For topology, see the attachment.
The interface interconnecting both AR28-11A and S3528GA is divided into three sub-interfaces, and encapsulated with vlan 1, 2 and 3.
The interface interconnecting both AR28-11B and S3528GB is divided into three sub-interfaces, and encapsulated with Vlan1, 2 and 3 respectively.
Set the three sub-interfaces to VRRP, and AR28-11A serves as the master of both VRRP 1 and 3, and AR28-11B as the master of VRRP 2.
At S3528G, only the interface connecting to the router and S3528G is configured as Trunk to permit all Vlans through.
Now, both VRRP 2 and VRRP 3 work well, and VRRP 1 is shown as master at two AR28-11s.
1. Change the PVID of Trunk interface of S3528G, and make it differ from that of three VLANs configured for VRRP.
2. Change the configurations of AR28-11, and do not use Vlan1 for VRRP. At S3528G, create another VLAN to permit the vlan 1 through.
According to the configurations of S3528G, the PVID of all Trunk interfaces is 1. Thus, the packets in Van1 do not contain vlan tag when they are sent to AR28-11. This is because all vlans are terminated at AR28-11. Moreover, the router can only identify the packets with vlan tag, and the packets to the router from Vlan1 do not have vlan tag, so two AR28-11s cannot communicate in Vlan1; VRRP heartbeat packets cannot receive correctly. As a result, two AR28-11s regard themselves as the master of VRRP 1.
It is not suggested to use vlan 1 when the router is configured with sub-interfaces to enable VRRP.