VRRP gives two or more routers a shared virtual IP so one can fail over to another. The contract is that exactly one is master at a time. When both decide they're master — split-brain — they both answer for the virtual IP and MAC, and traffic to the gateway becomes erratic: duplicate IPs, flapping ARP, intermittent drops.
1. Confirm both think they're master
show vrrp (or the platform equivalent) on each router shows its role and priority. Two routers both reporting Master for the same group is the definition of the problem. You'll often also see duplicate-IP warnings in the logs.
2. The root cause is almost always lost hellos
VRRP backups stay quiet only while they hear the master's advertisements. If those advertisements stop reaching the backup — a broken link between the pair, a blocked multicast (224.0.0.18), a VLAN/trunk fault, or a firewall dropping VRRP — the backup assumes the master is dead and promotes itself. Now both transmit. So the fix is usually restoring the peer communication path, not touching VRRP at all.
3. Rule out config faults
If comms are fine, check that both ends share the same VRID, virtual IP, and authentication, and that advertisement timers match. A VRID or auth mismatch means they never recognise each other as the same group, so neither ever backs down.
4. Recover cleanly
After fixing the underlying link or config, reset the VRRP group state so the routers re-run the election instead of both holding master — and confirm priority and preempt are set so the intended router wins. One master, one backup, virtual IP stable.
Practise network incidents
VRRP failover / split-brain is among the router incidents in the simulator (needs the Network Diagnostics skill to reveal the hint). Work it in a full incident response shift.