Table Of Contents
VRRP Router Priority and Preemption
Licensing Requirements for VRRP
Configuring VRRP Authentication
Configuring Time Intervals for Advertisement Packets
Configuring VRRP Interface State Tracking
Verifying the VRRP Configuration
Configuring VRRP
This chapter describes how to configure the Virtual Router Redundancy Protocol (VRRP) on a device
This chapter includes the following sections:
•
Licensing Requirements for VRRP
•
Information About VRRP
VRRP allows for transparent failover at the first-hop IP router, by configuring a group of routers to share a virtual IP address. VRRP selects a master router in that group to handle all packets for the virtual IP address. The remaining routers are in standby and take over in the event that the master router fails.
This section includes the following topics:
•
VRRP Operation
A LAN client can determine which router should be the first hop to a particular remote destination by using a dynamic process or static configuration. Examples of dynamic router discovery are as follows:
•
•
•
The disadvantage to dynamic discovery protocols is that they incur some configuration and processing overhead on the LAN client. Also, in the event of a router failure, the process of switching to another router can be slow.
An alternative to dynamic discovery protocols is to statically configure a default router on the client. Although, this approach simplifies client configuration and processing, it creates a single point of failure. If the default gateway fails, the LAN client is limited to communicating only on the local IP network segment and is cut off from the rest of the network.
VRRP can solve the static configuration problem by enabling a group of routers (a VRRP group) to share a single virtual IP address. You can then configure the LAN clients with the virtual IP address as their default gateway.
Figure 19-1 shows a basic VLAN topology. In this example, Routers A, B, and C form a VRRP group. The IP address of the group is the same address that was configured for the Ethernet interface of Router A (10.0.0.1).
Figure 19-1 Basic VRRP Topology
Because the virtual IP address uses the IP address of the physical Ethernet interface of Router A, Router A is the master (also known as the IP address owner). As the master, Router A owns the virtual IP address of the VRRP group r and forwards packets sent to this IP address. Clients 1 through 3 are configured with the default gateway IP address of 10.0.0.1.
Routers B and C function as backups. If the master fails, the backup router with the highest priority becomes the master and takes over the virtual IP address to provide uninterrupted service for the LAN hosts. When router A recovers, it becomes the r master again. For more information, see the "VRRP Router Priority and Preemption" section.
VRRP Benefits
The benefits of VRRP are as follows:
•
•
•
•
•
•
•
Multiple VRRP Groups
You can configure up to 255 VRRP groups on a physical interface. The actual number of VRRP groups that a router interface can support depends on the following factors:
•
•
In a topology where multiple VRRP groups are configured on a router interface, the interface can act as a master for one VRRP group and as a backup for one or more other VRRP groups.
Figure 19-2 shows a LAN topology in which VRRP is configured so that Routers A and B share the traffic to and from clients 1 through 4. Routers A and B act as backups to each other if either router fails.
Figure 19-2 Load Sharing and Redundancy VRRP Topology
In this topology contains two virtual IP addresses for two VRRP groups that overlap. For VRRP group 1, Router A is the owner of IP address 10.0.0.1 and is the master. Router B is the backup to router A. Clients 1 and 2 are configured with the default gateway IP address of 10.0.0.1.
For VRRP group 2, Router B is the owner of IP address 10.0.0.2 and is the master. Router A is the backup to router B. Clients 3 and 4 are configured with the default gateway IP address of 10.0.0.2.
VRRP Router Priority and Preemption
An important aspect of the VRRP redundancy scheme is the VRRP router priority because the priority determines the role that each VRRP router plays and what happens if the master router fails.
If a VRRP router owns the virtual IP address and the IP address of the physical interface, this router functions as the master. The priority of the master is 255.
Priority also determines if a VRRP router functions as a backup router and the order of ascendancy to becoming a master if the master fails.
For example, if router A, the master in a LAN topology, fails, VRRP must determine if backups B or C should take over. If you configure router B with priority 101 and router C with the default priority of 100, VRRP selects router B to become the master because it has the higher priority. If you configure routers B and C with the default priority of 100, VRRP selects the backup with the higher IP address to become the master.
