ProductsVRRP Introduction
Normally, you can configure a default route to the gateway for every host on a network, allowing all packets destined to the external networks to be sent over the default route to the gateway. This enables hosts on a network to communicate with external networks. However, when the gateway fails, all the hosts using the gateway as the default next-hop router are isolated from the external network.
Apparently, this approach to enabling hosts on a network to communicate with external networks is easy to configure but it imposes a very high requirement of performance stability on the device acting as the gateway. A common way to improve system reliability is to use more egress gateways, introducing the problem of routing among the multiple egresses.
Virtual Router Redundancy Protocol (VRRP) was designed to address this problem. Deploying VRRP on multicast and broadcast LANs such as Ethernet, you can assure that the system can still provide highly reliable default links without changing configurations when a device fails.
There are two VRRP versions: VRRPv2 and VRRPv3. VRRPv2 is based on IPv4, while VRRPv3 is based on IPv6. The two versions implement the same functions but provide different commands.
Basic Concepts of VRRP
VRRP Standby Group
VRRP combines a group of routers on a LAN (including a master and multiple backups) into a virtual router called standby group.
The VRRP standby group has the following features:
l A host on the LAN only needs to know the IP address of the virtual router and uses the IP address as the next hop of the default route.
l Every host on the LAN communicates with external networks through the virtual router.
l Routers in the standby group use a certain election mechanism to elect the gateway. Once the router acting as the gateway fails, the other routers in the standby group elect a new gateway to undertake the responsibility of the failed router.
Figure 1 Network diagram for a virtual router
As shown in Figure 1, Router A, Router B, and Router C form a virtual router, which has its own IP address. Hosts on the Ethernet use the virtual router as the default gateway.
In fact, only one of the three routers acts as the gateway, and the other two are backups.
Caution:
l The IP address of the virtual router can be either an unused IP address on the segment where the standby group resides or the IP address of an interface on a router in the standby group. In the latter case, the router is called the IP address owner.
l In a VRRP standby group, there can only be one IP address owner.
VRRP Priority
VRRP determines the role (master or backup) of each router in the standby group by priority. A router with a higher priority has more opportunity to become the master.
Preemption Mode
l In non-preemption mode, once a router in the standby group becomes the master, it stays as the master as long as it operates normally, even if a backup router is assigned a higher priority later.
l In preemption mode, once a backup router finds its priority higher than that of the router acting as the master, it becomes the master. Accordingly, the original master becomes a backup.
Interface Tracking
The interface tracking function expands the backup functionality of VRRP. It provides backup not only when the interface to which a standby group is assigned fails but also when other interfaces on the router become unavailable. This is achieved by tracking interfaces. When a monitored interface goes down, the priority of the router owning the interface is automatically decreased by a specified value, allowing a higher priority router in the standby group to become the master.
Authentication Mode
VRRP provides two authentication modes:
l Simple: Simple text authentication
l MD5: MD5 authentication
On a secure network, you can configure the routers not to perform authentication. In this case, neither the routers sending VRRP packets nor the routers receiving the VRRP packets perform authentication.
On a network where potential threats are present, you can set the authentication mode to simple. In this case, a router fills the authentication key into the VRRP packet before sending the packet out, while the router receiving the VRRP packet compares the authentication key in the packet with its own. If they are the same, the packet is considered genuine and legitimate; otherwise, the packet is considered illegitimate and is discarded.
On an insecure network, you can set the authentication mode to MD5. This allows the router to encrypt VRRP packets using the authentication key and the MD5 algorithm and then save the encrypted packet in the authentication header (AH). The router receiving the VRRP packet uses the authentication key to decrypt and validate the packet.
Format of VRRP Packets
VRRP uses multicast packets. The router acting as the master sends VRRP packets periodically to declare its existence. VRRP packets are also used for checking the parameters of the virtual router and electing the master.
