Cradlepoint VRRP configuration

Transcription

1 Cradlepoint VRRP configuration Products Supported: AER2100. IBR11x0, IBR6x0 and MBR1400v2. Click here to identify your router. Firmware Version: or newer. This article was written utilizing version for information on upgrading firmware, click here. Quick Links Summary Network Topology Router A Configuration Router B Configuration Layer 2 Switch Configuration Validation Troubleshooting Assumptions System Requirements Related Articles Summary This document provides a configuration and design example for configuring the Virtual Router Redundancy Protocol (VRRP) on a Cradlepoint router. This design provides redundant WAN connections, redundant LAN gateways and router hardware redundancy. VRRP is a layer 3 protocol that provides automatic default gateway selections on an IP network. Administrations should have a basic knowledge of Cradlepoint configuration and a firm understanding of layer 2/3 network concepts. Configuration Difficulty: Expert Network Topology

2 In this example 3 separate VLANs have been created on each Cradlepoint router. For this VRRP design to function correctly, all VLANs must be 802.1Q trunked between routers over a layer 2 connection via the layer 2 switch. Below is a summary of the VLANs and IP addressing information used in this design example. VLAN Name 802.1Q VLAN ID Router A IP Address Router B IP Address Virtual IP (VIP) Subnet Mask Default Gateway Router ID : : : : : : : : : : : : : : : : Data LAN VoIP LAN PoS LAN Router A Configuration Log Into the Cradlepoint Web Administration Interface (default) Under the Network Settings heading, select WiFi / Local Networks Check the box next to the Primary LAN (the default configuration) and click Edit Add/Modify Primary (default) Network for VLAN 10 Data (PCs, Printers) Modify the Name of the Network to reflect the VLAN# and device usage. In this example the Network is named VLAN 10 Data since it will be tagged with VLAN ID 10 and used for Data devices.

3 Click on the IPv4 Settings tab and change the IP Address to Router A s assigned IP address for VLAN 10 to Leave the IPv4 netmask and routing mode as default (NAT) Click on the VRRP tab - Note: If you do not have a Feature License for Router A VRRP it will be indicated on this screen. Feature License are not included and can be purchased thru your Cradlepoint Reseller Check the box to enable VRRP Set the Virtual Router IP (VIP) to this is the shared (floating) virtual IP address between the two VRRP routers. Set the Virtual Router ID (VRID) to 10 (Matching the VLAN ID for this example. VRID for each subnet must match on both routers) Set the Router priority to 110, this will make sure that Router A is the VRRP master and will win the election when online. Leave the WAN Fault Priority as the default setting (none). The default value facilitates a VRRP failover to the standby router when no WAN

4 connection is available on the master router. If you set the value to match the Router Priority of 110, then VRRP will not failover when the WAN connection is down. Set the initial Virtual router state to Master, this will set Router A to become master by default unless it loses the VRRP election process to a higher priority VRRP router. Set the Authentication mode to Simple Set the password to whatever password is desired for VLAN 10. The password must match on both Router VRRP configurations for VLAN 10 Check the box to provide the VIP as the gateway address for DHCP leases. This ensure that all DHCP issued IP addresses have the VIP as the gateway and will failover between routers without having to request a new DHCP lease. Click Submit Add Network for VLAN 20 VoIP (Voice over Internet Protocol) On the Local IP Network screen, click the Add button to create a new network for VLAN 20. Name the Network to reflect the VLAN# and Usage. In this example the Network is named VLAN 20 VoIP since it will be tagged with VLAN ID 20 and used for VoIP devices.

5 Click on the IPv4 Settings tab and change the IP Address to Router A s assigned IP address for VLAN 20 IP of and Netmask of ) Leave the IPv4 routing mode as default (NAT) Click on the VRRP tab Check the box to enable VRRP Set the Virtual Route IP (VIP) to this is the shared virtual IP address between the two VRRP routers. Set the Virtual Router ID (VRID) to 20 (Matching the VLAN ID for this example. The VRID for each subnet must match on both routers) Set the Router priority to 110, this will make sure that Router A is the VRRP master and will win the election when online.

