VRRPv3 Protocol Support

Virtual Router Redundancy Protocol (VRRP) enables a group of devices to form a single virtual device to provide redundancy. The LAN clients can then be configured with the virtual device as their default gateway. The virtual device, representing a group of devices, is also known as a VRRP group. The VRRP version 3 (v3) Protocol Support feature provides the capability to support IPv4 and IPv6 addresses while VRRP version 2 (v2) only supports IPv4 addresses. This module explains concepts related to VRRPv3 and describes how to create and customize a VRRP group in a network. Benefits of using VRRPv3 Protocol Support include the following:

  • Interoperability in multi-vendor environments.

  • VRRPv3 supports usage of IPv4 and IPv6 addresses while VRRPv2 only supports IPv4 addresses.

  • Improved scalability through the use of VRRS Pathways.


Note

In this module, VRRP and VRRPv3 are used interchangeably.

Restrictions for VRRPv3 Protocol Support

  • VRRPv3 is not intended as a replacement for existing dynamic protocols. VRRPv3 is designed for use over multi-access, multicast, or broadcast capable Ethernet LANs.

  • VRRPv3 is supported on Ethernet, Fast Ethernet, Bridge Group Virtual Interface (BVI), and Gigabit Ethernet interfaces, and on Multiprotocol Label Switching (MPLS) Virtual Private Networks (VPNs), VRF-aware MPLS VPNs, and VLANs.

  • Because of the forwarding delay that is associated with the initialization of a BVI interface, you must not configure the VRRPv3 advertise timer to a value lesser than the forwarding delay on the BVI interface. If you configure the VRRPv3 advertise timer to a value equal to or greater than the forwarding delay on the BVI interface, the setting prevents a VRRP device on a recently initialized BVI interface from unconditionally taking over the primary role. Use the bridge forward-time command to set the forwarding delay on the BVI interface. Use the vrrp timers advertise command to set the VRRP advertisement timer.

  • VRRPv3 does not support Stateful Switchover (SSO).

  • VRRPv3 protocol does not support authentication.

  • Full network redundancy can only be achieved if VRRP operates over the same network path as the VRRS Pathway redundant interfaces. For full redundancy, the following restrictions apply:
    • VRRS pathways should not share a different physical interface as the parent VRRP group or be configured on a sub-interface having a different physical interface as the parent VRRP group.
    • VRRS pathways should not be configured on Switch Virtual Interface (SVI) interfaces as long as the associated VLAN does not share the same trunk as the VLAN on which the parent VRRP group is configured.

Information About VRRPv3 Protocol Support

VRRPv3 Benefits

Support for IPv4 and IPv6

VRRPv3 supports IPv4 and IPv6 address families while VRRPv2 only supports IPv4 addresses.

Note

When VRRPv3 is in use, VRRPv2 is unavailable. For VRRPv3 to be configurable, the fhrp version vrrp v3 command must be used in global configuration mode

Redundancy

VRRP enables you to configure multiple devices as the default gateway device, which reduces the possibility of a single point of failure in a network.

Load Sharing

You can configure VRRP in such a way that traffic to and from LAN clients can be shared by multiple devices, thereby sharing the traffic load more equitably between available devices.

Multiple Virtual Devices

VRRP supports up to 255 virtual devices (VRRP groups) on a device physical interface, subject to restrictions in scaling. Multiple virtual device support enables you to implement redundancy and load sharing in your LAN topology. In scaled environments, VRRS Pathways should be used in combination with VRRP control groups.

Multiple IP Addresses

The virtual device can manage multiple IP addresses, including secondary IP addresses. Therefore, if you have multiple subnets configured on an Ethernet interface, you can configure VRRP on each subnet.

Note

To utilize secondary IP addresses in a VRRP group, a primary address must be configured on the same group.

Preemption

The redundancy scheme of VRRP enables you to preempt a virtual device backup that has taken over for a failing virtual primary device with a higher priority virtual device backup that has become available.

Note

Preemption of a lower priority primary device is enabled with an optional delay.

Advertisement Protocol

VRRP uses a dedicated Internet Assigned Numbers Authority (IANA) standard multicast address for VRRP advertisements. For IPv4, the multicast address is 224.0.0.18. For IPv6, the multicast address is FF02:0:0:0:0:0:0:12. This addressing scheme minimizes the number of devices that must service the multicasts and allows test equipment to accurately identify VRRP packets on a segment. The IANA has assigned VRRP the IP protocol number 112.

VRRP Device Priority and Preemption

An important aspect of the VRRP redundancy scheme is VRRP device priority. Priority determines the role that each VRRP device plays and what happens if the virtual primary device fails.

