{"id":1640,"date":"2022-02-19T17:18:08","date_gmt":"2022-02-19T17:18:08","guid":{"rendered":"http:\/\/thechotacode.com\/?p=1640"},"modified":"2022-04-08T04:51:03","modified_gmt":"2022-04-08T04:51:03","slug":"vrrp-in-depth","status":"publish","type":"post","link":"https:\/\/thechotacode.com\/?p=1640","title":{"rendered":"VRRP IN DEPTH"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

As you see in the thumbnail, that network diagram we are going to implement and follow various scenarios of VRRP working in detail with packet flow. This is practical design on customer site connected to MPLS , devices and link are kept independent for <\/b>Redundancy<\/b><\/span>.\u00a0 Generally 2 Links are used however I tried with Tertiary link too.<\/b><\/span><\/p>

Configuration of all PE and Routers are in the snapshot below. Since the study is on VRRP we can Pre-build the network with config and keep it ready.<\/span><\/strong><\/p>

PE Configuration:-\u00a0<\/strong><\/span><\/p>

\"\"<\/p>

\u00a0<\/p>

Router Configuration:-\u00a0 R2 VRRP Config need Track 1 decrement 10 (Please correct)<\/strong><\/span><\/p>

\"\"<\/p>

VRRP Status:-<\/span><\/strong><\/span><\/p>

\"\"<\/p>

\u00a0<\/p>

Tracking Method:-<\/span><\/strong> It really depends on the design how we got to track the Main link for <\/b>fail over<\/b><\/span>. General practice is to track the route which is consistent because other tracking method can create high flapping causing problems to Router functioning.<\/b><\/p>

\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span><\/strong>1.<\/span><\/strong> IP<\/span><\/strong> SLA<\/span><\/strong> based<\/span><\/strong> Object<\/span><\/strong> Tracking<\/span><\/strong>
We practice this <\/b>scenario<\/b><\/span> when there isn’t routing protocol on WAN interface, and high latency is observed in WAN then we could use multiple logic in IP SLA way of tracking. One of that is sending ICMP packets to certain IP on WAN side and in the event of <\/b>packet loss<\/b><\/span> there will be track down causing the <\/b>fail over<\/b><\/span>. There can various feature on ICMP that can be tracked like latency, jitter etc even the <\/b>start time<\/b><\/span> and end-times can be set.<\/b><\/p>

R1(config)#track 1 ip sla 1 reachability<\/span><\/strong>
R1(config)#ip sla 1<\/span><\/strong>
R1(config)#icmp-echo 8.8.8.8<\/span><\/strong>
R1(config)#ip sla schedule 1 life forever start-time now<\/span><\/strong><\/p>

\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 2.<\/span><\/strong> Route lookup based Object Tracking<\/span><\/strong>
This is ideally way however this requires a routing protocol to be there in WAN link, the routes will go off only when the timers expires for it and restoration also been maintained with timer. hence Flapping\u00a0of Tracks would not be that frequent maintaining the sanity of the Router process.<\/b><\/span><\/span><\/p>

R1(config)#track 1 ip route 8.8.8.8 255.255.255.255 reachability<\/span><\/strong><\/p>

\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span><\/strong>3.<\/span><\/strong> Interface based Object Tracking.<\/span><\/strong><\/p>

This will track the line protocol status of the WAN interface connecting Main link. However has the drawback if the link is connected with many intermediate devices then end device link status remains always up even if the intermediate devices goes down.\u00a0 <\/span><\/strong>If the interface flap occurs then that would cause track to flap in high frequency causing the fail-over\u00a0too frequent for the network.<\/b><\/span><\/span><\/p>

R1(config)#track 1 interface gigabitEthernet 1\/0 line-protocol<\/span><\/strong>
R1(config-track)#exit<\/span><\/strong><\/p>

