H3C S5830V2 & S5820V2 Switch Series

Transcription

1 H3C S5830V2 & S5820V2 Switch Series High Availability Configuration Guide Hangzhou H3C Technologies Co., Ltd. Software version: Release2108 Document version: 6W

2 Copyright 2012, Hangzhou H3C Technologies Co., Ltd. and its licensors All rights reserved Trademarks No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of Hangzhou H3C Technologies Co., Ltd. H3C,, Aolynk,, H 3 Care,, TOP G,, IRF, NetPilot, Neocean, NeoVTL, SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V 2 G, V n G, PSPT, XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co., Ltd. Notice All other trademarks that may be mentioned in this manual are the property of their respective owners The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied.

3 Preface The H3C S5830V2 & S5820V2 documentation set includes 10 configuration guides, which describe the software features for the H3C S5830V2 & S5820V2 Switch Series and guide you through the software configuration procedures. These configuration guides also provide configuration examples to help you apply software features to different network scenarios. The High Availability Configuration Guide describes the fundamentals and configuration of VRRP. VRRP adds a group of network gateways to a VRRP group, which forms a virtual router, to implement redundancy. This preface includes: Audience Conventions About the H3C S5830V2 & S5820V2 documentation set Obtaining documentation Technical support Documentation feedback Audience This documentation is intended for: Network planners Field technical support and servicing engineers Network administrators working with the S5830V2 & S5820V2 series Conventions This section describes the conventions used in this documentation set. Command conventions Convention Boldface Italic Description Bold text represents commands and keywords that you enter literally as shown. Italic text represents arguments that you replace with actual values. [ ] Square brackets enclose syntax choices (keywords or arguments) that are optional. { x y... } [ x y... ] { x y... } * Braces enclose a set of required syntax choices separated by vertical bars, from which you select one. Square brackets enclose a set of optional syntax choices separated by vertical bars, from which you select one or none. Asterisk marked braces enclose a set of required syntax choices separated by vertical bars, from which you select at least one.

4 Convention [ x y... ] * &<1-n> Description Asterisk marked square brackets enclose optional syntax choices separated by vertical bars, from which you select one choice, multiple choices, or none. The argument or keyword and argument combination before the ampersand (&) sign can be entered 1 to n times. # A line that starts with a pound (#) sign is comments. GUI conventions Convention Description < > Button names are inside angle brackets. For example, click <OK>. [ ] Window names, menu items, data table and field names are inside square brackets. For example, pop up the [New User] window. / Multi-level menus are separated by forward slashes. For example, [File/Create/Folder]. Symbols Convention WARNING CAUTION IMPORTANT NOTE TIP Description An alert that calls attention to important information that if not understood or followed can result in personal injury. An alert that calls attention to important information that if not understood or followed can result in data loss, data corruption, or damage to hardware or software. An alert that calls attention to essential information. An alert that contains additional or supplementary information. An alert that provides helpful information. Network topology icons Represents a generic network device, such as a router, switch, or firewall. Represents a routing-capable device, such as a router or Layer 3 switch. Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports Layer 2 forwarding and other Layer 2 features. About the H3C S5830V2 & S5820V2 documentation set The H3C S5830V2&S5820V2 documentation set includes:

5 Category Documents Purposes Hardware specifications and installation Software configuration Compliance and safety manual Installation quick start Installation guide Fan assemblies installation manual Power modules user manual Configuration guides Command references Provides regulatory information and the safety instructions that must be followed during installation. Provides basic installation instructions. Provides a complete guide to hardware installation and hardware specifications. Describes the appearance, specifications, and installation and removal of hot-swappable fan assemblies. Describes the appearance, specifications, and installation and removal of hot-swappable power modules. Describe software features and configuration procedures. Provide a quick reference to all available commands. Obtaining documentation You can access the most up-to-date H3C product documentation on the World Wide Web at Click the links on the top navigation bar to obtain different categories of product documentation: [Technical Support & Documents > Technical Documents] Provides hardware installation, software upgrading, and software feature configuration and maintenance documentation. [Products & Solutions] Provides information about products and technologies. [Technical Support & Documents > Software Download] Provides the documentation released with the software version. Technical support service@h3c.com Documentation feedback You can your comments about product documentation to info@h3c.com. We appreciate your comments.

