What is VRRP, Why we use it, and How to configure it on Cisco devices?
Virtual Router Redundancy Protocol (VRRP) is an open standard FHRP (First Hop Redundancy Protocol) defined in RFC-5798. VRRP on Cisco devices can be configured to provide fault tolerance and redundancy at the network layer by quickly detecting and responding to router failures. It is designed to create redundancy in the network, especially when a router/switch or a layer 3 node serving as the default gateway for LAN users fails.
Virtual Router Redundancy Protocol operates on the principle of a group of routers, or hosts, participating in an election process to determine a single “master” router to provide the service of forwarding traffic. All routers configured with vrrp can participate in this election process, and the router with the highest priority becomes the master. And if the router with the highest priority fails, the router with the next highest priority takes ownership of the election process and wins it.
In this blog post, we will take a deep dive into cisco vrrp configuration.
You can also check another deep dive blog post about similarities and differences between VRRP, HSRP, and GLBP.
Take a look at this short video to get a quick overview of the VRRP.
Benefits of VRRP on Cisco devices
- Redundancy – You can configure multiple routers as the default gateway router instead of one, which decreases the risk of a single point of failure in a network.
- Load Sharing – You can use Virtual Router Redundancy Protocol to share LAN traffic by multiple routers, which will reduce the workload on each router.
- Multiple Virtual Routers – On a router, Virtual Router Redundancy Protocol supports up to 255 VRRP groups or virtual routers and can support up to four virtual routers on each interface. You can use multiple virtual routers in your LAN to provide redundancy and load sharing.
- Multiple IP Addresses – Virtual router can handle multiple IP addresses, including secondary IP addresses, making it a great option when you have more than one subnet configured on an Ethernet interface.
- Preemption – You can use preemption to ensure that the actual master virtual router (with the high priority) preempts the current backup vrrp router (with low priority) when it comes back online.
- Authentication – Virtual Router Redundancy Protocol supports the industry-standard MD5 algorithm for better security, hence protecting against Virtual Router Redundancy Protocol spoofing software.
- Advertisement Protocol – Virtual Router Redundancy Protocol advertising packets are sent to a multicast address 224.0.0.18. This reduces the number of routers required to handle the multicasts and enables test equipment to identify Virtual Router Redundancy Protocol packets on a network reliably.
- VRRP Object Tracking – You can use Virtual Router Redundancy Protocol object tracking to enable the best VRRP router to serve as the group’s virtual router master role by adjusting VRRP priorities based on the status of tracked objects. A tracked object can be an IP route or interface line protocol.
Overview of VRRP Protocol
- Open standard FHRP protocol defined in RFC-3768, which is based on HSRP with slight differences.
- The VRRP roles are called master and backup.
- One master router is elected, and it replies to ARP requests sent to a virtual IP address.
- VRRP uses its own IP protocol 112 with multicast destination address 224.0.0.18.
- VRRP preemption is enabled by default.
- VRRP uses the MAC address 0000.5e00.01xx – where XX is the VRRP group number in hex.
- VRRP supports text authentication and md5 authentication.
- VRRP Timers
- You can set VRRP timers to millisecond values.
- Similar to the HSRP Hello, VRRP uses a Master advertisement interval (default = 1 sec).
- Similar to the HSRP Dead time, VRRP uses a Master down interval.
- The Master down interval cannot be configured. It is calculated as follow:
- Master down = (3 * Advertisement Interval) + Skew_time
- Skew time = ((256 – Priority)/256)
- This results in higher priority routers having shorter Master down intervals.
- VRRP, unlike HSRP, can be configured to inherit the timer values configured on the VRRP Master.
VRRP Priority and Preemption
Virtual Router Redundancy Protocol router priority is an important feature of VRRP redundancy. Priority defines which router will become master and serve as a gateway for LAN users.