If a VRRP device owns the IP address of the virtual device and the IP address of the physical interface, this device will function as a virtual primary device.

Priority also determines if a VRRP device functions as a virtual device backup and the order of ascendancy to becoming a virtual primary device if the virtual primary device fails. You can configure the priority of each virtual device backup with a value of 1 through 254 using the priority command (use the vrrp address-family command to enter the VRRP configuration mode and access the priority option).

For example, if device A, the virtual primary device in a LAN topology, fails, an election process takes place to determine if virtual device backups B or C should take over. If devices B and C are configured with the priorities of 101 and 100, respectively, device B is elected to become virtual primary device because it has the higher priority. If devices B and C are both configured with the priority of 100, the virtual device backup with the higher IP address is elected to become the virtual primary device.

By default, a preemptive scheme is enabled whereby a higher priority virtual device backup that becomes available takes over from the virtual device backup that was elected to become virtual primary device. You can disable this preemptive scheme using the no preempt command (use the vrrp address-family command to enter the VRRP configuration mode, and enter the no preempt command). If preemption is disabled, the virtual device backup that is elected to become virtual primary device remains the primary until the original virtual primary device recovers and becomes primary again.


Note

Preemption of a lower priority primary device is enabled with an optional delay.

VRRP Advertisements

The virtual router master sends VRRP advertisements to other VRRP routers in the same group. The advertisements communicate the priority and state of the virtual router master. The VRRP advertisements are encapsulated into either IPv4 or IPv6 packets (based on the VRRP group configuration) and sent to the appropriate multicast address assigned to the VRRP group. For IPv4, the multicast address is 224.0.0.18. For IPv6, the multicast address is FF02:0:0:0:0:0:0:12. The advertisements are sent every second by default and the interval is configurable.

Cisco routers allow you to configure millisecond timers, which is a change from VRRPv2. You need to manually configure the millisecond timer values on both the primary and the backup routers. The master advertisement value displayed in the show vrrp command output on the backup routers is always 1 second because the packets on the backup routers do not accept millisecond values.

You must use millisecond timers where absolutely necessary and with careful consideration and testing. Millisecond values work only under favorable circumstances. The use of the millisecond timer values is compatible with third party vendors, as long as they also support VRRPv3. You can specify a timer value between 100 milliseconds and 40000 milliseconds.

How to Configure VRRPv3 Protocol Support

IPv6 VRRP Link Local Address

VRRPv3 for IPv6 requires that a primary virtual link-local IPv6 address is configured to allow the group to operate. After the primary link-local IPv6 address is established on the group, you can add the secondary global addresses.

Enabling VRRPv3 on a Device

To enable VRRPv3 on a device, perform the following task:

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. fhrp version vrrp v3
  4. end

DETAILED STEPS

Step 1

enable

Example:


Device> enable

Enables privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 3

fhrp version vrrp v3

Example:


Device(config)# fhrp version vrrp v3

Enables the ability to configure VRRPv3 and VRRS.

Note

 

When VRRPv3 is in use, VRRPv2 is unavailable.

Step 4

end

Example:


Device(config)# end

Returns to privileged EXEC mode.

Creating and Customizing a VRRP Group

To create a VRRP group, perform the following task. Steps 6 to 14 denote customizing options for the group, and they are optional:

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. fhrp version vrrp v3
  4. interface type number
  5. vrrp group-id address-family {ipv4 | ipv6}
  6. address ip-address [primary | secondary]
  7. description group-description
  8. match-address
  9. preempt delay minimum seconds
  10. priority priority-level
  11. timers advertise interval
  12. vrrpv2
  13. vrrs leader vrrs-leader-name
  14. shutdown
  15. end

DETAILED STEPS

  Command or Action Purpose

Step 1

enable

Example:


Device> enable

Enables privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 3

fhrp version vrrp v3

Example:


Device(config)# fhrp version vrrp v3

Enables the ability to configure VRRPv3 and VRRS.

Note

 

When VRRPv3 is in use, VRRPv2 is unavailable.

Step 4

interface type number

Example:


Device(config)# interface GigabitEthernet 0/0/0

Enters interface configuration mode.

Step 5

vrrp group-id address-family {ipv4 | ipv6}

Example:


Device(config-if)# vrrp 3 address-family ipv4

Creates a VRRP group and enters VRRP configuration mode.

Step 6

address ip-address [primary | secondary]

Example:


Device(config-if-vrrp)# address 100.0.1.10 primary

Specifies a primary or secondary address for the VRRP group.