6 Contents Configuring VRRP 1 Overview 1 VRRP standard mode 2 Router priority in a VRRP group 2 Preemption 3 Authentication method 3 VRRP timers 3 Packet format 4 How VRRP works 5 VRRP application 6 VRRP load balancing mode 7 Packet types 8 Virtual MAC address assignment 8 Virtual forwarder 10 Configuring IPv4 VRRP 12 IPv4 VRRP configuration task list 12 Specifying an IPv4 VRRP operating mode 12 Specifying the IPv4 VRRP version 13 Creating a VRRP group and assigning a virtual IP address 13 Configuring the router priority and preemptive mode 14 Configuring IPv4 VRRP packet attributes 14 Disabling an IPv4 VRRP group 15 Displaying and maintaining IPv4 VRRP 15 Configuring IPv6 VRRP 16 IPv6 VRRP configuration task list 16 Specifying an IPv6 VRRP operating mode 16 Creating a VRRP group and assigning a virtual IPv6 address 17 Configuring the router priority and preemptive mode 17 Configuring the IPv6 VRRP advertisement sending interval 18 Disabling an IPv6 VRRP group 18 Displaying and maintaining IPv6 VRRP 19 IPv4 VRRP configuration examples 19 Single VRRP group configuration example 19 Multiple VRRP groups configuration example 22 VRRP load balancing configuration example 25 IPv6 VRRP configuration examples 29 Single VRRP group configuration example 29 Multiple VRRP groups configuration example 32 VRRP load balancing configuration example 36 Troubleshooting VRRP 41 Error prompts are displayed frequently 41 Multiple masters appear in a VRRP group 41 Fast VRRP state flapping 42 Index 43 i

7 Configuring VRRP NOTE: VRRP is available only on VLAN interfaces. Overview Typically, you can configure a default route with the gateway as the next hop for every host on a subnet, as shown in Figure 1. All packets destined to other network segments are sent over the default route to the gateway, which then forwards the packets. However, when the gateway fails, all the hosts that use the gateway as the default next-hop router cannot communicate with external networks. Figure 1 LAN networking Configuring a default route for network hosts facilitates your configuration but also requires that the gateway has high availability. Using more egress gateways can improve availability, but this method introduces the problem of routing among the egresses. Virtual Router Redundancy Protocol (VRRP) is designed to address this problem. VRRP adds a group of network gateways to a VRRP group, which forms a virtual router. The gateways in the VRRP group automatically elect a master to provide services, and the hosts on the subnet only need to configure the virtual router as their default network gateway. VRRP avoids single points of failure and simplifies the configuration on hosts. When the master in the VRRP group on a multicast or broadcast capable LAN (for example, an Ethernet network) fails, another router in the VRRP group can take over as the master without causing dynamic route recalculation, route re-discovery, gateway reconfiguration on the hosts, or traffic interruption. VRRP works in either of the following modes: Standard protocol mode Implemented based on RFCs. For more information, see "VRRP standard mode." 1

