Like HSRP, Gateway Load Balancing Protocol (GLBP) is a Cisco proprietary protocol. Gateway Load Balancing Protocol (GLBP) provides high network availability by in a manner similar to HSRP and VRRP. However, unlike HSRP and VRRP, in which only a single gateway actively forwards traffic for a particular group at any given time, GLBP allows multiple gateways within the same GLBP group to actively forward network traffic at the same time.
GLBP gateways communicate through Hello messages that are sent every 3 seconds to the Multicast address 224.0.0.102, using UDP port 3222. This is illustrated in Figure 8-25.
Figure 8-25: GLBP Layer 3 and Layer 4 Protocol and Addresses
Gateway Load Balancing Protocol Operation
When Global Load Balancing Protocol is enabled, the GLBP group members elect one gateway to be the active virtual gateway (AVG) for that group. The AVG is the gateway that has the highest priority value. In the event that the priority values are equal, the AVG will be elected as the gateway with the highest IP address in the group. The other gateways in the GLBP group provide backup for the AVG in the event that the AVG becomes unavailable.
The AVG answers all ARP requests for the virtual router address. In addition to this, the AVG assigns a virtual MAC address to each member of the GLBP group. Each gateway is therefore responsible for forwarding packets that are sent to the virtual MAC address it has been assigned by the AVG. These gateways are referred to as active virtual forwarders (AVFs) for their assigned MAC addresses. This allows GLBP to provide load sharing. This concept is illustrated in Figure 8-26.
Figure 8-26: GLBP Active Virtual Gateway and Active Virtual Forwarders
Figure 8-26 shows a network using GLBP as the FHRP. The three gateways are all configured in GLBP group 1. Gateway GLBP-1 is configured with a priority of 110, gateway GLBP-2 is configured with a priority of 105, and gateway GLBP-3 is using the default priority of 100. GLBP-1 is elected AVG, and GLBP-2 and GLBP-3 are assigned virtual MAC addresses bbbb.bbbb.bbbb and cccc.cccc.cccc, respectively, and become AVFs for those virtual MAC addresses. GLBP-1 is also AVF for its own virtual MAC address, aaaa.aaaa.aaaa.
Hosts 1, 2 and 3 are all configured with the default gateway address 192.168.1.254, which is the virtual IP address assigned to the GLBP group. Host 1 sends out an ARP Broadcast for its gateway IP address. This is received by the AVG (GLBP-1) which responds with its own virtual MAC address aaaa.aaaa.aaaa. Host 1 forwards traffic to 192.168.1.254 to this MAC address.
Host 2 sends out an ARP Broadcast for its gateway IP address. This is received by the AVG (GLBP-1) which responds with the virtual MAC address of bbbb.bbbb.bbbb (GLBP-2). Host 2 forwards traffic to 192.168.1.254 to this MAC address and GLBP-2 forwards this traffic.
Host 3 sends out an ARP Broadcast for its gateway IP address. This is received by the AVG (GLBP-1) which responds with the virtual MAC address of cccc.cccc.cccc (GLBP-3). Host 3 forwards traffic to 192.168.1.254 to this MAC address and GLBP-3 forwards this traffic.
By using all gateways in the group, GLBP allows for load sharing without having to configure multiple groups as would be required if either HSRP or VRRP was being used as the FHRP.
GLBP Virtual MAC Address Assignment
A GLBP group allows up to four virtual MAC addresses per group. The AVG is responsible for assigning the virtual MAC addresses to each member of the group. Other group members request a virtual MAC address after they discover the AVG through Hello messages.
Gateways are assigned the next virtual MAC address in sequence. A gateway that is assigned a virtual MAC address by the AVG is known as a primary virtual forwarder while a gateway that has learned the virtual MAC address is referred to as a secondary virtual forwarder.
GLBP Redundancy
Within the GLBP group, a single gateway is elected as the AVG, and another gateway is elected as the standby virtual gateway. All other remaining gateways in the group are placed in a listen state. If an AVG fails, the standby virtual gateway will assume responsibility for the virtual IP address. At the same time, an election is held and a new standby virtual gateway is then elected from the gateways currently in the listen state.