Note

 
VRRPv3 for IPv6 requires that a primary virtual link-local IPv6 address is configured to allow the group to operate. After the primary link-local IPv6 address is established on the group, you can add the secondary global addresses.

Step 7

description group-description

Example:


Device(config-if-vrrp)# description group 3

(Optional) Specifies a description for the VRRP group.

Step 8

match-address

Example:


Device(config-if-vrrp)# match-address

(Optional) Matches secondary address in the advertisement packet against the configured address.

  • Secondary address matching is enabled by default.

Step 9

preempt delay minimum seconds

Example:


Device(config-if-vrrp)# preempt delay minimum 30

(Optional) Enables preemption of lower priority primary device with an optional delay.

  • Preemption is enabled by default.

Step 10

priority priority-level

Example:


Device(config-if-vrrp)# priority 3

(Optional) Specifies the priority value of the VRRP group.

  • The priority of a VRRP group is 100 by default.

Step 11

timers advertise interval

Example:


Device(config-if-vrrp)# timers advertise 1000

(Optional) Sets the advertisement timer in milliseconds.

  • The advertisement timer is set to 1000 milliseconds by default.

Step 12

vrrpv2

Example:


Device(config-if-vrrp)# vrrpv2

(Optional) Enables support for VRRPv2 simultaneously, so as to interoperate with devices which only support VRRP v2.

  • VRRPv2 is disabled by default.

Step 13

vrrs leader vrrs-leader-name

Example:


Device(config-if-vrrp)# vrrs leader leader-1

(Optional) Specifies a leader's name to be registered with VRRS and to be used by followers.

  • A registered VRRS name is unavailable by default.

Step 14

shutdown

Example:


Device(config-if-vrrp)# shutdown

(Optional) Disables VRRP configuration for the VRRP group.

  • VRRP configuration is enabled for a VRRP group by default.

Step 15

end

Example:


Device(config)# end

Returns to privileged EXEC mode.

Configuring the Delay Period Before FHRP Client Initialization

To configure the delay period before the initialization of all FHRP clients on an interface, perform the following task:

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. fhrp version vrrp v3
  4. interface type number
  5. fhrp delay {[minimum] [reload] seconds}
  6. end

DETAILED STEPS

Step 1

enable

Example:


Device> enable

Enables privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 3

fhrp version vrrp v3

Example:


Device(config)# fhrp version vrrp v3

Enables the ability to configure VRRPv3 and VRRS.

Note

 

When VRRPv3 is in use, VRRPv2 is unavailable.

Step 4

interface type number

Example:


Device(config)# interface GigabitEthernet 0/0/0

Enters interface configuration mode.

Step 5

fhrp delay {[minimum] [reload] seconds}

Example:


Device(config-if)# fhrp delay minimum 5

Specifies the delay period for the initialization of FHRP clients after an interface comes up.

  • The range is 0-3600 seconds.

Step 6

end

Example:


Device(config)# end

Returns to privileged EXEC mode.

Configuration Examples for VRRPv3 Protocol Support

Example: Enabling VRRPv3 on a Device

The following example shows how to enable VRRPv3 on a device: 

Device> enable
Device# configure terminal
Device(config)# fhrp version vrrp v3
Device(config-if-vrrp)# end

Example: Creating and Customizing an IPv4 VRRP Group

The following example shows how to create and customize an IPv4 VRRP group: 

Device> enable
Device# configure terminal
Device(config)# fhrp version vrrp v3
Device(config)# interface gigabitethernet0/0
Device(config-if)# vrrp 3 address-family ipv4
Device(config-if-vrrp)# address 10.0.0.1 primary
Device(config-if-vrrp)# description group 3
Device(config-if-vrrp)# match-address  
Device(config-if-vrrp)# preempt delay minimum 30
Device(config-if-vrrp)# end

Note

In the above example, the fhrp version vrrp v3 command is used in the global configuration mode.

Example: Creating and Customizing an IPv6 VRRP Group

The following example shows how to create and customize an IPv6 VRRP group: 

Device> enable
Device# configure terminal
Device(config)# fhrp version vrrp v3
Device(config)# interface gigabitethernet0/0/0
Device(config-if)# vrrp 3 address-family ipv6
Device(config-if-vrrp)# address FE80::46B6:BEFF:FE50:DBB0 primary
Device(config-if-vrrp)# address 2001:1234::FFFF/64
Device(config-if-vrrp)# exit-vrrp
Device(config-if)# end

Note

In above example, primary link-local address should match on all VRRP peers and the fhrp version vrrp v3 is used in the global configuration mode

Example: Configuring the Delay Period Before FHRP Client Initialization

The following example shows how to configure the delay period before FHRP client initialization : 

Device> enable
Device# configure terminal
Device(config)# fhrp version vrrp v3
Device(config)# interface gigabitethernet0/0
Device(config-if)# fhrp delay minimum 5
Device(config-if-vrrp)# end

Note

In the above example, a five-second delay period is specified for the initialization of FHRP clients after the interface comes up. You can specify a delay period between 0 and 3600 seconds.

