Professional Documents
Culture Documents
03 VRRP Configuration
03 VRRP Configuration
Table of Contents
Table of Contents
Chapter 1 VRRP Configuration .................................................................................................... 1-1 1.1 Introduction to VRRP ......................................................................................................... 1-1 1.2 Configuring VRRP ............................................................................................................. 1-2 1.2.1 Configuring the Function of Pinging the Virtual IP Address.................................... 1-3 1.2.2 Configuring the TTL Value Check for VRRP Packets............................................. 1-3 1.2.3 Configuring the Mapping Mode between Virtual IP Address and MAC Address ............ 1-3 1.2.4 Configuring a Virtual IP Address ............................................................................. 1-4 1.2.5 Configuring a Priority for a Switch in the VRRP Group........................................... 1-4 1.2.6 Configuring Preemption and Delay for a Switch in a VRRP Group ........................ 1-5 1.2.7 Configuring Authentication Type and Authentication Key....................................... 1-6 1.2.8 Configuring the Interval for Sending VRRP Packets on the Master ....................... 1-7 1.2.9 Configuring the Switch to Track a Specified Interface ............................................ 1-7 1.2.10 Configuring VRRP Link Monitoring ....................................................................... 1-8 1.2.11 Configuring IFM Tracking...................................................................................... 1-9 1.2.12 Configuring the Fast Switch Function for a Virtual Router.................................. 1-10 1.3 Displaying and Debugging VRRP.................................................................................... 1-11 1.4 VRRP Configuration Examples........................................................................................ 1-12 1.4.1 Single VRRP Group Configuration Example......................................................... 1-12 1.4.2 VRRP Interface Tracking Configuration Example................................................. 1-13 1.4.3 VRRP Link Monitoring Configuration Example ..................................................... 1-14 1.4.4 IFM Tracking Configuration Example.................................................................... 1-16 1.4.5 Multiple Virtual Routers Configuration Example ................................................... 1-18 1.5 Troubleshooting VRRP .................................................................................................... 1-19
Network
Host 1
Host 2
Host 3
Figure 1-1 Network diagram for LAN VRRP, designed for LANs with multicast and broadcast capabilities (such as Ethernet) settles the above problem. VRRP integrates a group of LAN switches (including a Master and several Backups) into a virtual router. The diagram below is taken as an example to explain how VRRP works.
1-1
Ethernet 10.100.10.8
Host 1
Host 2
Host 3
Figure 1-2 Network diagram for virtual router This virtual router has its own IP address: 10.100.10.1 (which can be the interface address of a switch within the virtual router). The switches within the virtual router have their own IP addresses (such as 10.100.10.2 for the Master switch and 10.100.10.3 for the Backup switch). The hosts on the LAN only know the IP address of this virtual router 10.100.10.1 (usually called as virtual IP address of the virtual router), but not the specific IP addresses 10.100.10.2 of the Master switch and 10.100.10.3 of the Backup switch. A default route with the next hop 10.100.10.1 is configured on the hosts. Therefore, hosts within the network will communicate with the external network through this virtual router. If the Master switch in the virtual group breaks down, another Backup switch will function as the new Master switch to continue serving the hosts without any interruption.
1-2
By default, the ping function is enabled, that is, you can ping or telnet to the virtual IP address of the virtual router. You should enable the ping function before configuring the virtual router. If VRRP is already configured on the switch, it is not allowed to modify the configuration.
1.2.3 Configuring the Mapping Mode between Virtual IP Address and MAC Address
This task is to configure the mapping mode between virtual lP address and MAC address. In VRRP, the virtual IP address of the virtual router corresponds to the virtual MAC address, to ensure correct data forwarding. Depending on the chips installed, some switches support mapping one virtual IP address to multiple MAC addresses. S9500 series not only guarantee correct data forwarding in the subnet, but also allow you to specify a mapping mode, either virtual IP address to real MAC address mapping or virtual IP address to virtual MAC address mapping. Perform the following configuration in system view to configure IP-to-MAC mappings:
1-3
To do Specify a mapping mode for the virtual IP address Restore the default
Use the command vrrp method { real-mac | virtual-mac } undo vrrp method
By default, the virtual IP address of the virtual router corresponds to the virtual MAC address. You should perform this configuration only before configuring the virtual router.