Let us take an example of two Routers, R1 and R2, and they both are connected to LAN and configured for Virtual Router Redundancy Protocol. In normal operations, you should configure the priority of one router as higher compared to the other one. Please note, if you do not configure any priority on both routers, they will take default priority as 100, and the virtual router with the higher IP address becomes the master.
Also, if the virtual router master fails, the order of authority to become a virtual router master is determined by priority. For example, using the vrrp priority command, you may set the priority of any backup virtual router from 1 to 254.
If R1, the virtual router master, fails in a LAN topology, virtual router backup R2 will be elected to take over because it has the next greater priority.
By default, a higher priority backup virtual router that becomes available replaces the virtual router master. You can use the “no vrrp preempt” command to disable this preemptive technique. If preemption is off, the virtual router backup chosen as master remains until the original virtual router master recovers and reclaims control.
VRRP Advertisements
Virtual Router Redundancy Protocol advertisements are sent to other VRRP routers in the group, conveying the virtual router master’s priority and state. The announcements are transmitted as IP packets to the VRRP group’s IP Version 4 multicast address 224.0.0.18. The messages are sent every second by default; you can change the interval.
While the VRRP Protocol does not support millisecond timers, Cisco routers do. Therefore, you must manually configure the timer value in milliseconds on both the primary and backup routers. As a result, the master advertisement value presented in the “show vrrp” command output on the backup router is always 1 second.
It’s important to use millisecond timers only when essential and tested. Millisecond values only function in favorable conditions and using them confines VRRP operation to Cisco devices exclusively.
VRRP Object Tracking
Object tracking is a separate process that tracks objects like an interface’s line protocol state or an ip route availability. Clients like HSRP, GLBP, and VRRP register their interest in a particular tracked object and react when their state changes.
The tracking CLI assigns a unique number to each tracked object. Virtual Router Redundancy Protocol, for example, uses this number to track an object.
The tracking process polls the tracked objects and records any value changes. Changes in the monitored item are reported to interested parties like VRRP.
Each VRRP group can track separate objects and can use the tracked object information to affect the VRRP device’s priority, which will further make a master router become a backup.
How to configure VRRP on Cisco Devices
Quick Tip – If you intend to alter or customize (add additional functions like object tracking, msec timers, etc.) VRRP, you should do so before enabling VRRP in cisco devices to ensure that your customizations are successful.
Below is an example for vrrp configuration cisco.
Router#configuration Terminal –> Enter Global Configuration Mode
Router(conf)#interface type number –> Enter Interface Configuration Mode
Router(conf-if)# ip address ip-address mask
Router(conf-if)# vrrp group description text
Router(conf-if)# vrrp group preempt [delay minimum seconds] –> Configures the router to assume the role of virtual router master for a VRRP group if its priority is higher than the existing virtual router master.
Router(conf-if)# vrrp {group} ip {IP} –> Defines the master IP to be used as the gateway IP address of the virtual router.