8 Load balancing mode Extends the VRRP standard mode to distribute load across VRRP group members. For more information, see "VRRP load balancing mode." VRRP standard mode VRRP combines a set of routers (one master and multiple backups) on a subnet into a group called a "VRRP group." To the hosts on the subnet, the group of routers functions as a virtual router, which has a virtual IP address. A host on the subnet only needs to know the IP address of the virtual router and uses the IP address as the next hop of the default route. Therefore, every host on the subnet communicates with external networks through the virtual router. Routers in the VRRP group elect a master that acts as the gateway according to their priorities. The other routers function as backups. When the master fails, to ensure that the hosts in the network segment can uninterruptedly communicate with the external networks, the backups in the VRRP group elect a new master to act as the gateway. Figure 2 VRRP networking As shown in Figure 2, Router A, Router B, and Router C form a virtual router, which has its own IP address. Hosts on the subnet use the virtual router as the default gateway. The router with the highest priority among the three routers is elected as the master to act as the gateway, and the other two are backups. NOTE: The IP address of the virtual router can be either an unused IP address on the segment where the VRRP group resides or the IP address of an interface on a router in the VRRP group. In the latter case, the router is called the IP address owner. A VRRP group can have only one IP address owner. The state of a router in a VRRP group can be master, backup, initialize, or inactive. Router priority in a VRRP group VRRP determines the role (master or backup) of each router in a VRRP group by priority. A router with a higher priority is more likely to become the master. 2

9 VRRP priority ranges from 0 to 255, and a greater number represents a higher priority. Priorities 1 to 254 are configurable. Priority 0 is reserved for special uses, and priority 255 is for the IP address owner. The router acting as the IP address owner in a VRRP group always has the running priority 255 and acts as the master as long as it works properly. Preemption A router in a VRRP group works in either non-preemptive mode or preemptive mode. In non-preemptive mode, when a router in the VRRP group becomes the master, it acts as the master as long as it operates properly, even if a backup is assigned a higher priority later. The non-preemptive mode helps avoid frequent switchover between the master and backups. In preemptive mode, a backup takes over as the master and sends VRRP advertisements when it detects that it has a higher priority than the master. The previous master becomes a backup. The preemptive mode ensures that the router with the highest priority in a VRRP group always acts as the master. Authentication method To avoid attacks from unauthorized users, VRRP member routers add authentication keys in VRRP packets to authenticate one another. VRRP provides the following authentication methods: simple Simple text authentication The sender fills an authentication key into the VRRP packet, and the receiver compares the received authentication key with its local authentication key. If the two authentication keys are the same, the received VRRP packet is legitimate. Otherwise, the received packet is illegitimate and discarded. md5 MD5 authentication The sender computes a digest for the packet to be sent by using the authentication key and MD5 algorithm and saves the result in the authentication header. The receiver performs the same operation by using the authentication key and MD5 algorithm, and compares the result with the content in the authentication header. If the results are the same, the received VRRP packet is legitimate. Otherwise, the received packet is illegitimate and discarded. On a secure network, you can choose not to authenticate VRRP packets. NOTE: IPv4 VRRPv3 and IPv6 VRRPv3 do not support VRRP packet authentication. VRRP timers Skew_Time Skew_Time can help avoid the situation that multiple backups in a VRRP group become the master at the same time when the master in the VRRP group fails. Skew_Time is not configurable and its value depends on the version of VRRP: In VRRPv2 (described in RFC 3768), Skew_Time is (256 Router priority)/256 In VRRPv3 (described in RFC 5798), Skew_Time is ((256 Router priority) * VRRP advertisement sending interval)/256 3

10 VRRP advertisement sending interval The master in a VRRP group periodically sends VRRP advertisements to declare its presence. You can configure the interval at which the master sends VRRP advertisements. If a backup does not receive a new VRRP advertisement from the master when the timer (3 * VRRP advertisement sending interval + Skew_Time) expires, it regards the master failed and takes over as the master. VRRP preemption delay timer To avoid frequent state changes among members in a VRRP group and provide the backups enough time to collect information such as routing information, a backup does not immediately becomes the master after it receives an advertisement with lower priority than the local priority. Instead, it waits for a period of time (preemption delay time + Skew_Time) before taking over as the master. Packet format The master periodically multicasts VRRP packets to declare its presence. VRRP packets are used for checking the parameters of the virtual router and electing the master. VRRP packets are encapsulated in IP packets, with the protocol number being 112. VRRP has two versions: VRRPv2 and VRRPv3. VRRPv2 packet format VRRPv2 packet format is defined in RFC 3768, and applies to only IPv4 VRRP. Figure 3 VRRPv2 packet format A VRRPv2 packet comprises the following fields: Version Version number of the protocol: 2 for VRRPv2. Type Type of the VRRPv2 packet. It must be VRRP advertisement, represented by 1. Virtual Rtr ID (VRID) ID of the virtual router. It ranges from 1 to 255. Priority Priority of the router in the VRRP group, in the range 0 to 255. A greater value represents a higher priority. Count IP Addrs Number of virtual IPv4 addresses for the VRRP group. A VRRP group can have multiple virtual IPv4 addresses. Auth Type Authentication type. 0 means no authentication, 1 means simple text authentication, and 2 means MD5 authentication. Adver Int Interval for sending VRRP advertisements, in seconds. Checksum 16-bit checksum for validating the data in VRRP packets. 4