In the event the AVF fails, one of the secondary virtual forwarders in the listen state assumes responsibility for the virtual MAC address. However, because the new AVF is already a forwarder using another virtual MAC address, GLBP needs to ensure that the old forwarder MAC address ceases being used and hosts are migrated away from this address. This is achieved using two timers:
- The redirect timer
- The timeout timer
The redirect time is the interval during which the AVG continues to redirect hosts to the old virtual forwarder MAC address. When this timer expires, the AVG stops using the old virtual forwarder MAC address in ARP replies, although the virtual forwarder will continue to forward packets that were sent to the old virtual forwarder MAC address.
When the timeout timer expires, the virtual forwarder is removed from all gateways in the GLBP group. Any clients still using the old MAC address in their ARP caches must refresh the entry to obtain the new virtual MAC address. GLBP uses the hello messages to communicate the current state of these two timers.
GLBP Load Preemption
By default, GLBP preemption is disabled, which means that a backup virtual gateway can become the AVG only if the current AVG fails, regardless of the priorities assigned to the virtual gateways. This method of operation is similar to that used by HSRP.
Cisco IOS software allows administrators to enable preemption, which allows a backup virtual gateway to become the AVG, if the backup virtual gateway is assigned a higher priority than the current AVG. By default, the GLBP virtual forwarder preemptive scheme is enabled with a delay of 30 seconds. However, this value can be manually adjusted by administrators.
GLBP Weighting
GLBP uses a weighting scheme to determine the forwarding capacity of each gateway that is in the GLBP group. The weighting assigned to a gateway in the GLBP group can be used to determine whether it will forward packets and, if so, the proportion of hosts in the LAN for which it will forward packets.
By default, each gateway is assigned a weight of 100. Administrators can additionally configure the gateways to make dynamic weighting adjustments by configuring object tracking, such as for interfaces and IP prefixes, in conjunction with GLBP. If an interface fails, the weighting is dynamically decreased by the specified value, allowing gateways with higher weighting values to be used to forward more traffic than those with lower weighting values.
In addition to this, thresholds can be set to disable forwarding when the weighting for a GLBP group falls below a certain value, and then when it rises above another threshold, forwarding is automatically re-enabled. A backup virtual forwarder can become the AVF if the current AVF weighting falls below the low weighting threshold for 30 seconds.
GLBP Load Sharing
GLBP supports three different load sharing methods:
- Host-dependent
- Round Robin
- Weighted
With host-dependent load sharing, each client that generates an ARP request for the virtual router address always receives the same virtual MAC address in reply. This method provides clients with a consistent gateway MAC address.
The round robin load sharing mechanism distributes the traffic evenly across all gateways participating as AVFs in the group. This is the default load sharing mechanism.
The weighted load sharing mechanism uses the weighting value determines the proportion of traffic that should be sent to a particular AVF. A higher weighting results in more frequent ARP replies containing the virtual MAC address of that gateway.
GLBP Client Cache
The GLBP client cache contains information about network hosts that are using a GLBP group as the default gateway. The cache entry contains information about the host that sent the IPv4 ARP or IPv6 Neighbor Discovery (ND) request and which forwarder the AVG has assigned to it, the number of the GLBP forwarder that each network host has been assigned to and the total number of network hosts currently assigned to each forwarder in a GLBP group.
The AVG for a GLBP group can be enabled to store a client cache database of all the LAN clients using this group. The maximum number of entries that may be stored can be up to 2000 but it is recommended that this number never exceed 1000. While GLBP cache configuration is beyond the scope of the SWITCH exam requirements, this feature can be configured using the glbp client-cache command and then verified using the show glbp detailcommand.
GLBP Authentication
By default, GLBP authentication is disabled. However, authentication can be configured using either a plain-text password or MD5 with, or without, a key chain. MD5 authentication provides greater security than plain-text authentication and is the recommended method for enabling GLBP authentication.