\u00a0<\/p>

Normal Scenario:-<\/strong><\/span> We are going to remove all the VRRP config from Routers and configure one by one and how the behavior <\/strong><\/span>will be is explained <\/strong><\/span><\/p>

1. When you configure the first interface of VRRP that will become Master and it will send broadcast announcement every second to Multicast IP.<\/span><\/strong>
Source MAC:- 5e:1:1 (last digit is group Number of VRRP) to Destination MAC 5e::12<\/span><\/strong>
Source IP:- physical IP i.e. 50.0.0.2 and Destination IP:- 228.0.0.18 Multicast<\/span><\/strong><\/p>

Announcement\u00a0Packet<\/b><\/span><\/p>

\"\"<\/p>

2. As soon as the second interface is configured in that VRRP Group it becomes from Init to Backup, and interface listen for few seconds if any VRRP protocol announcement is coming from any Master. If any announcement is received then it verifies the priority with its own priority. If its own priority is lower then annouced Master value, then it will simply listen and keep comparing. Remember all the backup devices will never send any updates or keep alive or announcement in the Network, it will just listen to Master announcements only.<\/b><\/span><\/p>

Logs as you see interface came UP and become backup, receives announcement from 50.0.0.2 with priority 105 and compares all the time.<\/b><\/span><\/p>

\"\"<\/p>

But if second interface which is configured is of higher priority then the Master <\/b>announcement<\/b><\/span>, then it will make Event \u2013 Master down and will become Master by sending Gratuitous ARP and start broadcasting announcement every second. The <\/b>announcement<\/b><\/span> will have the details of all as in below with <\/b>priority<\/b><\/span> value.<\/b>
Source MAC:- 5e:1:1 (last digit is group Number of VRRP) to Destination MAC 5e::12<\/b>
Source IP:- physical IP i.e. 50.0.0.3 and Destination IP:- 228.0.0.18 Multicast<\/b><\/p>

Log as you see it remained in backup but after putting\u00a0the command 110 priority, the announcement of Master priority 105 is compared with 110 in couple of second it made event Master down. It became Backup and started sending\u00a0<\/b><\/span>Announcement:-<\/b><\/span><\/p>

\"\"<\/p>

\"\"<\/p>

Note:-<\/span>\u00a0 Whenever the Master change happens there will be three Gracious ARP generated Broadcast and UplinkFast, It will have opcode 2 which states the switch to update the MAC address. I\u2019m not sure if UplinkFast is anything to do with STP but the other Broadcast informs the Switch to update MAC three times each time a Master change happen. Above is the 3 times of packet in network.<\/strong><\/span><\/p>

Below shown packet of Gracious ARP And UplinkFast:-<\/span><\/strong><\/p>

\"\"<\/p>

\"\"<\/p>

3. When the third interface comes up in the same VRRP group, it will start from INIT to Backup and then listen for any VRRP announcement, compares its priority and stays in Backup if priority is lower. It will not advertise anything out until the priority is less. If higher then it will follow the above step 2 of making Event Master down and becoming Master followed by broadcasting announcement. Also If no announcement is listened during activation for 3 sec then it will become Master and start sending announcement.<\/b><\/span><\/span><\/p>

Logs of interface coming up and becoming Backup followed by listening to <\/b>announcement<\/b><\/span>\u00a0of Master and it comparing its own priority.<\/b><\/p>

\"\"<\/p>

\u00a0<\/h5>

Failover 1:-<\/span>\u00a0 In the event of Track going down for various reason of WAN failure, then fail-over will happen. Behavior of other Routers is explained.<\/span><\/strong><\/span><\/p>

Primary link is down or Route 8.8.8.8 is not received, then track would go down causing the priority to be decrement by 20 then Master will change its priority and make the announcement to all, as you can see below.<\/strong><\/span><\/p>

When track goes down the priority is decreased by 20, hence Master announcing with priority 90 now from 110.<\/span><\/strong><\/p>