Router(conf-if)# vrrp {group} timers advertise [msec] {sec/msec} –> Changes the timers, optionally in milliseconds
Router(conf-if)# vrrp {group} timers learn –> Inherit the timers values of the VRRP master
Router(conf-if)# vrrp {group} priority {1-255} –> Changes the priority. Higher value preferred (default = 100)
Router(conf-if)# vrrp {group} authentication –> Specifies authentication for the group
Cisco vrrp configuration example
Router 1
R1(config)# interface G0/0
R1(config-if)# ip address 192.168.0.2 255.255.255.0
R1(config-if)# vrrp 11 priority 110
R1(config-if)# vrrp 11 authentication cisco123
R1(config-if)# vrrp 11 timers advertise 3
R1(config-if)# vrrp 11 timers learn
R1(config-if)# vrrp 11 ip 192.168.0.1
R1(config-if)# vrrp 21 priority 100
R1(config-if)# vrrp 21 timers advertise 30
R1(config-if)# vrrp 21 timers learn
R1(config-if)# vrrp 21 ip 192.168.0.10
Router 2
R2(config)# interface G0/0
R2(config-if)# ip address 192.168.0.3 255.255.255.0
R2(config-if)# vrrp 11 priority 100
R2(config-if)# vrrp 11 authentication cisco123
R2(config-if)# vrrp 11 timers advertise 3
R2(config-if)# vrrp 11 timers learn
R2(config-if)# vrrp 11 ip 192.168.0.1
R2(config-if)# vrrp 21 priority 110
R2(config-if)# vrrp 21 timers advertise 30
R2(config-if)# vrrp 21 timers learn
R2(config-if)# vrrp 21 ip 192.168.0.10
Object Tracking Example
R1 Object Tracking WAN interface
R1(config)# track 11 interface GigabitEthernet 0/1 line-protocol
R1(config-track)# exit
R1(config)# interface GigabitEthernet 0/0
R1(config-if)# ip address 192.168.0.2 255.255.255.0
R1(config-if)# vrrp 11 ip 192.168.0.1
R1(config-if)# vrrp 11 priority 110
R1(config-if)# vrrp 11 track 11 decrement 20
Useful Commands for VRRP
Show vrrp [brief] – Shows VRRP statistics, priority, counters, active and standby router
Show ip interface brief – Provides Interface status, ip address, and other details.
Show track – Useful when the track is configured to monitor interfaces.
Debug VRRP all – This shows the VRRP errors, events, and state transitions.
Definitions and Acronyms used in the post
- GLBP : Gateway Load Balancing Protocol
- VRRP : Virtual Router Redundancy Protocol
- FHRP: First Hop Redundancy Protocol
- ARP: Address Resolution Protocol
Quiz
Conclusion
In this post, we looked into VRRP, which provides gateway redundancy similar to HSRP. To solidify our knowledge, we watched a short video and took a quiz.
I hope you found the information in this blog post helpful. Thank you for reading, and please share it with others who may be looking for the same information.
Frequently Asked Questions About VRRP
Is VRRP a layer 2 protocol ?
VRRP is not a layer 2 protocol, VRRP is a protocol that operates at layer 3.
How does VRRP protocol work?
VRRP is an acronym for Virtual Router Redundancy Protocol. It is a network protocol that enables fault tolerance. In an essence, it enables a group of routers to behave as if they are one. When one of the group’s routers fails, another immediately takes over, ensuring that service is not interrupted. This results in a very high level of fault tolerance, which is particularly useful in Local Area Networks.
Is vrrp cisco proprietary ?
NO, VRRP is not a Cisco proprietary protocol. It is an open standard that is extensively supported by all networking equipment vendors.
How to configure vrrp on cisco router?
- You can configure VRRP on Cisco routers using the following commands.
- Router#configuration Terminal –> Enter Global Configuration Mode
- Router(conf)#interface type number –> Enter Interface Configuration Mode
- Router(conf-if)# ip address ip-address mask
- Router(conf-if)# vrrp group description text
- Router(conf-if)# vrrp group preempt [delay minimum seconds] –> Configures the router to assume the role of virtual router master for a VRRP group if its priority is higher than the existing virtual router master.
- Router(conf-if)# vrrp {group} ip {IP} –> Defines the master IP to be used as the gateway IP address of the virtual router.
- Router(conf-if)# vrrp {group} timers advertise [msec] {sec/msec} –> Changes the timers, optionally in milliseconds
- Router(conf-if)# vrrp {group} timers learn –> Inherit the timers values of the VRRP master
- Router(conf-if)# vrrp {group} priority {1-255} –> Changes the priority. Higher value preferred (default = 100)
- Router(conf-if)# vrrp {group} authentication –> Specifies authentication for the group
- NETGEAR Nighthawk CM3000 Cable Modem Review - December 27, 2024
- NETGEAR Nighthawk CM1200 Review: Is It Worth It - December 25, 2024
- NETGEAR Cable Modem CM600 Review - December 22, 2024