6 Leave the WAN Fault Priority as the default setting (none). The default value facilitates a VRRP failover to the standby router when no WAN connection is available on the master router. If you set the value to match the Router Priority of 110, then VRRP will not failover when the WAN connection is down. Set the initial Virtual router state to Master, this will set Router A to become master by default unless it loses the VRRP election process to a higher priority VRRP router. Set the Authentication mode to Simple Set the password to whatever password is desired for VLAN 20. The password must match on both Router VRRP configurations for VLAN 20 Check the box to provide the VIP as the gateway address for DHCP leases. This ensure that all DHCP issued IP addresses have the VIP as the gateway and will failover between routers without having to request a new DHCP lease. Click Submit (Point of Sale) Add Network for VLAN 30 PoS On the Local IP Network screen, click the Add button to create a new network for VLAN 30. Name the Network to reflect the VLAN# and Usage. In this example the Network is named VLAN 30 PoS since it will be tagged with VLAN ID 30 and used for VoIP devices

7 Click on the IPv4 Settings tab and change the IP Address to Router A s assigned IP address for VLAN 30 to IP of and Netmask of ) Leave the IPv4 routing mode as default (NAT) Click on the VRRP tab Check the box to enable VRRP Set the virtual Route IP (VIP) to this is the shared virtual IP address between the two VRRP routers. Set the Virtual Router ID (VRID) to 30 (Matching the VLAN ID for this example. The VRID for each subnet must match on both routers) Set the Router priority to 110, this will make sure that Router A is the VRRP master and will win the election when online.

8 Leave the WAN Fault Priority as the default setting (none). The default value facilitates a VRRP failover to the standby router when no WAN connection is available on the master router. If you set the value to match the Router Priority of 110, then VRRP will not failover when the WAN connection is down. Set the initial Virtual router state to Master, this will set Router A to become master by default unless it loses the VRRP election process to a higher priority VRRP router. Set the authentication mode to Simple Set the password to whatever password is desired for VLAN 30. The password must match on both Router VRRP configurations for VLAN 30 Check the box to provide the VIP as the gateway address for DHCP leases. This ensure that all DHCP issued IP addresses have the VIP as the gateway and will failover between routers without having to request a new DHCP lease. Click Submit Create VLAN interfaces (assigning VLANs to a physical port) From the WiFi/Local Networks screen (This should be the active screen) scroll down to the Local Network Interfaces section. In this example we will be using ethernet port 4 for the 802.1q trunk port. Click on the VLAN Interfaces tab Click the Add button Assign the VID (10) and name it Data. Select LAN for the Mode. Click the Add button under Configured Ports Select Port 4 and Tagged for the Port mode and hit Submit

9 Hit Submit again to close the VLAN Editor window Repeat the previous 6 steps to create a VLAN for VLANs 20 and 30 (see example below) After creating all 3 VLANs the VLAN Interfaces tab should appear like the image below Assign L3 networks to Ethernet q trunk port The 3 networks that were configured now need to be assigned to the correct 802.1q trunk port. From the WiFi/Local Networks screen (This should be the active screen) scroll up to the Local IP Networks section. Check the box next to VLAN 10 Data and then click the Edit button. Click on the Interfaces tab on the left In the list of available Interfaces on the left, click on VLAN: 10-Data: Port(s)4 so that it s highlighted in blue, then click on the + button to add it to the Selected list of interfaces for the VLAN 10 Data network

10 Click Submit From the WiFi/Local Networks screen (This should be the active screen) Check the box next to VLAN 20 VoIP and then click the Edit button. Click on the Interfaces tab on the left In the list of available Interfaces on the left, click on VLAN: 20-VoIP: Port(s)4 so that it s highlighted in blue, then click on the + button to add it to the Selected list of interfaces for the VLAN 20 VoIP network Click Submit From the WiFi/Local Networks screen (This should be the active screen)

11 Check the box next to VLAN 30 PoS and then click the Edit button. Click on the Interfaces tab on the left In the list of available Interfaces on the left, click on VLAN: 30-PoS: Port(s)4 so that it s highlighted in blue, then click on the + button to add it to the Selected list of interfaces for the VLAN 30 PoS network Click Submit Router B Configuration Log Into the Cradlepoint Web Administration Interface (default) Under the Network Settings heading, select WiFi / Local Networks Check the box next to the Primary LAN (the default configuration) and click Edit Add/Modify Primary (default) Network for VLAN 10 Data (PCs, Printers) Modify the Name of the Network to reflect the VLAN # and Usage. In this example the Network is named VLAN 10 Data since it will be tagged with VLAN ID 10 and used for Data devices.