11 IP Address Virtual IPv4 address of the VRRP group. Authentication Data Authentication key. This field is used only for simple text authentication. For any other authentication mode, this field is always 0. VRRPv3 packet format VRRPv3 packet format is defined in RFC 5798, and applies to both IPv4 VRRP and IPv6 VRRP. Figure 4 VRRPv3 packet format A VRRPv3 packet comprises the following fields: Version Version number of the protocol: 3 for VRRPv3. Type Type of the VRRPv3 packet. It must be VRRP advertisement, represented by 1. Virtual Rtr ID (VRID) ID of the virtual router. It ranges from 1 to 255. Priority Priority of the router in the VRRP group, in the range 0 to 255. A greater value represents a higher priority. Count IPvX Addrs Number of virtual IPv4 or IPv6 addresses for the VRRP group. A VRRP group can have multiple virtual IPv4 or IPv6 addresses. Rsvd Reserved field. Adver Int Interval for sending VRRP advertisements, in centiseconds. Checksum 16-bit checksum for validating the data in VRRP packets. IPvX Address Virtual IPv4 or IPv6 address of the VRRP group. How VRRP works Routers in a VRRP group determine their roles by priority. The router with the highest priority is the master, and the others are the backups. The master periodically sends VRRP advertisements to notify the backups that it is working properly, and each of the backups starts a timer to wait for advertisements from the master. In preemptive mode, when a backup receives a VRRP advertisement, it compares the priority in the packet with its own priority. If the priority of the backup is higher, the backup becomes the master. Otherwise, it remains as a backup. In preemptive mode, the router with the highest priority in a VRRP group always acts as the master for packet forwarding. In non-preemptive mode, a router in the VRRP group remains as a master or backup as long as the master does not fail. A backup does not become the master even if it is configured with a higher priority. If a backup does not receive any VRRP advertisement when the timer (3 * advertisement sending interval + Skew_Time) expires, it considers that the master fails, and takes over as the master and send VRRP advertisements. 5

12 NOTE: When multiple routers in a VRRP group declare that they are the master because of inconsistent configuration or network problems, the one with the highest priority becomes the master. If two routers have the same priority, the one with the highest IP address becomes the master. When a backup router receives an advertisement, it only compares its priority with the advertised priority and IP addresses are not involved. If its priority is higher than the advertised priority, it takes over as the master. VRRP application Master/backup This section takes IPv4 VRRP as an example. In master/backup mode, only the master forwards packets. When the master fails, a new master is elected from the backups. This mode requires only one VRRP group, and each router in the group has a different priority. The one with the highest priority becomes the master. Figure 5 VRRP in master/backup mode Load sharing Assume that Router A is acting as the master to forward packets to external networks, and Router B and Router C are backups in listening state. When Router A fails, Router B and Router C elect a new master to forward packets for hosts on the subnet. A router can join multiple VRRP groups, and it can act as the master in one VRRP group and a backup in another. In load sharing mode, multiple VRRP groups provide gateway services. This mode requires at least two VRRP groups, and each group has one master and multiple backups. The master roles in the VRRP groups are assumed by different routers, as shown in Figure 6. 6