The virtual-router-id ranges from 1 to 255. The virtual-address can be an unused address in the network segment where the virtual router resides, or the IP address of an interface in the virtual router. If the virtual address is the same as the real IP address of a member switch in the virtual router, the switch is called an IP Address Owner. When assigning an IP address to a nonexistent virtual router, the system will create a new virtual router accordingly. When adding a new address to an existing virtual router, the system will directly add it into the virtual IP address list. After the last virtual IP address is removed from the virtual router, the whole virtual router will also be removed. That is, there is no virtual router on the interface any more and any configuration of it is invalid accordingly.
1-4
To do Configure a priority for the switch in the virtual router. Remove the priority setting of the switch
Use the command vrrp vrid virtual-router-id priority priority undo vrrp vrid virtual-router-id priority
The priority ranges from 0 to 255. The greater the number, the higher the priority. However the value can only be taken from 1 to 254. The priority 0 is reserved for special use and priority 255 is reserved for the IP address owner by the system. By default, the priority is 100.
Note: The priority for IP address owner is always 255, which cannot be configured.
1-5
The delay in seconds ranges from 0 to 255. By default, the preemption mode is enabled with a delay of 0 seconds.
Note: If preemption mode is disabled, the delay will automatically become 0 seconds.
1-6
Note: The same authentication type and authentication key should be configured for all VLAN interfaces that belong to the virtual router.
1.2.8 Configuring the Interval for Sending VRRP Packets on the Master
The master switch advertises its normal operation state to the backup switch by sending VRRP packets regularly (at adver-interval). And the backup switch only receives VRRP packets. If the backup has not received any VRRP packet from the master within a period of time (specified by master-down-interval), it will consider the master as down, and then take its place and become the Master. You can use the following command to set a timer and adjust the interval (adver-interval) at which Master transmits VRRP packets. The master-down-interval of the Backup switch is three times that of the adver-interval. The excessive network traffic or the differences between different switch timers will result in master-down-interval timing out and state changing abnormally. Such problems can be solved through prolonging the adver-interval and preemption delay time. adver-interval is measured in seconds. Perform the following configuration in VLAN interface view to configure the interval for the master to send VRRP packets: To do Configure the interval for the master to send VRRP packets Restore the default Use the command vrrp vrid virtual-router-id timer advertise adver-interval undo vrrp vrid virtual-router-id timer advertise
By default, adver-interval is 1.
Note: You must configure the same interval for switches within the VRRP group.
specified by value-reduced. Then the backup switch with the highest priority becomes the new master. Perform the following configuration in VLAN interface view to configure the switch to track a specified interface: To do Configure the switch to track a specified interface Stop tracking the specified interface Use the command vrrp vrid virtual-router-id track interface vlan-interface vlan-id [ reduced value-reduced ] undo vrrp vrid virtual-router-id track interface vlan-interface vlan-id
Note: If the switch is an IP address owner, its interfaces cannot be tracked. If the interface is up again, the corresponding priority of the switch, will be restored automatically. On each virtual router, a maximum of eight interfaces can be tracked.
1-8
Caution: Before you configure VRRP link monitoring, it is required that no physical loop exists and the spanning tree protocol (STP) is not enabled on the network. If all the physical links in between are down, the backup device considers that the master device is down, and then the backup device switches to the master state. At this time, two master devices may exist, and you need to ensure communication through networking. Make sure that all the links between the master and backup devices are monitored.
Perform the following configuration in VLAN interface view to configure the switch to monitor a specified link: To do Configure the device to monitor the specified link Disable link monitoring Use the command vrrp vrid virtual-router-id monitor { interface interface-type interface-number | link-aggregation group group-id } undo vrrp vrid virtual-router-id monitor
Note: When you configure the device to monitor a specified interface, the interface cannot belong to any aggregation group (including dynamic aggregation groups). After you configure the device to monitor an aggregation group, the aggregation group cannot be removed directly. You cannot configure the device to monitor multiple links. After you configure the device to monitor a specified link, you need to use a board that supports reporting connection failures and configure the link-status hold 0 command globally to meet the performance requirements.