Example: VRRP Status, Configuration, and Statistics Details

The following is a sample output of the status, configuration and statistics details for a VRRP group: 


Device# show vrrp detail

GigabitEthernet0/0/0 - Group 3 - Address-Family IPv4
  State is MASTER
  State duration 1 mins 23.203 secs
  Virtual IP address is 10.0.0.254
  Virtual MAC address is 0000.5E00.0103
  Advertisement interval is 1000 msec
  Preemption enabled
  Priority is 110
  State change reason is VRRP_PRIORITY
  Master Router is 10.0.0.1 (local), priority is 110
  Master Advertisement interval is 1000 msec (expires in 598 msec)
  Master Down interval is unknown
  FLAGS: 1/1
  VRRPv3 Advertisements: sent 1985 (errors 0) - rcvd 70
  VRRPv2 Advertisements: sent 0 (errors 0) - rcvd 0
  Group Discarded Packets: 3
    VRRPv2 incompatibility: 0
    IP Address Owner conflicts: 0
    Invalid address count: 0
    IP address configuration mismatch : 0
    Invalid Advert Interval: 0
    Adverts received in Init state: 3
    Invalid group other reason: 0
  Group State transition:
    Init to master: 0
    Init to backup: 3 (Last change Fri Jul 26 15:10:23.977)
    Backup to master: 2 (Last change Fri Jul 26 15:10:27.547)
    Master to backup: 0
    Master to init: 1 (Last change Fri Jul 26 15:09:28.947)
    Backup to init: 1 (Last change Fri Jul 26 14:40:55.710)

GigabitEthernet0/0/0 - Group 3 - Address-Family IPv6
  State is MASTER
  State duration 1 mins 26.772 secs
  Virtual IP address is FE80::46B6:BEFF:FE50:DBB0
  Virtual secondary IP addresses:
    2001:1234::FFFF/64
  Virtual MAC address is 0000.5E00.0203
  Advertisement interval is 1000 msec
  Preemption enabled
  Priority is 255 (owner mode)
  State change reason is VRRP_PRIORITY
  Master Router is FE80::46B6:BEFF:FE50:DBB0 (local), priority is 255
  Master Advertisement interval is 1000 msec (expires in 600 msec)
  Master Down interval is unknown
  FLAGS: 1/1
  VRRPv3 Advertisements: sent 1181 (errors 0) - rcvd 1
  VRRPv2 Advertisements: sent 0 (errors 0) - rcvd 0
  Group Discarded Packets: 0
    VRRPv2 incompatibility: 0
    IP Address Owner conflicts: 0
    Invalid address count: 0
    IP address configuration mismatch : 1
    Invalid Advert Interval: 0
    Adverts received in Init state: 0
    Invalid group other reason: 0
  Group State transition:
    Init to master: 2 (Last change Fri Jul 26 15:10:23.979)
    Init to backup: 0
    Backup to master: 0
    Master to backup: 0
    Master to init: 1 (Last change Fri Jul 26 15:09:28.947)
    Backup to init: 0

Device# exit

Additional References for VRRPv3 Protocol Support

Related Documents

Related Topic

Document Title

Cisco IOS commands

Master Commands List, All Releases

FHRP commands

First Hop Redundancy Protocols Command Reference

Configuring VRRPv2

Configuring VRRP

Standards and RFCs

Standard/RFC

Title

RFC5798

Virtual Router Redundancy Protocol

RFC 6527

Definitions of Managed Objects for the Virtual Router Redundancy Protocol Version 3 (VRRPv3)

MIBs

MIB MIBs Link

VRRPv3 MIB

To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html

Feature Information for VRRPv3 Protocol Support

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Glossary

Virtual IP address owner —The VRRP router that owns the IP address of the virtual router. The owner is the router that has the virtual router address as its physical interface address.

Virtual router —One or more VRRP routers that form a group. The virtual router acts as the default gateway router for LAN clients. The virtual router is also known as a VRRP group.

Virtual router backup —One or more VRRP routers that are available to assume the role of forwarding packets if the virtual primary router fails.

Virtual primaryrouter —The VRRP router that is currently responsible for forwarding packets sent to the IP addresses of the virtual router. Usually, the virtual primary router also functions as the IP address owner.

VRRP router —A router that is running VRRP.