13 Figure 6 Load sharing of VRRP A router can be in multiple VRRP groups and have a different priority in a different group. As shown in Figure 6, the following VRRP groups are present: VRRP group 1 Router A is the master; Router B and Router C are the backups. VRRP group 2 Router B is the master; Router A and Router C are the backups. VRRP group 3 Router C is the master; Router A and Router B are the backups. For load sharing among Router A, Router B, and Router C, the hosts on the subnet must be configured with the virtual IP addresses of VRRP group 1, 2, and 3 as the default gateways, respectively. When you configure their priorities, make sure that each router has such a priority in each VRRP group that the router can take the expected role in each group. VRRP load balancing mode NOTE: IPv4 VRRPv3 does not support the load balancing mode. IPv6 VRRP and IPv4 VRRPv2 support the load balancing mode. In a VRRP group in standard mode, only the master can forward packets and the backups are in listening state. You can create multiple VRRP groups to share the traffic, but you must configure different gateways for the hosts on the subnet. In load balancing mode, a VRRP group maps its virtual IP address to multiple virtual MAC addresses: one virtual MAC address for each member router. The master uses these virtual MAC addresses of the member routers to respond to IPv4 ARP requests or IPv6 ND requests from hosts. Therefore, every router in this VRRP group can forward traffic and traffic from hosts is distributed across the VRRP group members. Load balancing mode simplifies configuration and improves forwarding efficiency. VRRP load balancing mode uses the same master election and preemption mechanisms as the standard mode, and adds new mechanisms as described in the following sections. 7

14 Packet types In standard mode, VRRP defines only VRRP advertisement. Only the master in a VRRP group periodically sends VRRP advertisements, and the backups do not send VRRP advertisements. To implement load balancing, VRRP defines the following types of packets: Advertisement Advertises the state of the local router in the VRRP group and information about the AVF on the local router. Both the master and the backups periodically send VRRP advertisements. Request If a backup is not the VF owner, the backup sends a request to ask the master to assign a virtual MAC address for it. Reply After the master receives a request, it sends a reply to the backup to assign a virtual MAC address for the backup. After receiving the reply, the backup router creates a VF that corresponds to the virtual MAC address. The backup is the owner of the VF. Release When a VF owner fails, the router that takes over sends a release after a specified period of time to notify the other routers in the VRRP group to delete the VF of the failed VF owner. NOTE: The packets in load balancing mode are similar to the advertisement in standard mode in the aspect of their format, but the load balancing mode adds an options field, which contains information for load balancing. Virtual MAC address assignment In load balancing mode, the master assigns virtual MAC addresses to the routers in the VRRP group and uses different MAC addresses to respond to the ARP requests or ND requests from different hosts. The backup routers, however, do not answer the ARP requests or ND requests from the hosts. Assume that a VRRP group works in an IPv4 network. The load balancing mode works as follows: 1. The master assigns virtual MAC addresses to all member routers, including itself. This example assumes that the virtual IP address of the VRRP group is /24, Router A is the master and Router B is the backup. Router A assigns 000f-e2ff-0011 for itself and 000f-e2ff-0012 for Router B. 8

15 Figure 7 Virtual MAC address assignment 2. When an ARP request arrives, the master (Router A) selects a virtual MAC address based on the load balancing algorithm to answer the ARP request. In this example, Router A returns the virtual MAC address of itself in response to the ARP request from Host A, and returns the virtual MAC address of Router B in response to the ARP request from Host B (see Figure 8). Figure 8 Answer ARP requests 3. Each host sends packets to the returned MAC address. As shown in Figure 9, Host A sends packets to Router A and Host B sends packets to Router B. 9