1-9
Figure 1-3 Network diagram for IFM devices As shown in Figure 1-3, the two Layer 3 switches form a VRRP group. Each switch is enabled to track the status of the corresponding IFM device through the OAM module. When receiving signals from the IFM device, the priority of the corresponding interface on a switch will increase by the value specified by value-increased. The switch with a higher priority becomes the master. When the link of the master is down, the priority will decrease by a specified value. As a result, the backup will have a higher priority and become the master switch. Thus, the cooperation between IFM and VRRP through OAM is implemented. Perform the following configuration in VLAN interface view to enable/disable IFM tracking: To do Enable IFM tracking Disable IFM tracking Use the command vrrp vrid virtual-router-id track ifm [ increased value-increased ] undo vrrp vrid virtual-router-id track ifm
1-10
Perform the following configuration in VLAN interface view to enable/disable the fast switch function for a virtual router: To do Enable the fast switch function for a virtual router Disable the fast switch function for the virtual router Use the command vrrp vrid virtual-router-id fast-switch undo vrrp vrid virtual-router-id fast-switch
display vrrp ifm Available in any view display vrrp statistics [ interface interface-type interface-number [ vrid virtual-router-id ] ] display vrrp verbose [ interface type number [ vrid virtual-router-id ] ] reset vrrp statistics [ interface interface-type interface-number [ vrid virtual-router-id ] ] debugging vrrp { state | packet | error } undo debugging vrrp { state | packet | error } Available in user view
1-11
Internet
VLAN- interface3: 10.100.10.2 -
Host A
# Configure VLAN 2.
[LSW-A] vlan 2 [LSW-A-vlan2] interface vlan 2 [LSW-A-vlan-interface2] ip address 202.38.160.1 255.255.255.0 [LSW-A-vlan-interface2] quit
# Configure VRRP.
[LSW-A] vrrp ping-enable [LSW-A] interface vlan 2 [LSW_A-vlan-interface2] vrrp vrid 1 virtual-ip 202.38.160.111
1-12
2)
Configure switch B
# Configure VLAN2.
[LSW-B] vlan 2 [LSW-B-vlan2] interface vlan 2 [LSW-B-vlan-interface2] ip address 202.38.160.2 255.255.255.0 [LSW-B-vlan-interface2] quit
# Configure VRRP.
[LSW-B] vrrp ping-enable [LSW-B] interface vlan 2 [LSW-B-vlan-interface2] vrrp vrid 1 virtual-ip 202.38.160.111 [LSW-B-vlan-interface2] vrrp vrid 1 preempt-mode
The virtual router can be used soon after configuration. Host A can be configured with the default gateway 202.38.160.111. Under normal conditions, switch A functions as the gateway. Once switch A breaks down, switch B will function as the gateway instead. Configure the preemption mode for switch A, so that it can become the master again after recovery.
# Configure VLAN2.
[LSW-A] vlan 2 [LSW-A-vlan2] interface vlan 2 [LSW-A-vlan-interface2] ip address 202.38.160.1 255.255.255.0 [LSW-A-vlan-interface2] quit
# Enable the function to ping the virtual IP address of the virtual router.
1-13
# Set the authentication mode and authentication key for the virtual router.
[LSW_A-vlan-interface2] vrrp vrid 1 authentication-mode md5 switch
# Track VLAN-interface 3.
[LSW_A-vlan-interface2] vrrp vrid 1 track interface vlan-interface 3 reduced 30
2)
Configure switch B
# Configure VLAN2.
[LSW-B] vlan 2 [LSW-B-vlan2] interface vlan 2 [LSW-B-vlan-interface2] ip address 202.38.160.2 255.255.255.0 [LSW-B-vlan-interface2] quit
# Enable the function to ping the virtual IP address of the virtual router.
[H3CLSW-B] vrrp ping-enable
# Set the authentication mode and authentication key for the virtual router.
[LSW_B-vlan-interface2] vrrp vrid 1 authentication-mode md5 switch
Under normal conditions, switch A functions as the gateway. Once VLAN-interface 3 of switch A is down, its priority will be reduced by 30, lower than that of switch B so that switch B will become the master. When VLAN-interface 3 of switch A recovers, it will become the master again.
