Understanding and Troubleshooting VRRP

As is the case with HSRP, it is important to have a fundamental understanding of VRRP so as to be able to troubleshoot and identify protocol failures. Because VRRP is very similar to HSRP, troubleshooting VRRP follows the same basic concepts described in the HSRP troubleshooting portion of the previous section.

Understanding Virtual Router Redundancy Protocol

VRRP operates in a similar manner to HSRP; however, unlike HSRP, VRRP is an open standard that is defined in RFC 2338. VRRP sends advertisements to the Multicast destination address 224.0.0.18 (VRRP), using IP protocol number 112. At the Data Link layer, advertisements are sent from the virtual router master virtual router MAC address 01-00-5e-00-01xx, where xxrepresents the two-digit VRRP group number in Hexadecimal. This allows you to configure up to 255 virtual routers on an interface. However, it should be noted that the actual number of virtual routers that a gateway interface can actually support depends on the following factors:

1. Gateway processing capability
2. Gateway memory capability
3. Gateway interface support of multiple MAC addresses

VRRP and HSRP are similar in many ways. For example, both protocols elect the primary router, which is the active router in HSRP and virtual router master in VRRP based on the priority values configured (both use a default of 100). In the event that priority values are the same, the gateway with the highest IP address is elected.

Another similarity is that both HSRP and VRRP can be configured between more than two LAN gateways. This allows multiple gateways to provide redundancy for LAN hosts. However, it should be noted that although both do support this capability, the show vrrp command only indicates which router is virtual router master; however, the show standby command will show the active and standby gateway (if issued on a gateway which is neither) as shown below:

NOTE: A non-active or non-standby HSRP gateway will remain in the Listen state, as is illustrated in the output above. All non-virtual router master VRRP gateways will be in a backup state regardless of the number of gateways in the group.

Another similarity between HSRP and VRRP is that both protocols support MD5 and plain text authentication for securing protocol message exchanges. Despite their similarities, there are some significant differences between HSRP and VRRP. Understanding these differences is not only important from a protocol configuration and implementation perspective, it is also important from a troubleshooting perspective. The following section describes some of the differences between HSRP and VRRP that you should be intimately familiar with. These include version, priority values, VIP configuration, and Hello packet sending, preemption and timers.

By default, VRRP version 2 is enabled when VRRP is configured on a gateway in IOS software. Version 2 is the default and current VRRP version. It is not possible to change the version as is the case with HSRP. There is no VRRP version 1 standard. On the other hand, when HSRP is enabled on a gateway, by default HSRP version 1 is enabled. However, Cisco IOS software allows administrators to change this to HSRP version 2 using the standby version <1-2>interface configuration command.

Like HSRP, VRRP uses priority values to determine which gateway will be elected the virtual router master. The default VRRP priority value is 100; however, this value can be manually adjusted to a value between 1 and 254. While the default HSRP priority value is also 100, the configurable priority values for HSRP are between 1 and 255.

NOTE: The priority value of 255 is reserved for a special purpose in VRRP. This is described in the following section on VRRP virtual IP configuration.

When configuring HSRP, virtual IP (VIP) address assigned to the HSRP group cannot be the real IP address assigned to an interface. For example, if an interface has the IP address 10.0.0.1/24, the VIP cannot be that IP address or the IP address of any other device that will be part of the same HSRP group. If you attempt to configure the real IP address as the VIP, the software will print the following error message on the console:

With VRRP, however, the VIP can be configured as simply a logical IP address that is shared between the routers in the group or as the real IP address of one of the devices in the group. When the VIP is configured as the real IP address of a gateway, that device is referred to as the IP Address Owner or sometimes as the Real IP Address Owner.

When the IP Address Owner is up, this gateway will respond to all packets that are sent to the IP address. This gateway is also the virtual router master for the group and is assigned a priority value of 255 in Cisco IOS software. As previously stated, only values 1- 254 are configurable in Cisco IOS software; therefore, this value is only allocated by the software when the virtual IP address for the group is equal to that of the real router interface. Consider the topology that is illustrated in Figure 3-2 for example:

Fig. 3-2. Specifying Real Interface Addresses as the VRRP VIP

NOTE: While Figure 3-2 depicts routers, the same concept is applicable on Multilayer switches.

Prior to the configuration of VRRP on the gateways, the interface configurations for all three are provided in the following section. The interface configuration for R1 is as follows:

The interface configuration for R2 is as follows:

And finally, the interface configuration for R3 is as follows:

Following this initial verification, VRRP group 1 is configured under the FastEthernet interface of all gateways using the vrrp 1 ip 10.0.0.1 interface configuration command, which specifies the real IP address of R1 as the VIP. No additional VRRP configuration is performed. The running configuration on all gateways is updated as follows, beginning with R1:

The interface configuration for R2 is as follows:

And finally, the interface configuration for R3 is as follows:

Following this configuration, because the real IP address of R1 is used as the VRRP group VIP, this gateway is designated IP Address Owner and an automatic priority value is assigned to this gateway allowing it to respond to all packets sent to that IP address. This is confirmed using theshow vrrp [group] command. Following is the output of this command on R1:

Gateways R2 and R3 default to the backup state and show R1 as virtual router master. Because both R2 and R3 show the same information, only the output of the show vrrp command on R2 is provided because R3 will reflect the same information.

NOTE: When using the interface address of a gateway as the VIP, you may see the following error message if the gateway goes down and then comes back up:

This error message should immediately clear, however, if you see it repeatedly citing multiple MAC addresses, there may be another device on the network that is using the same address.

Another notable difference between VRRP and HSRP is the sending of Hello packets. When you enable HSRP, the standby and active gateways exchange Hello packets, which are sent out every 3 (three) seconds by default. If you enabled the debug standby command on either gateway, you would see an output similar to the following:

With VRRP, the virtual router master sends advertisements to other VRRP routers in the same group every 1 (one) second by default. However, the virtual router backup(s) will not send any packets to the VRRP group. This is often a point of confusion when troubleshooting. If thedebug vrrp command was issued on the virtual router master, you would see advertisements being sent out similar to the following:

On the virtual router backup, the debug vrrp command would show the following output:

In the debug output on the virtual router backup, the event being observed is that the gateway received an advertisement from another gateway for VRRP group 1 that has a higher or equal priority to itself. This message does not indicate a message sent by the local gateway itself. The advertisement messages include the priority and address of the current virtual router master.

By default, unlike HSRP, preemption is enabled for VRRP and no explicit configuration is required by the administrator to enable this functionality.

And finally, there is a difference in the range of MAC addresses used by both VRRP and HSRP. When using VRRP, at the Data Link layer, advertisements are sent from the virtual router master virtual router MAC address 01-00-5e-00-01xx, where xx represents the two-digit Hexadecimal group number. With HSRPv1, the Layer 2 address that is used by the virtual IP address will be a virtual MAC address in the range 0000.0C07.ACxx, where xx is the HSRP group number in Hexadecimal value and based on the respective interface. HSRPv2 uses MAC addresses in the range 0000.0C9F.F000 to 0000.0C9F.FFFF for the virtual gateway IP address.

Troubleshooting Virtual Router Redundancy Protocol

For the most part, VRRP troubleshooting follows the same basic logic as HSRP troubleshooting. For example, assume that one or more gateways were logging the following messages:

Given the state transitions being logged, you would perform the same troubleshooting for VRRP as you would if this were HSRP. In other words, you would check Physical layer connectivity, verify if there are any Data Link problems, check for excessive network traffic or congestion and verify gateway resource utilization using the show processes command.