16 Figure 9 Send packets to different routers for forwarding Virtual forwarder Virtual forwarder creation Virtual MAC addresses enable traffic distribution across the routers in a VRRP group. To enable the routers in the VRRP group to forward packets, virtual forwarders (VFs) must be created on the routers. Each VF is associated with a virtual MAC address in the VRRP group and forwards packets that are sent to this virtual MAC address. VFs are created on the routers in a VRRP group, as follows: 1. The master assigns virtual MAC addresses to all routers in the VRRP group. Each member router creates a VF for this MAC address and becomes the owner of this VF. 2. Each router advertises its VF information to the other member routers. 3. After receiving the VF advertisement, each of the other routers creates the advertised VF. Eventually, every member router maintains one VF for each virtual MAC address in the VRRP group. VF weight and priority The weight of a VF indicates the forwarding capability of a VF. A higher weight means higher forwarding capability. When the weight is lower than the lower limit of failure, the VF cannot forward packets. The priority of a VF determines the VF state. Among the VFs created on different member routers for the same virtual MAC address, the VF with the highest priority, known as the active virtual forwarder (AVF), is in active state to forward packets, and all other VFs listen to the state of the AVF and are known as the listening virtual forwarders (LVFs). VF priority ranges from 0 to 255, where 255 is reserved for the VF owner. When the weight of a VF owner is higher than or equal to the lower limit of failure, the priority of the VF owner is 255. The priority of a VF is calculated based on its weight: On the router that owns the VF, if the weight of the VF is higher than or equal to the lower limit of failure, the priority of the VF is

17 VF backup On a router that does not own the VF, if the weight of the VF is higher than or equal to the lower limit of failure, the priority of the VF is weight/(number of local AVFs +1). If the weight of the VF is lower than the lower limit of failure, the priority of the VF is 0. The VFs corresponding to a virtual MAC address on different routers in the VRRP group back up one another. Figure 10 VF information Figure 10 shows the VF table on each router in the VRRP group and how the VFs back up one another. The master, Router A, assigns virtual MAC addresses 000f-e2ff-0011, 000f-e2ff-0012, and 000f-e2ff-0013 to itself, Router B, and Router C, and each router creates VF 1, VF 2, and VF 3 for the virtual MAC addresses, respectively. The VFs for the same virtual MAC address on different routers back up one another. For example, the VF 1 instances on Router A, Router B, and Router C back up one another. The VF 1 instance on Router A (the VF 1 owner) has priority 255 and acts as the AVF to forward the packets sent to virtual MAC address 000f-e2ff The VF 1 instances on Router B and Router C has priority 255/(1 + 1), or 127. Because their priorities are lower than the priority of the VF 1 instance on Router A, they act as LVFs to listen to the state of the VF 1 instance on Router A. When the VF 1 instance on Router A fails, the VF 1 instances on Router B and Router C elect the one with higher priority as the new AVF to forward the packets destined for virtual MAC address 000f-e2ff NOTE: A VF always works in preemptive mode. When an LVF finds its priority value higher than the one advertised by the AVF, the LVF declares itself as the AVF. 11

18 VF timers When the AVF on a router fails, the new AVF on another router creates a redirect timer and a timeout timer for the failed AVF. Redirect timer Before this timer times out, the master still uses the virtual MAC address corresponding to the failed AVF to respond to ARP/ND requests from the hosts, and the VF owner can share traffic load if the VF owner resumes normal operation within this time. When this timer times out, the master stops using the virtual MAC address corresponding to the failed AVF to respond to ARP/ND requests from the hosts. Timeout timer The duration that the new AVF takes over the responsibility of the failed VF owner. Before this timer times out, all the routers in the VRRP group keep the VFs that correspond to the failed AVF, and the new AVF forwards the packets destined for the virtual MAC address of the failed AVF. When this timer times out, all the routers in the VRRP group remove the VFs that correspond to the failed AVF, including the new AVF. The packets destined for the virtual MAC address of the failed AVF are not forwarded any longer. Configuring IPv4 VRRP This section describes how to configure IPv4 VRRP. IPv4 VRRP configuration task list To configure an IPv4 VRRP group, perform the following tasks on all routers that form the group: Tasks at a glance (Required) Specifying an IPv4 VRRP operating mode (Optional) Specifying the IPv4 VRRP version (Required) Creating a VRRP group and assigning a virtual IP address (Optional) Configuring the router priority and preemptive mode (Optional) Configuring IPv4 VRRP packet attributes (Optional) Disabling an IPv4 VRRP group Remarks N/A This configuration is not effective in VRRP load balancing mode. N/A N/A N/A N/A Specifying an IPv4 VRRP operating mode A VRRP group can work in either of the following modes: Standard mode Only the master can forward packets. Load balancing mode All members that have an AVF can forward packets. After the IPv4 VRRP operating mode is specified on a router, all IPv4 VRRP groups on the router work in the specified operating mode. To specify an IPv4 VRRP operating mode: 12