\"\"<\/p>

\"\"<\/strong><\/p>

In my understanding, Now the New Master 50.0.0.3 makes a Gratuitous<\/span> ARP with opcode 2 to L2 Broadcast FF:FF to make a MAC entry change to L2 domain. <\/strong><\/span>This is merely informing all the L2 devices to flush the MAC and update with new MAC for destination IP 50.0.0.1<\/strong><\/span>
Source MAC:- 5e:1:1 (last digit is group Number of VRRP) to Destination MAC FF::FF<\/strong><\/span>
Source IP:- physical IP i.e. 50.0.0.1 and Destination IP:- 50.0.0.1<\/strong><\/span><\/p>

Packet of Gratuitous\u00a0ARP followed by STPUplink:-<\/b><\/span><\/p>

\"\"<\/p>

50.0.0.3 Announcement<\/span> of priority 110 in the network.\u00a0<\/span><\/strong><\/span><\/p>

\"\"<\/p>

\u00a0<\/h5>

Also you can see R3 is also becoming Master and sending a Gracious ARP by making an announcement, this is because announcement sent by Master 50.0.0.1 was having priority 90 hence R3 which is priority 100 become master and sent gracious ARP followed by announcement. However during this time there wasn’t any R2 announcement received that’s why R3 felt it has Master.\u00a0 <\/strong><\/span>But as soon as the announcement of R2 50.0.0.3 is came to R3, the priority is compared and R3 become Backup and stopped announcement.<\/strong><\/span><\/p>

Gratious ARP of R3 sent:-<\/span><\/strong><\/p>

\"\"<\/p>

R3 Annoucement:-<\/span><\/strong><\/p>

\"\"<\/span><\/strong><\/p>

As you can see Primary track going down and respective R2 and R3 routers changing its state accordingly.<\/span><\/strong><\/p>

\"\"<\/h5>
\u00a0<\/h5>

Failover 2:-<\/span> In the Event of R2 going down, while R1 is also still down. Then R2 will make priority to 85 by decrementing 20 and R3 would receive priority 90 then it will compare to its own which is default 100. Then will make the event of Master down followed by sending Gratuitous<\/span>\u00a0ARP. Then it will start announcement<\/span>\u00a0by becoming Master. You can imagine the packet flow.<\/span><\/strong><\/p>

Fallback :-<\/span> When primary link goes up the track will up and priority will become 110 again, the behavior of other Routers is explained.<\/span><\/strong>
Now R1 will become Master as its priority is 110 when compared to R2 announcement<\/span>\u00a0of 105. Hence R1 will send Gratuitous<\/span>\u00a0ARP followed by its announcement<\/span>.<\/span><\/strong>
Note:- After each Master change there are 3 Gratuitous<\/span>\u00a0ARP sent with opcode 2 to make a MAC flush and update with New MAC for 50.0.0.1 IP in L2 devices.<\/span><\/strong><\/p>

Packet of R1 Taken over:-<\/span><\/strong><\/p>

\"\"<\/span><\/strong><\/p>

Logs:-<\/span><\/strong><\/p>

\"\"<\/p>

R3 Stays silent as its priority is still less from previous announcement.<\/span><\/strong><\/p>

\"\"<\/p>

Note :- <\/span>\u00a0 We don’t have to worry much about two more cases, where the secondary link goes down while primary is still up. As primary would stay Master and will receive traffic, the election will happen for Backup state based on priority. Also in the event of tertiary link goes down while primary and sec is still up, will be null event as in VRRP priority is mostly to find Master and Backup.<\/span><\/strong><\/p>

\u00a0<\/p>

Special USED CASE 1:-<\/span> \u00a0PRI And SEC is MASTER and MASTER.When link between Switches go Down or if there is issue in Switch configuration due to which L2 packet of VRRP can’t flow between routers.\u00a0 <\/span><\/strong>Even chances are there of Router LAN interface having ACL which blocks VRRP packets. In such case both Primary and Secondary stays Master.<\/span><\/strong><\/p>

