link local
                             bind_if <IFNAME>

                             # Optional source port to
                             # originate the connection from
                             bind_port <PORT>

                             # Optional connection timeout in seconds.
                             # The default is 5 seconds
                             connect_timeout <INTEGER>

                             # Optional fwmark to mark all outgoing
                             # checker packets with
                             fwmark <INTEGER>

                             alpha <BOOL>                    # see above
                             retry <INTEGER>                 # see above
                             delay_before_retry <INTEGER>    # see above
                             warmup <INTEGER>                # see above
                             delay_loop <INTEGER>            # see above
                             inhibit_on_failure <BOOL>       # see above

                         # The following options are additional checker

                         # HTTP and SSL healthcheckers
                             # An url to test
                             # can have multiple entries here
                             url {
                               #eg path / , or path /mrtg2/
                               path <STRING>
                               # healthcheck needs status_code
                               # or status_code and digest
                               # Digest computed with genhash
                               # eg digest 9b3a0c85a887a256d6939da88aabd8cd
                               digest <STRING>
                               # status code returned in the HTTP header
                               # eg status_code 200. Default is any 2xx value
                               status_code <INT>
                               # VirtualHost string. eg virtualhost
                               # If not set, uses virtualhost from real or
              virtual server
                               virtualhost <STRING>

                         # TCP healthchecker
                             # No additional options

                         # SMTP healthchecker
                             # Optional string to use for the SMTP HELO
                             helo_name <STRING>|<QUOTED-STRING>

                         # DNS healthchecker
                             # The retry default is 3.

                             # DNS query type
                             #   A|NS|CNAME|SOA|MX|TXT|AAAA
                             # The default is SOA
                             type <STRING>

                             # Domain name to use for the DNS query
                             # The default is . (dot)
                             name <STRING>

                         # MISC healthchecker, run a program
                             # The retry default is 0.

                             # External script or program
                             misc_path <STRING>|<QUOTED-STRING>
                             # Script execution timeout
                             misc_timeout <INT>

                             # If set, the exit code from healthchecker is
                             # to dynamically adjust the weight as follows:
                             #   exit status 0: svc check success, weight
                             #     unchanged.
                             #   exit status 1: svc check failed.
                             #   exit status 2-255: svc check success, weight
                             #     changed to 2 less than exit status.
                             #   (for example: exit status of 255 would set
                             #     weight to 253)
                             # NOTE: do not have more than one dynamic
              MISC_CHECK per real_server.

                             # Specify the username/groupname that the script
                             #   be run under.
                             # If GROUPNAME is not specified, the group of the
                             #   is used
                             user USERNAME [GROUPNAME]
                     } # realserver defn
                  } # virtual service

       Joseph Mack.
       Information derived from doc/keepalived.conf.SYNOPSIS,
       doc/samples/keepalived.conf.* and Changelog by Alexandre Cassen for
       keepalived-1.1.4, and from HOWTOs by Adam Fletcher and Vince

       ipvsadm(8), ip --help.

4th Berkeley Distribution          Apr 2016                 KEEPALIVED.CONF(5)