19 Step Command Remarks 1. Enter system view. system-view N/A 2. Specify an IPv4 VRRP operating mode. Specify the standard mode: undo vrrp mode Specify the load balancing mode: vrrp mode load-balance Use one of the commands. By default, VRRP works in standard mode. Specifying the IPv4 VRRP version You can specify IPv4 VRRPv2 or IPv4 VRRPv3 to use. To specify the IPv4 VRRP version: Step Command Remarks 1. Enter system view. system-view N/A 2. Enter interface view. interface interface-type interface-number N/A 3. Specify the VRRP version. vrrp version version-number By default, VRRPv3 is used. NOTE: When VRRP works in load balancing mode, VRRPv2 is always used and this command does not take effect. The VRRP version on all routers in an IPv4 VRRP group must be the same. Creating a VRRP group and assigning a virtual IP address A VRRP group can work normally after you create it and assign at least one virtual IP address for it. You can configure multiple virtual IP addresses for the VRRP group on an interface that connects to multiple subnets for router backup on different subnets. Configuration guidelines When VRRP works in standard mode, the virtual IP address of a VRRP group can be either an unused IP address on the subnet where the VRRP group resides or the IP address of an interface on a router in the VRRP group. When a router is the IP address owner in a VRRP group, do not configure the network command on the interface to use the IP address of the interface, or the virtual IP address of the VRRP group, to establish a neighbor relationship with the adjacent router. For more information about the network command, see Layer 3 IP Routing Command Reference. In load balancing mode, the virtual IP address of a VRRP group cannot be the same as the IP address of any interface in the VRRP group. If you create an IPv4 VRRP group but do not assign any virtual IP address for it, the VRRP group stays in inactive state and does not function. Removal of the VRRP group on the IP address owner causes IP address collision. To avoid the collision, change the IP address of the interface on the IP address owner before you remove the VRRP group from the interface. 13

20 The virtual IP addresses of an IPv4 VRRP group and the IP address of the interface where the VRRP group is configured must be in the same subnet. Otherwise, the hosts in the subnet cannot access external networks. Configuration procedure To create a VRRP group and assign a virtual IP address: Step Command Remarks 1. Enter system view. system-view N/A 2. Enter interface view. interface interface-type interface-number N/A 3. Create a VRRP group and assign a virtual IP address. vrrp vrid virtual-router-id virtual-ip virtual-address By default, no VRRP group exists. Configuring the router priority and preemptive mode The router priority and preemptive mode can determine which router in the VRRP group serves as the master. Configuration guidelines The running priority of an IP address owner is always 255 and you do not need to configure it. An IP address owner always works in preemptive mode. Configuration procedure To configure the router priority and preemptive mode: Step Command Remarks 1. Enter system view. system-view N/A 2. Enter interface view. 3. Configure the priority of the router in the VRRP group. 4. Enable the preemptive mode for the router in a VRRP group and configure the preemption delay time. interface interface-number interface-type vrrp vrid virtual-router-id priority priority-value vrrp vrid virtual-router-id preempt-mode [ delay delay-value ] N/A The default setting is 100. By default, the router in a VRRP group works in preemptive mode and the preemption delay time is 0 seconds, which means an immediate preemption. Configuring IPv4 VRRP packet attributes Configuration guidelines You can configure different authentication modes and authentication keys for the VRRP groups on an interface. However, members of the same VRRP group must use the same authentication mode and authentication key. In VRRPv3, authentication modes and authentication keys are not effective. In VRRPv2, all routers in a VRRP group must have the same VRRP advertisement sending interval. 14