Configuring GLBP on the Gateway
The following steps are required to configure GLBP on the gateway:
- Configure the correct IP address and mask for the gateway interface using the ip address [address] [mask] [secondary] interface configuration command
- Create a GLBP group on the gateway interface and assign the group the virtual IP address via the glbp [number] ip [virtual address][secondary] interface configuration command. The [secondary] keyword configures the virtual IP address as a secondary gateway address for the specified group
- Optionally, assign the VRRP group a name using the glbp [number] name [name] interface configuration command
- Optionally, if you want to control the election of the AVG, configure the group priority via the glbp [number] priority [value] interface configuration command
The GLBP configuration examples in this section will be based on Figure 8-27.
Figure 8-27: GLBP Configuration Examples Topology
NOTE: It is assumed that VLAN and trunking configuration between the switches is already in place and the switches are successfully able to ping each other across VLAN 192. For the sake of brevity, this configuration will be omitted from the configuration examples.
Example 8-48: Configuring GLBP Groups
| VTP-Server-2(config)#interface vlan 192 VTP-Server-2(config-if)#glbp 1 ip 192.168.1.254 VTP-Server-2(config-if)#glbp 1 priority 110 VTP-Server-2(config-if)#exit |
| VTP-Server-2(config)#interface vlan 192 VTP-Server-2(config-if)#glbp 1 ip 192.168.1.254 VTP-Server-2(config-if)#exit |
| VTP-Server-3(config)#interface vlan 192 VTP-Server-3(config-if)#glbp 1 ip 192.168.1.254 VTP-Server-3(config-if)#exit |
| VTP-Server-4(config)#interface vlan 192 VTP-Server-4(config-if)#glbp 1 ip 192.168.1.254 VTP-Server-4(config-if)#exit |
Once the GLBP group has been configured, the show glbp brief command can be used to view a summary of the GLBP configuration as shown in Example 8-49.
Example 8-49: Verifying GLBP Groups
| VTP-Server-1#show glbp brief Interface Grp Fwd Pri State Address Active router Standby router Vl192 1 – 110 Active 192.168.1.254 local 192.168.1.4 Vl192 1 1 – Active 0007.b400.0101 local – Vl192 1 2 – Listen 0007.b400.0102 192.168.1.2 – Vl192 1 3 – Listen 0007.b400.0103 192.168.1.3 – Vl192 1 4 – Listen 0007.b400.0104 192.168.1.4 – |
| VTP-Server-2#show glbp brief Interface Grp Fwd Pri State Address Active router Standby router Vl192 1 – 100 Listen 192.168.1.254 192.168.1.1 192.168.1.4 Vl192 1 1 – Listen 0007.b400.0101 192.168.1.1 – Vl192 1 2 – Active 0007.b400.0102 local – Vl192 1 3 – Listen 0007.b400.0103 192.168.1.3 – Vl192 1 4 – Listen 0007.b400.0104 192.168.1.4 – |
| VTP-Server-3#show glbp brief Interface Grp Fwd Pri State Address Active router Standby router Vl192 1 – 100 Listen 192.168.1.254 192.168.1.1 192.168.1.4 Vl192 1 1 – Listen 0007.b400.0101 192.168.1.1 – Vl192 1 2 – Listen 0007.b400.0102 192.168.1.2 – Vl192 1 3 – Active 0007.b400.0103 local – Vl192 1 4 – Listen 0007.b400.0104 192.168.1.4 – |
| VTP-Server-4#show glbp brief Interface Grp Fwd Pri State Address Active router Standby router Vl192 1 – 100 Standby 192.168.1.254 192.168.1.1 local Vl192 1 1 – Listen 0007.b400.0101 192.168.1.1 – Vl192 1 2 – Listen 0007.b400.0102 192.168.1.2 – Vl192 1 3 – Listen 0007.b400.0103 192.168.1.3 – Vl192 1 4 – Active 0007.b400.0104 local – |
From the output above, we can determine that VTP-Server-1 (192.168.1.1) has been elected AVG based on its priority value of 110, which is higher than that of all the other gateways. Gateway VTP-Server-4 (192.168.1.4) has been elected standby virtual gateway because it has the highest IP address of the remaining three gateways, even though they all share the same priority value.