VRRP uses preemption to determine what happens after a VRRP backup router becomes the master. With preemption enabled by default, VRRP will switch to a backup if that backup comes online with a priority higher than the new master. For example, if Router A is the master and fails, VRRP selects Router B (next in order of priority). If Router C comes online with a higher priority than Router B, VRRP selects Router C as the new master, even though Router B has not failed.
If you disable preemption, VRRP will only switch if the original master recovers or the new master fails.
VRRP Advertisements
The VRRP master sends VRRP advertisements to other VRRP routers in the same group. The advertisements communicate the priority and state of the master. Cisco NX-OS encapsulates the VRRP advertisements in IP packets and sends them to the IP multicast address assigned to the VRRP group. Cisco NX-OS sends the advertisements once every second by default, but you can configure a different advertisement interval.
VRRP Authentication
VRRP supports the following authentication mechanisms:
•
•
VRRP rejects packets in any of the following cases:
•
•
VRRP Tracking
VRRP uses the native tracking method to track interface states. You can track the state of an interface and use that state to determine the priority of the VRRP router in a VRRP group. If the tracked interface goes down, VRRP updates the priority based on what you configure the new priority to be for the tracked interface state. When the tracked interface comes up, VRRP restores the original priority for the virtual router group.
For example, you may want to lower the priority of a VRRP group member if its uplink to the network goes down so another group member can take over as master for the VRRP group.
High Availability
VRRP supports stateful restart. A stateful restart occurs on a supervisor switchover. Cisco NX-OS applies the runtime configuration after the switchover.
Virtualization Support
VRRP supports Virtual Routing and Forwarding instances (VRFs). VRFs exist within virtual device contexts (VDCs). By default, Cisco NX-OS places you in the default VDC and default VRF unless you specifically configure another VDC and VRF.
If you change the VRF membership of an interface, Cisco NX-OS removes all layer 3 configuration, including VRRP.
For more information, see the Cisco Nexus 7000 Series NX-OS Virtual Device Context Configuration Guide, Release 4.0 and see Chapter 14, "Configuring Layer 3 Virtualization."
Licensing Requirements for VRRP
The following table shows the licensing requirements for this feature:
Guidelines and Limitations
VRRP has the following guidelines and limitations:
•
•
•
•
•
Configuring VRRP
This section includes the following topics:
•
•
•
Note
Enabling the VRRP Feature
You must globally enable the VRRP feature before you can configure and enable any VRRP groups.
To enable the VRRP feature, use the following command in global configuration mode:
To disable the VRRP feature in a VDC, use the following command in global configuration mode:
no feature vrrp
Example:
switch(config)# no feature vrrp
Disables the VRRP feature in a VDC.
Configuring VRRP Groups
You can create a VRRP group, assign the virtual IP address, and enable the group.
You can configure one virtual IPv4 address for a VRRP group. By default, the master VRRP router drops the packets addressed directly to the virtual IP address because the VRRP master is only intended as a next-hop router to forward packets. Some applications require that Cisco NX-OS accept packets addressed to the virtual router IP. Use the secondary option to the virtual IP address to accept these packets when the local router is the VRRP master.
Once you have configured the VRRP group, you must explicitly enable the group before it becomes active.
BEFORE YOU BEGIN
Ensure that you are in the correct VDC (or use the switchto vdc command).
Ensure that you configure an IP address on the interface (see the "Configuring IPv4 Addressing" section on page 2-7.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Configuring VRRP Priority
The valid priority range for a virtual router is from 1 to 254 (1 is the lowest priority and 254 is the highest). The default priority value for backups is 100. For devices whose interface IP address is the same as the primary virtual IP address (the master), the default value is 255.
Note
BEFORE YOU BEGIN
Ensure that you have enabled the VRRP feature (see the "Configuring VRRP" section).
Ensure that you have configured an IP address on the interface (see the "Configuring IPv4 Addressing" section on page 2-7.
