What is a Virtual IP Address?

A Virtual IP Address (VIP) is an IP address not bound to a single physical network interface. Instead, it moves between devices or fronts a service, so traffic keeps flowing when the underlying hardware changes – the address VRRP shares among redundant routers, or the front-end address of a load-balanced application.

Key takeaways

• A VIP is an IP address that isn’t tied to one physical interface.
• VRRP shares a VIP between an active router and standby backups.
• Load balancers publish a VIP as a service’s single front-end address.
• Failover moves a VIP to a healthy device without reconfiguring clients.
• Versa gateways configure a VIP on a VLAN profile to enable VRRP failover.

On this page: Why it matters · How it works · Types · Virtual IP Addresses & Versa · FAQ

Why are virtual IP addresses important?

A physical address ties a service to one piece of hardware; if that hardware fails, every client holding the old address breaks. A VIP decouples the address clients use from whichever device currently answers for it, so a failover or maintenance window changes the hardware underneath without clients noticing.

That decoupling underlies two common patterns: first-hop redundancy, where a LAN’s gateway keeps answering even if the primary router dies, and load balancing, where many backend servers share one public-facing address. Without a VIP, both need manual DNS re-pointing during every failure; with one, failover is a routing-table update measured in seconds.

What is a virtual IP address?

A VIP is an IP address advertised rather than permanently bound to one interface’s hardware. It is configured on more than one device, or fronts more than one backend, and a protocol or control plane decides at any moment which device currently owns it.

Two mechanisms make this work. With address ownership, a protocol such as VRRP elects one router as master; it answers for the VIP, and if it fails, a backup detects the missed hellos and takes over within seconds. With address fronting, a load balancer terminates the VIP as a single published address, then distributes traffic across backend addresses clients never see. Either way, the client-facing address stays stable while the infrastructure behind it changes.

Types of virtual IP addresses

Gateway (first-hop redundancy) VIPs are shared by two or more routers through VRRP or a similar protocol such as HSRP or CARP; the active router answers, and a backup takes over on failure, typically serving as the LAN’s default gateway. Load-balancer front-end VIPs are the single published address of a load-balanced service; the load balancer maps it to a pool of backend servers and can add or remove servers without changing the address clients use. Cluster (failover) VIPs are bound to whichever node in an active-standby cluster currently holds a resource, moving with it on failover. Anycast VIPs are the same address advertised from multiple, distributed locations through BGP; routing decides which location answers a client – how CDNs and DNS root servers scale.

Virtual IP Addresses & Versa

Versa SASE gateway devices configure a VIP as part of a VLAN profile’s VRRP settings: enabling VRRP exposes a Virtual IP Address field, which must share the VLAN’s IP subnet, and a Priority field (range 1–255, default 100) that determines which router becomes the VRRP active router. The virtual IP address then serves as the default gateway for hosts on that LAN segment; if the active router fails, a backup with the next-highest priority takes over within about 3 seconds, or 22 seconds if all its WAN connections go down. Titan Portal automatically creates a supporting IP SLA monitor when a SASE gateway is activated, using ICMP to track LAN reachability. The same model applies per tenant on multitenant gateway devices. See Configure and Activate SASE Gateway Devices and Configure and Activate Multitenant Gateway Devices for the full steps.

Frequently asked questions

What is the difference between a virtual IP address and a physical IP address?

A physical IP address is bound to one interface on one device; if that device fails, the address goes with it. A virtual IP address is logical – any of several devices, or a load balancer’s backend pool, can answer for it, so it survives a single device’s failure.

How does VRRP use a virtual IP address for failover?

VRRP elects one router as master among a group sharing the same virtual IP address; the master answers for it and forwards traffic. If its hello messages stop, the backup with the next-highest priority takes over the address within seconds – with no client reconfiguration.

What is the difference between a VIP and a floating IP?

The terms largely overlap. “Floating IP” is the common cloud-platform name for an address an administrator reassigns between instances on demand. “VIP” is the broader networking term for any address shared or moved between devices, including VRRP gateways and load balancers.

Can a virtual IP address serve clients in multiple locations at once?

Yes, through anycast: the same VIP is advertised from multiple sites via BGP, and routing sends each client to the nearest advertising location. This differs from VRRP or load-balancer VIPs, where the address is active at one site or one cluster at a time.

How does Versa configure a virtual IP address for gateway redundancy?

On a SASE gateway’s VLAN profile, enabling VRRP exposes a Virtual IP Address field and a Priority field (1–255, default 100); the highest-priority router becomes active and answers for the address, with a backup taking over automatically within seconds if it fails.

More on virtual IP addresses

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about virtual IP addresses, these are worth looking at next.