12 Click on the IPv4 Settings tab and change the IP Address to Router B s assigned IP address for VLAN 10 to Leave the IPv4 netmask and routing mode as default (NAT) Click on the IPv4 Settings tab and change the IP Address to Router B s assigned IP address for VLAN 10 to Leave the IPv4 netmask and routing mode as default (NAT) Click on the VRRP tab Note: If you do not have a Feature License on Router B for VRRP it will be indicated on this screen. Feature License are not included and can be purchased thru your Cradlepoint Reseller

13 Check the box to enable VRRP Set the Virtual Route IP (VIP) to this is the shared virtual IP address between the two VRRP routers. Set the Virtual Router ID (VRID) to 10 (Matching the VLAN ID for this example. The VRID for each subnet must match on both routers) Leave the default Router priority at 100, this will make sure that Router B is the VRRP backup when there is an election and both VRRP routers are online. Leave the WAN Fault Priority as the default setting (none). The default value facilitates a VRRP failover to the standby router when no WAN connection is available on the master router. If you set the value to match the Router Priority of 100, then VRRP will not failover when the WAN connection is down. Set the initial Virtual router state to Backup, this will set Router B to become backup by default unless it loses the VRRP election process to a higher priority VRRP router. Set the Authentication mode to Simple Set the password to whatever password is desired for VLAN 10. The password must match on both Router VRRP configurations for VLAN 10 Check the box to provide the VIP as the gateway address for DHCP leases. This ensure that all DHCP issued IP addresses have the VIP as the gateway and will failover between routers without having to request a new DHCP lease. Click Submit Add Network for VLAN 20 VoIP (Voice over Internet Protocol) On the Local IP Network screen, click the Add button to create a new network for VLAN 20. Name the Network to reflect the VLAN # and Usage. In this example the Network is named VLAN 20 VoIP since it will be tagged with VLAN ID 20 and used for VoIP devices.

14 Click on the IPv4 Settings tab and change the IP Address to Router B s assigned IP address for VLAN 20 IP is and Netmask is ) Leave the IPv4 routing mode as default (NAT) Click on the VRRP tab Check the box to enable VRRP Set the Virtual Route IP (VIP) to this is the shared virtual IP address between the two VRRP routers. Set the Virtual Router ID (VRID) to 20 (Matching the VLAN ID for this example. VRID for each subnet must match on both routers) Leave the default Router priority at 100, this will make sure that Router B is the VRRP backup when there is an election and both VRRP routers are online.

15 Leave the WAN Fault Priority as the default setting (none). The default value facilitates a VRRP failover to the standby router when no WAN connection is available on the master router. If you set the value to match the Router Priority of 100, then VRRP will not failover when the WAN connection is down. Set the initial Virtual router state to Backup, this will set Router B to become backup by default unless it loses the VRRP election process to a higher priority VRRP router. Set the Authentication mode to Simple Set the password to whatever password is desired for VLAN 20. The password must match on both Router VRRP configurations for VLAN 20 Check the box to provide the VIP as the gateway address for DHCP leases. This ensure that all DHCP issued IP addresses have the VIP as the gateway and will failover between routers without having to request a new DHCP lease. Click Submit Add Network for VLAN 30 PoS (Point of Sale) On the Local IP Network screen, click the Add button to create a new network for VLAN 30. Name the Network to reflect the VLAN# and Usage. In this example the Network is named VLAN 30 PoS since it will be tagged with VLAN ID 30 and used for VoIP devices

16 Click on the IPv4 Settings tab and change the IP Address to Router B s assigned IP address for VLAN 30 IP is and a Netmask of ) Leave the IPv4 routing mode as default (NAT) Click on the VRRP tab Check the box to enable VRRP Set the Virtual Route IP (VIP) to this is the shared virtual IP address between the two VRRP routers. Set the Virtual Router ID (VRID) to 30 (Matching the VLAN ID for this example. VRID for each subnet must match on both routers) Leave the default Router priority at 100, this will make sure that Router B is the VRRP backup when there is an election and both VRRP routers are online.