No physical loops exist between Switch A, Switch B and Host Server, and STP is not enabled. Switch A is the master while Switch B is the backup. No physical link is available between Switch A and Host Server. Normally, Switch A acts as the gateway. The traffic sent from Host Server is forwarded at Layer 2 through Switch B to Switch A which then forwards the traffic at Layer 3 to the IP network. It is required to configure Switch B to monitor the link to Switch A. If Switch A fails or the link between Switch A and Switch B fails, Switch B becomes the master and acts as the gateway instead of Switch A. Then, the traffic from Host Server is forwarded to the IP network directly through Switch B. The state switching delay should be in milliseconds.
# Configure VLAN 2.
<LSW-A> system-view [LSW-A] vlan 2 [LSW-A-vlan2] interface vlan 2 [LSW-A-vlan-interface2] ip address 10.1.1.1 255.255.255.0 [LSW-A-vlan-interface2] quit
1-15
2)
Configure Switch B
# Configure VLAN 2.
<LSW-B> system-view [LSW-B] vlan 2 [LSW-B-vlan2] interface vlan 2 [LSW-B-vlan-interface2] ip address 10.1.1.2 255.255.255.0 [LSW-B-vlan-interface2] quit
1-16
# Configure VLAN 2.
[Switch A] vlan 2 [Switch A-vlan2] interface vlan-interface 2 [Switch A-Vlan-interface2] ip address 202.38.160.1 255.255.255.0 [Switch A-Vlan-interface2] quit
# Enable OAM.
[Switch A] Ethernet3/1/1 [Switch A-Ethernet3/1/1] oam ethernet mode passive [Switch A-Ethernet3/1/1] oam ethernet enable [Switch A-Ethernet3/1/1] quit
# Enable the function of pinging the virtual IP address of the virtual router.
[Switch A] vrrp ping-enable
# Set the authentication mode and authentication key for the virtual router.
[Switch A-Vlan-interface2] vrrp vrid 1 authentication-mode md5 switch
2)
Configure Switch B
# Configure VLAN2.
[Switch B] vlan 2 [Switch B-vlan2] interface vlan-interface 2 [Switch B-Vlan-interface2] ip address 202.38.160.2 255.255.255.0 [Switch B-Vlan-interface2] quit
# Enable OAM.
[Switch B] Ethernet3/1/1 [Switch B-Ethernet3/1/1] oam ethernet mode passive [Switch B-Ethernet3/1/1] oam ethernet enable [Switch B-Ethernet3/1/1] quit
# Enable the function to ping the virtual IP address of the virtual router.
[Switch B] vrrp ping-enable
# Set the authentication mode and authentication key for the virtual router.
[Switch B-Vlan-interface2] vrrp vrid 1 authentication-mode md5 switch
Note: Switch A acts as the gateway in normal cases. When Switch B tracks the state of the IFM device being Master through OAM, the priority of Switch B will be increased by 10, greater than that of Switch A (105), and Switch B will turn the Master and act as the gateway.
# Configure VLAN2.
[LSW-A] vlan 2 [LSW-A-vlan2] interface vlan 2 [LSW-A-vlan-interface2] ip address 202.38.160.1 255.255.255.0
1-18
2)
Configure switch B
# Configure VLAN2.
[LSW-B] vlan 2 [LSW-B-vlan2] interface vlan 2 [LSW-B-vlan-interface2] ip address 202.38.160.2 255.255.255.0
Note: Multiple virtual routers are often used in actual network applications.
II. Symptom 2: More than one Master existing within the same virtual router
There are also 2 reasons. One is short time coexistence of many master switches, which is normal and needs no manual intervention. Another is the long time coexistence of many Master switches, which may be because switches in the virtual router cannot receive VRRP packets from each other, or receive some illegal packets. To solve such problems, an attempt should be made to ping the master switches. If such an attempt fails, check the device connectivity. If they can be pinged, check the
1-19
VRRP configuration. For the configuration of the same VRRP virtual router, complete consistency for the number of virtual IP addresses, each virtual IP address, timer duration and authentication type must be guaranteed.
1-20