Ensure that you are in the correct VDC (or use the switchto vdc command).
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
DETAILED STEPS
Configuring VRRP Authentication
You can configure simple text authentication for a VRRP group.
Note
BEFORE YOU BEGIN
Ensure that the authentication configuration is identical for all VRRP devices in the network.
Ensure that you have enabled the VRRP feature (see the "Configuring VRRP" section).
Ensure that you have configured an IP address on the interface (see the "Configuring IPv4 Addressing" section on page 2-7.
Ensure that you are in the correct VDC (or use the switchto vdc command).
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
DETAILED STEPS
Configuring Time Intervals for Advertisement Packets
You can configure the time intervals for advertisement packets.
Note
BEFORE YOU BEGIN
Ensure that you have enabled the VRRP feature (see the "Configuring VRRP" section).
Ensure that you have configured an IP address on the interface (see the "Configuring IPv4 Addressing" section on page 2-7.
Ensure that you are in the correct VDC (or use the switchto vdc command).
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
DETAILED STEPS
Disabling Preemption
You can disable preemption for a VRRP group member. If you disable preemption, a higher-priority back up router will not take over for a lower-priority master router. Preemption is enabled by default.
Note
BEFORE YOU BEGIN
Ensure that you have enabled the VRRP feature (see the "Configuring VRRP" section).
Ensure that you have configured an IP address on the interface (see the "Configuring IPv4 Addressing" section on page 2-7.
Ensure that you are in the correct VDC (or use the switchto vdc command).
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
DETAILED STEPS
Configuring VRRP Interface State Tracking
Interface state tracking changes the priority of the virtual router based on the state of another interface in the device. When the tracked interface goes down, Cisco NX-OS assigns the tracking priority value to the virtual router. When the tracked interface comes up, Cisco NX-OS restores the configured priority to the virtual router (see the"Configuring VRRP Priority" section).
Note
Note
BEFORE YOU BEGIN
Ensure that you have enabled the VRRP feature (see the "Configuring VRRP" section).
Ensure that you have configured an IP address on the interface (see the "Configuring IPv4 Addressing" section on page 2-7.
Ensure that you have enabled the virtual router (see the "Configuring VRRP Groups" section).
Ensure that you are in the correct VDC (or use the switchto vdc command).
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
DETAILED STEPS
Verifying the VRRP Configuration
To verify VRRP configuration information, use the following commands:
Displaying VRRP Statistics
To display VRRP statistics, use the following commands:
show vrrp vr number interface interface-type port statistics
Displays the virtual router information.
show vrrp statistics
Displays the VRRP statistics.
Use the clear vrrp statistics command to clear all the VRRP statistics for all interfaces in the device.
Use the clear vrrp vr command to clear the IPv4 VRRP statistics for a specified interface.
Use the clear vrrp ipv4 command to clear all the statistics for the specified IPv4 virtual router.
VRRP Example Configuration
In this example, Router A and Router B each belong to three VRRP groups. In the configuration, each group has the following properties:
•
–
–
–
–
•
–
–
–
•
–
–
–
Router A
interface ethernet 1/0ip address 10.1.0.2/16no shutdownvrrp 1priority 120authentication text ciscoadvertisement-interval 3address 10.1.0.10no shutdownvrrp 5priority 100advertisement-interval 30address 10.1.0.50no shutdownvrrp 100no preemptaddress 10.1.0.100no shutdownRouter B
interface ethernet 1/0ip address 10.2.0.1/2no shutdownvrrp 1priority 100authentication text ciscoadvertisement-interval 3address 10.2.0.10no shutdownvrrp 5priority 200advertisement-interval 30address 10.2.0.50no shutdownvrrp 100no preemptaddress 10.2.0.100no shutdownDefault Settings
Table 19-1 lists the default settings for VRRP parameters.
Table 19-1 Default VRRP Parameters
advertisement interval
1 seconds
authentication
no authentication
preemption
enabled
priority
100
VRRP feature
disabled
Additional References
For additional information related to implementing VRRP, see the following sections:
Related Documents