17 Leave the WAN Fault Priority as the default setting (none). The default value facilitates a VRRP failover to the standby router when no WAN connection is available on the master router. If you set the value to match the Router Priority of 100, then VRRP will not failover when the WAN connection is down. Set the initial Virtual router state to Backup, this will set Router B to become backup by default unless it loses the VRRP election process to a higher priority VRRP router. Set the Authentication mode to Simple Set the password to whatever password is desired for VLAN 30. The password must match on both Router VRRP configurations for VLAN 30 Check the box to provide the VIP as the gateway address for DHCP leases. This ensure that all DHCP issued IP addresses have the VIP as the gateway and will failover between routers without having to request a new DHCP lease. Click Submit Create VLAN interfaces (assigning VLANs to a physical port) From the WiFi/Local Networks screen (This should be the active screen) scroll down to the Local Network Interfaces section. In this example we will be using ethernet port 4 for the 802.1q trunk port. Click on the VLAN Interfaces tab Click the Add button Assign the VID (10) and name it Data. Select LAN for the Mode. Click the Add button under Configured Ports Select Port 4 and Tagged for the Port mode and hit Submit

18 Hit Submit again to close the VLAN Editor window Repeat the previous 6 steps to create a VLAN for VLANs 20 and 30 (see example below) After creating all 3 VLANs the VLAN Interfaces tab should appear like the image below Assign L3 networks to Ethernet q trunk port The 3 networks that were configured now need to be assigned to the correct 802.1q trunk port. From the WiFi/Local Networks screen (This should be the active screen) scroll up to the Local IP Networks section. Check the box next to VLAN 10 Data and then click the Edit button. Click on the Interfaces tab on the left In the list of available Interfaces on the left, click on VLAN: 10-Data: Port(s)4 so that it s highlighted in blue, then click on the + button to add it to the Selected list of interfaces for the VLAN 10 Data network

19 Click Submit From the WiFi/Local Networks screen (This should be the active screen) Check the box next to VLAN 20 VoIP and then click the Edit button. Click on the Interfaces tab on the left In the list of available Interfaces on the left, click on VLAN: 20-VoIP: Port(s)4 so that it s highlighted in blue, then click on the + button to add it to the Selected list of interfaces for the VLAN 20 VoIP network Click Submit From the WiFi/Local Networks screen (This should be the active screen)

20 Check the box next to VLAN 30 PoS and then click the Edit button. Click on the Interfaces tab on the left In the list of available Interfaces on the left, click on VLAN: 30-PoS: Port(s)4 so that it s highlighted in blue, then click on the + button to add it to the Selected list of interfaces for the VLAN 30 PoS network Click Submit Layer 2 Switch Configuration Configure the Layer 2 Switch Cradlepoint provides example configurations of 3rd party devices as interoperability examples only. Although Cradlepoint makes every effort to ensure that 3rd party configuration examples are correct, Cradlepoint accepts no responsibility for an issues resulting in the use of 3rd party configuration examples. Support for 3rd party devices and configurations are not provided by Cradlepoint Support. In this example we are using an 8 port Cisco 2960 series switch The native VLAN is set to an unused VLAN of 999. Cradlepoint routers do not utilize a native VLAN, so the native VLAN on the Layer 2 switch must be a VLAN number that is not used for network traffic. Fast Ethernet ports 7 and 8 are used for the two 802.1q trunk ports and then connected to Ethernet 4 on the two Cradlepoint routers Define the VLANs on the switch Switch#conf t Switch(config)#VLAN 10 Switch(config-vlan)#Name VLAN10Data Switch(config-vlan)#VLAN 20 Switch(config-vlan)#Name VLAN20VoIP Switch(config-vlan)#VLAN 30 Switch(config-vlan)#Name VLAN30PoS Configure fast Ethernet ports 7 and 8 Switch#conf t Switch(config)#int range fa0/7-8 Switch(config-if-range)#switchport mode trunk Switch(config-if-range)#switchport trunk native vlan 999 Switch(config-if-range)#switchport trunk allowed vlan 10,20,30 Switch(config-if-range)#no shutdown Switch(config-if-range)#description 802.1q Trunk to Cradlepoint Router Configure fast Ethernet port 1 as an access port for VLAN 10, this will be used to connect a PC to the network for testing and validation of the VRRP environment