Gateways VTP-Server-2 and VTP-Server-3 are therefore placed in the listen state.
The show glbp command prints detailed information on the status of the GLBP group. The output of this command is illustrated in Example 8-50.
Example 8-50: Verifying GLBP Groups
| VTP-Server-1#show glbp Vlan192 – Group 1 State is Active 2 state changes, last state change 02:52:22 Virtual IP address is 192.168.1.254 Hello time 3 sec, hold time 10 sec Next hello sent in 1.465 secs Redirect time 600 sec, forwarder time-out 14400 sec Preemption disabled Active is local Standby is 192.168.1.4, priority 100 (expires in 9.619 sec) Priority 110 (configured) Weighting 100 (default 100), thresholds: lower 1, upper 100 Load balancing: round-robin Group members: 0004.c16f.8741 (192.168.1.3) 000c.cea7.f3a0 (192.168.1.2) 0013.1986.0a20 (192.168.1.1) local 0030.803f.ea81 (192.168.1.4) There are 4 forwarders (1 active) Forwarder 1 State is Active 1 state change, last state change 02:52:12 MAC address is 0007.b400.0101 (default) Owner ID is 0013.1986.0a20 Redirection enabled Preemption enabled, min delay 30 sec Active is local, weighting 100 Forwarder 2 State is Listen MAC address is 0007.b400.0102 (learnt) Owner ID is 000c.cea7.f3a0 Redirection enabled, 599.299 sec remaining (maximum 600 sec) Time to live: 14399.299 sec (maximum 14400 sec) Preemption enabled, min delay 30 sec Active is 192.168.1.2 (primary), weighting 100 (expires in 9.295 sec) Forwarder 3 State is Listen MAC address is 0007.b400.0103 (learnt) Owner ID is 0004.c16f.8741 Redirection enabled, 599.519 sec remaining (maximum 600 sec) Time to live: 14399.519 sec (maximum 14400 sec) Preemption enabled, min delay 30 sec Active is 192.168.1.3 (primary), weighting 100 (expires in 9.515 sec) Forwarder 4 State is Listen MAC address is 0007.b400.0104 (learnt) Owner ID is 0030.803f.ea81 Redirection enabled, 598.514 sec remaining (maximum 600 sec) Time to live: 14398.514 sec (maximum 14400 sec) Preemption enabled, min delay 30 sec Active is 192.168.1.4 (primary), weighting 100 (expires in 8.510 sec) |
When executed on the AVG, the show glbp command shows, amongst other things, the address of the standby virtual gateway and the number of AVFs in the group, as well as the states that it has assigned to them. The virtual MAC addresses for each AVF are also displayed.
Configuring GLBP Load Sharing
The glbp [number] load-balancing [host-dependent| round-robin|weighted] command is used to configure the GLBP load sharing method. The default is round robin, which can be verified in the output of the show glbpcommand as shown in Example 8-51.
Example 8-51: Verifying GLBP Groups
| VTP-Server-1#show glbp Vlan192 – Group 1 State is Active 2 state changes, last state change 02:52:22 Virtual IP address is 192.168.1.254 Hello time 3 sec, hold time 10 sec Next hello sent in 1.465 secs Redirect time 600 sec, forwarder time-out 14400 sec Preemption disabled Active is local Standby is 192.168.1.4, priority 100 (expires in 9.619 sec) Priority 110 (configured) Weighting 100 (default 100), thresholds: lower 1, upper 100 Load balancing: round-robin Group members: 0004.c16f.8741 (192.168.1.3) 000c.cea7.f3a0 (192.168.1.2) 0013.1986.0a20 (192.168.1.1) local 0030.803f.ea81 (192.168.1.4) There are 4 forwarders (1 active) … [Truncated Output] |
Example 8-52 shows how to change the load sharing method on the AVG to host dependent.
Example 8-52: Configuring the GLBP Load Sharing Method
| VTP-Server-1(config)#interface vlan 192 VTP-Server-1(config-if)#glbp 1 load-balancing host-dependent VTP-Server-1(config-if)#exit |
The show glbp command is again used to verify this configuration as shown in Example 8-53.