\"\"<\/p>

As you can see the announcement of Primary Master is always going on since there is no new announcement received to compare, hence the Primary will be always Master. However the Secondary stopped receiving announcement from Master hence it will make the Master timer down, make its state to Master and start sending advertisement. The end user of switch 1 will send their traffic to R1 as switch 1 will have the MAC for 50.0.0.1 and users of switch 2 will send their traffic to R2 as this also holds MAC for 50.0.0.1. This behavior can happen if there is ACL in Router LAN interface which blocks the VRRP packets.<\/strong><\/span><\/p>

\"\"<\/p>

\u00a0<\/p>

Special USED CASE 2:-\u00a0 <\/span>There can be situation we had to use \/30 in LAN with failover needed, VRRP can come handy. In VRRP we can use the physical IP also as VRRP IP, however the router which holds the physical IP as VRRP IP will by-default has the priority of 255 and always stays as MASTER, it will over rule the priority configured in Interface.<\/span><\/span><\/strong><\/p>

\"\"
In this example, I purposefully used VRRP IP: 50.0.0.2 using the Secondary Physical IP. Though the primary has the priority of 120, and Track is UP too. The secondary becomes the Master due to higher priority. Hence whenever you use physical IP as VRRP IP, make sure it is always used for Primary Physical IP.<\/strong><\/span><\/p>

R1:- Primary Config.<\/strong><\/span><\/p>

interface GigabitEthernet1\/0<\/strong><\/span>
ip address 50.0.0.2 255.255.255.252<\/strong><\/span>
negotiation auto<\/strong><\/span>
vrrp 1 ip 50.0.0.3<\/strong><\/span>
vrrp 1 priority 110<\/strong><\/span>
vrrp 1 track 1 decrement 20<\/strong><\/span><\/p>

R2:- Secondary Config.<\/strong><\/span><\/p>

interface GigabitEthernet1\/0<\/strong><\/span>
ip address 50.0.0.3 255.255.255.252<\/strong><\/span>
negotiation auto<\/strong><\/span>
vrrp 1 ip 50.0.0.3<\/strong><\/span>
vrrp 1 priority 105<\/strong><\/span>
end<\/strong><\/span><\/p>

When Interface is activated, it became Master.<\/strong><\/span><\/p>

\"\"<\/p>

When Sec port came up, it checks VRRP IP with its physical and immediately become Master<\/strong><\/span><\/p>

\"\"<\/p>

\u00a0<\/span><\/strong><\/p>

R1 was Master initially sending advertisement with Priority of 110.\u00a0<\/span><\/strong><\/p>

\"\"<\/p>

R2 become master having priority 255, though the configured value on interface is 105.<\/span><\/strong><\/p>

\"\"<\/p>

Note:-\u00a0 All designated gateway packets coming from end user are in same L2 domain so underlined switch will observe the MAC only, Since only the Master is advertising all the time as broadcast with source MAC 5e:1:1 and Destination MAC 5e::12 Multicast. The Switches will cache the MAC 5e:1:1 of Master in respective port it received each time. Whenever the gateway packet comes the switch will look at the last port that have the MAC 5e:1:1 will forward to that port in turn going to Router which is the Master having Gateway IP and\u00a0 forwards to WAN.<\/b><\/span><\/p>

Some VRRP Interview Questions:-<\/strong><\/span><\/span><\/p>

1. What is VRRP?<\/strong><\/span><\/p>

Ans:-\u00a0 VRRP stands for Virtual Router Redundancy Protocol<\/strong><\/span>
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0VRRP is an IP routing redundancy protocol designed to allow for transparent\u00a0failover at the first-hop IP router.<\/b><\/span><\/p>