21 Switch#conf t Switch(config)#int fa0/1 Switch(config-if)#switchport mode access Switch(config-if)#switchport access vlan 10 Switch(config-if)#spanning-tree portfast Switch(config-if)#no shutdown Remember to save your configuration when completed or the changes will be discarded when the switch reboots. Physically connect the two routers and a PC to the Layer 2 switch Connect an Ethernet cable to Ethernet port 4 on router A, connect the other end of the Ethernet cable to the Layer 2 switch, port 7 Connect an Ethernet cable to Ethernet port 4 on router A, connect the other end of the Ethernet cable to the Layer 2 switch, port 7 Connect an Ethernet cable to a PC, connect the other end of the Ethernet cable to the Layer 2 switch, port 1 Refer to the Network Topology for reference Validation From the PC connected to the Layer 2 switch validate that you can ping all the network interface IP addresses highlighted in the table below VLAN Name 802.1Q VLAN ID Router A IP Address Router B IP Address Virtual IP (VIP) Subnet Mask Default Gateway Router ID : : : : : : : : : : : : : : : : Data LAN VoIP LAN PoS LAN Log into each router s web interface, Router A Rotuer B On Router A navigate to Network Settings > WiFi / Local Networks The VRRP Failover State on Router A should show as Master for all three VLANs. It should appear as it does in the image below.

22 On Router B navigate to Network Settings > WiFi / Local Networks The VRRP Failover State on Router B should show as Backup for all three VLANs. It should appear as it does in the image below.

23 VRRP Failover State when a WAN link is down When a WAN link goes down on the Master of any VRRP network The VRRP Failover State will switch to Fault and relinquish Master status until WAN connectivity is restored. This is true for only the VRRP routers that are currently a Master when a WAN link fails. When WAN connectivity is restored the VRRP election process is initiated and a new Master is elected if it has the highest VRRP router priority. It s recommended to configure Advanced Failure Check on WAN links to ensure proper detection of a down WAN link. The following knowledgebase article explains how to configure this feature. Failure-Check-in-your-Series-3-router Below is an example of the VRRP router in the Fault state.

24 Technical Terms VRRP: Virtual Router Redundancy Protocol. VLAN: Virtual Local Area Network. Commonly used with a VLAN 802.1Q VLAN number Also referred to as a VLAN tag 802.1Q Trunk: Ethernet port configuration that sends and receives tagged frames for multiple VLANs Native VLAN: a default VLAN on a 802.1Q trunk connection that does not contain a VLAN tag, a.k.a. untagged frames. Virtual IP (VIP): Used in VRRP as the floating IP address between routers for default gateways. Router Priority: VRRP routers have a priority between The router with the highest priority (highest number) will become the master during the VRRP election process. Router ID: The Virtual Router Identifier or VRID is a unique number for each virtual router in a network. The Router ID is also referred to as the VRRP group number. The Router ID is used for identifying and establishing VRRP communications between virtual routers. VRRP Authentication: A simple alphanumeric string used as a password between virtual router instances to enhance security and prevent rogue

25 VRRP routers on a network from becoming active in the VRRP election process. WAN Fault Priority: An optional value to control automated demotion of a VRRP master to the backup state when a WAN link is down. Assumptions The Cradlepoint routers Local LAN interfaces have not been modified and are at their factory default configurations. A WAN source is available, tested and connected to both routers LAN devices are able to access the Internet via the Cradlepoint s WAN connection or each router. System Requirements Two VRRP capable Cradlepoint routers and a layer 2 switch that supports 802.1Q trunking. The VRRP feature is supported on following Cradlepoint Products with a valid Feature License. Supported on Cradlepoint Models: AER 2100, IBR1100 (All carrier models), IBR1150 (All carrier models), MBR1400v2, IBR600 (All carrier models), IBR650 (All carrier models) Troubleshooting Q: The VRRP routers do not negotiate a Master and Backup state correctly. A: Validate the All IP address information, VLAN IDs, VRRP passwords and Virtual Router IDs are set correctly. As a secondary setup, remove the Layer 2 switch from the network and directly connect port 4 on each router directly with an Ethernet cable, if this resolves the issue the problem is with the Layer 2 switch or Layer 2 switch configuration. Re-check the Layer 2 switch configuration. Q: I am unable to ping one or multiple IP addresses used on the Cradlepoint VRRP router network interfaces A: Connect a PC directly to Ethernet port 1 on the Cradlepoint router(s) that you are unable to ping and validate all VRRP configurations. If you are able to ping the IP addresses when directly connected to the Cradlepoint router then the problem is with the Layer 2 switch or Layer 2 switch configuration. Re-check the Layer 2 switch configuration. Q: The VRRP Master does not fail over when the WAN link is down. A: Verify that the WAN fault priority is set to none (blank) and that Advanced Failure check is configured correctly. If advanced failure check is not configured and the WAN interface still has an active link then it will not failover. Refer to the following knowledge base article for instructions for configuring this feature. Related Articles/Links Cradlepoint Knowledgebase How to configure advanced failure check Published Date: 01/16/2015