Example 8-53: Verifying the GLBP Load Sharing Method
| VTP-Server-1#show glbp Vlan192 – Group 1 State is Active 2 state changes, last state change 03:52:19 Virtual IP address is 192.168.1.254 Hello time 3 sec, hold time 10 sec Next hello sent in 2.503 secs Redirect time 600 sec, forwarder time-out 14400 sec Preemption disabled Active is local Standby is 192.168.1.4, priority 100 (expires in 9.495 sec) Priority 110 (configured) Weighting 100 (default 100), thresholds: lower 1, upper 100 Load balancing: host-dependent Group members: 0004.c16f.8741 (192.168.1.3) 000c.cea7.f3a0 (192.168.1.2) 0013.1986.0a20 (192.168.1.1) local 0030.803f.ea81 (192.168.1.4) There are 4 forwarders (1 active) … [Truncated Output] … |
Configuring GLBP Plain Text and MD5 Authentication
The glbp [number] authentication text [password] interface configuration command is used to enable GLBP plain-text authentication for group members. This command must be configured on all members the group. This is illustrated in Example 8-54.
Example 8-54: Configuring GLBP Plain Text Authentication
| VTP-Server-1(config)#interface vlan 192 VTP-Server-1(config-if)# glbp 1 authentication text SWITCH VTP-Server-1(config-if)#exit |
| VTP-Server-2(config)#interface vlan 192 VTP-Server-2(config-if)# glbp 1 authentication text SWITCH VTP-Server-2(config-if)#exit |
| VTP-Server-3(config)#interface vlan 192 VTP-Server-3(config-if)# glbp 1 authentication text SWITCH VTP-Server-3(config-if)#exit |
| VTP-Server-4(config)#interface vlan 192 VTP-Server-4(config-if)# glbp 1 authentication text SWITCH VTP-Server-4(config-if)#exit |
The glbp [number] authentication md5 key-string [password] interface configuration command is used to enable MD5 authentication for GLBP without using a key chain. The glbp [number] authentication md5 key-chain [name] interface configuration command is used to enable MD5 authentication for GLBP referencing a configured key chain. Example 8-55 below shows how to enable MD5 authentication, without a key chain, for the Gateway Load Balancing Protocol.
Example 8-55: Configuring GLBP MD5 Authentication with no Key Chain
| VTP-Server-1(config)#interface vlan 192 VTP-Server-1(config-if)# glbp 1 authentication md5 key-string SWITCH VTP-Server-1(config-if)#exit |
| VTP-Server-2(config)#interface vlan 192 VTP-Server-2(config-if)# glbp 1 authentication md5 key-string SWITCH VTP-Server-2(config-if)#exit |
| VTP-Server-3(config)#interface vlan 192 VTP-Server-3(config-if)# glbp 1 authentication md5 key-string SWITCH VTP-Server-3(config-if)#exit |
| VTP-Server-4(config)#interface vlan 192 VTP-Server-4(config-if)# glbp 1 authentication md5 key-string SWITCH VTP-Server-4(config-if)#exit |
This configuration is verified using the show glbp command as shown in Example 8-56.
Example 8-56: Verifying GLBP MD5 Authentication with no Key Chain
| VTP-Server-1#show glbp Vlan192 – Group 1 State is Active 2 state changes, last state change 04:06:10 Virtual IP address is 192.168.1.254 Hello time 3 sec, hold time 10 sec Next hello sent in 0.840 secs Redirect time 600 sec, forwarder time-out 14400 sec Authentication MD5, key-string Preemption disabled Active is local Standby is 192.168.1.4, priority 100 (expires in 8.721 sec) Priority 110 (configured) Weighting 100 (default 100), thresholds: lower 1, upper 100 Load balancing: host-dependent Group members: 0004.c16f.8741 (192.168.1.3) 000c.cea7.f3a0 (192.168.1.2) 0013.1986.0a20 (192.168.1.1) local 0030.803f.ea81 (192.168.1.4) There are 4 forwarders (1 active) … [Truncated Output] … |