2. What is the protocol number of VRRP?<\/span><\/strong><\/p>

Ans:- 112<\/span><\/strong><\/p>

3. What is the use of VRRP?<\/span><\/strong><\/p>

Ans:- VRRP is used to provide default gateway redundancy<\/span><\/strong><\/p>

4. What is the default VRRP Proirity?<\/span><\/strong><\/p>

Ans:- The default VRRP Priority\u00a0is 100<\/b><\/span>
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0You can configure the priority of each backup virtual router with a value of 1 through 254 using the VRRP priority command.<\/span><\/strong><\/p>

5. What are the VRRP default hello and hold down Timers.<\/span><\/strong><\/p>

Ans:- Hello timer is 1 sec and Hold Down Timer – 3<\/span><\/strong><\/p>

6. Which protocol is used in VRRP to communicate with other routers?<\/strong><\/span><\/p>

Ans:-\u00a0 IP Protocol 112 is used in VRRP to communicate with other routers.
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Which Multicast IP address is used in VRRP?Multicast IP 224.0.0.18 is used in VRRP.<\/span><\/strong><\/p>

7. Is it necessary to configure Preempt command in VRRP?<\/span><\/strong><\/p>

Ans:-\u00a0 No, by default Preemption is enabled in VRRP.<\/span><\/strong><\/p>

8. How we can achieve rudundancy if WAN link is down?<\/strong><\/span><\/p>

Ans:- By using Event Tracking, we can achieve redundancy if WAN link down by decreasing the VRRP Priority.<\/span><\/strong>
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Decreased priority should be less then Backup Priority.<\/span><\/strong><\/p>

9. Which IP address will get in trace-route physical or Virtual IP?<\/span><\/strong><\/p>

Ans:- Physical IP address<\/span><\/strong><\/p>

10. Is it possible to use a real interface IP address as a Virtual address in VRRP?<\/span><\/strong><\/p>

Ans:- Yes, you can use physical inteface IP as vritual IP address.<\/strong><\/span><\/p>

11. What is the role of Master Router in VRRP?<\/span><\/strong><\/p>

Ans:-\u00a0 The master router takes up the responsibility of forwarding the local traffic<\/span><\/strong>
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0The router in VRRP is elected as a master router on the basis of priority, if some group memmber of VRRP group has higher priority than others then itwill be elected as Master router.<\/span><\/strong><\/p>

12. Which is the VRRP Virtual MAC Address?<\/strong><\/span><\/p>

Ans:- VRRP Virtual MAC Adress – 0000.5E00.01xx –\u00a0 “xx” – hexadecimanl group number of VRRP.<\/span><\/strong><\/p>

Thank you for the read this far, wish you good luck!!<\/strong><\/span><\/p>\"1\"2\"3\"4\"5 (5<\/strong> votes, average: 4.60<\/strong> out of 5)
<\/span><\/span>Loading…<\/span>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

As you see in the thumbnail, that network diagram we are going to implement and follow various scenarios of VRRP working in detail with packet flow. This is practical design on customer site connected to MPLS , devices and link are kept independent for Redundancy.\u00a0 Generally 2 Links are used however I tried with Tertiary…<\/p>\n","protected":false},"author":2,"featured_media":1801,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[13],"tags":[],"class_list":["post-1640","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ip-tech","wpcat-13-id"],"_links":{"self":[{"href":"https:\/\/thechotacode.com\/index.php?rest_route=\/wp\/v2\/posts\/1640","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thechotacode.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thechotacode.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thechotacode.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/thechotacode.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1640"}],"version-history":[{"count":174,"href":"https:\/\/thechotacode.com\/index.php?rest_route=\/wp\/v2\/posts\/1640\/revisions"}],"predecessor-version":[{"id":2357,"href":"https:\/\/thechotacode.com\/index.php?rest_route=\/wp\/v2\/posts\/1640\/revisions\/2357"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thechotacode.com\/index.php?rest_route=\/wp\/v2\/media\/1801"}],"wp:attachment":[{"href":"https:\/\/thechotacode.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1640"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thechotacode.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1640"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thechotacode.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1640"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}