IPv4-based VRRP Packet Format
Figure 2 IPv4-based VRRP packet format
As shown in Figure 2, an IPv4-based VRRP packet consists of the following fields:
l Version: Version number of the protocol, 2 for VRRPv2.
l Type: Type of the VRRP packet. Only one VRRP packet type is present, that is, VRRP advertisement, which is represented by 1.
l Virtual Rtr ID (VRID): Number of the virtual router, that is, number of the standby group. It ranges from 1 to 255.
l Priority: Priority of the router in the standby group, in the range 0 to 255. A greater value represents a higher priority. The priority of 0 is reserved for special purposes, while 255 is reserved for the IP address owner.
l Count IP Addrs: Number of virtual IP addresses for the standby group. A standby group can have multiple virtual IP addresses.
l Auth Type: Authentication type. 0 means no authentication, 1 means simple authentication, and 2 means MD5 authentication.
l Adver Int: Interval for sending advertisement packets, in seconds. The default is 1.
l Checksum: 16-bit checksum for validating the data in VRRP packets.
l IP Address: Virtual IP address entry of the standby group. The allowed number is given by the Count IP Addrs field.
l Authentication Data: Authentication key. Currently, this field is used only for simple authentication and is 0 for any other authentication modes.
IPv6-based VRRP Packet Format
Figure 3 IPv6-based VRRP packet format
As shown in Figure 3, an IPv6-based VRRP packet consists of the following fields:
l Version: Version number of the protocol, 3 for VRRPv3.
l Type: Type of the VRRP packet. Only one VRRP packet type is present, that is, VRRP advertisement, which is represented by 1.
l Virtual Rtr ID (VRID): Number of the virtual router, that is, number of the standby group. It ranges from 1 to 255.
l Priority: Priority of the router in the standby group, in the range 0 to 255. A greater value represents a higher priority. The priority of 0 is reserved for special purposes, while 255 is reserved for the IP address owner.
l Count IPv6 Addrs: Number of virtual IPv6 addresses for the standby group. A standby group can have multiple virtual IPv6 addresses.
l Auth Type: Authentication type. 0 means no authentication, 1 means simple authentication. VRRPv3 does not support MD5 authentication.
l Adver Int: Interval for sending advertisement packets, in centiseconds. The default is 100.
l Checksum: 16-bit checksum for validating the data in VRRPv3 packets.
l IPv6 Address: Virtual IPv6 address entry of the standby group. The allowed number is given by the Count IPv6 Addrs field.
l Authentication Data: Authentication key. Currently, this field is used only for simple authentication and is 0 for any other authentication modes.
Principles of VRRP
l With VRRP enabled, the routers determine their respective roles in the standby group by priority. The router with the highest priority becomes the master, while the others are the backups. The master sends VRRP advertisement packets periodically to notify the backups that it is working properly, and each of the backups starts a timer to wait for advertisement packets from the master.
l In preemption mode, when a backup receives a VRRP advertisement packet, it compares the priority in the packet with that of its own. If its priority is higher, it becomes the master; otherwise, it remains a backup.
l In non-preemption mode, the router in the standby group remains as a master or backup as long as the master does not fail. The backup will no become the master even if the former is configured with a higher priority.
l If the timer of a backup expires but the backup still does not receive any VRRP advertisement packet, it considers that the master fails and starts the election process to elect a new master for forwarding packets.
Operation Modes of VRRP (Taking IPv4-Based VRRP for Example)
Master/Backup
In master/backup mode, only one router, the master, provides services. When the master fails, a new master is elected from the original backups. This mode requires only one standby group, in which each router holds different priorities and the one with the highest priority becomes the master, as shown in Figure 4.
Figure 4 VRRP in master/backup mode
At the beginning, Router A is the master and therefore can forward packets to external networks, while Router B and Router C are backups and are thus in the state of listening. If Router A fails, Router B and Router C will elect for the new master. The new master takes over the forwarding task to provide services to hosts on the LAN.
Load Balancing
You can create more than one standby group on an interface of a router, allowing the router to be the master of one standby group but a backup of another at the same time.
In load balancing mode, multiple routers provide services at the same time. This mode requires two or more standby groups, each of which includes a master and one or more backups. The masters of the standby groups can be assumed by different routers, as shown in Figure 5.
Figure 5 VRRP in load balancing mode
A router can be in multiple standby groups and hold a different priority in different group.
In Figure 5, three standby groups are present:
l Standby group 1: Router A is the master; Router B and Router C are the backups.
l Standby group 2: Router B is the master; Router A and Router C are the backups.
l Standby group 3: Router C is the master; Router A and Router B are the backups.
For load balancing among Router A, Router B, and Router C, hosts on the LAN need to be configured to use standby group 1, 2, and 3 as the default gateways respectively. When configuring VRRP priorities, ensure that each router holds such a priority in each standby group that it will take the expected role in the group.