21 In VRRPv3, the routers in an IPv4 VRRP group can have different intervals for sending VRRP advertisements. The master in the VRRP group sends VRRP advertisements at the specified interval and carries the interval in the advertisements. After a backup receives the advertisement, it records the interval in the advertisement. If the backup does not receive a new VRRP advertisement from the master when the timer (3 * recorded interval + Skew_Time) expires, it regards the master failed and takes over as the master. Configuration procedure To configure VRRP packet attributes: Step Command Remarks 1. Enter system view. system-view N/A 2. Enter interface view. 3. Configure the authentication mode and the authentication key for an IPv4 VRRP group to send and receive VRRP packets. 4. Configure the interval at which the master in an IPv4 VRRP group sends VRRP advertisements. 5. Enable TTL check for IPv4 VRRP packets. interface interface-number interface-type vrrp vrid virtual-router-id authentication-mode { md5 simple } { cipher plain } key vrrp vrid virtual-router-id timer advertise adver-interval vrrp check-ttl enable N/A By default, authentication is disabled. The default setting is 1 second. By default, TTL check for IPv4 VRRP packets is enabled. Disabling an IPv4 VRRP group You can temporarily disable an IPv4 VRRP group. After this configuration, the VRRP group stays in initialized state and its configurations remain unchanged. You can change the configuration of a VRRP group when the VRRP group is disabled. Your changes take effect when you enable the VRRP group again. To disable an IPv4 VRRP group: Step Command Remarks 1. Enter system view. system-view N/A 2. Enter interface view. interface interface-type interface-number N/A 3. Disable a VRRP group. vrrp vrid virtual-router-id shutdown By default, a VRRP group is enabled. Displaying and maintaining IPv4 VRRP Perform display commands in any view and the reset command in user view. 15

22 Task Display the states of IPv4 VRRP groups. Display statistics for IPv4 VRRP groups. Clear statistics for IPv4 VRRP groups. Command display vrrp [ interface interface-type interface-number [ vrid virtual-router-id ] ] [ verbose ] display vrrp statistics [ interface interface-type interface-number [ vrid virtual-router-id ] ] reset vrrp statistics [ interface interface-type interface-number [ vrid virtual-router-id ] ] Configuring IPv6 VRRP This section describes how to configure IPv6 VRRP. IPv6 VRRP configuration task list To configure an IPv6 VRRP group, perform the following tasks on all routers that form the group: Tasks at a glance (Required) Specifying an IPv6 VRRP operating mode (Required) Creating a VRRP group and assigning a virtual IPv6 address (Optional) Configuring the router priority and preemptive mode (Optional) Configuring the IPv6 VRRP advertisement sending interval (Optional) Disabling an IPv6 VRRP group Remarks N/A N/A N/A N/A N/A Specifying an IPv6 VRRP operating mode A VRRP group can work in either of the following two modes: Standard mode Only the master can forward packets. Load balancing mode All members that have an AVF can forward packets. After the IPv6 VRRP operating mode is specified on a router, all IPv6 VRRP groups on the router work in the specified operating mode. To specify an IPv6 VRRP operating mode: Step Command Remarks 1. Enter system view. system-view N/A 2. Specify an IPv6 VRRP operating mode. Specify the standard mode: undo vrrp ipv6 mode Specify the load balancing mode: vrrp ipv6 mode load-balance Use one of the commands. By default, VRRP works in standard mode. 16

23 Creating a VRRP group and assigning a virtual IPv6 address A VRRP group can work properly after you create it and assign at least one virtual IPv6 address for it. You can configure multiple virtual IPv6 addresses for the VRRP group on an interface that connects to multiple subnets for router backup. Configuration guidelines When a router is the IP address owner in a VRRP group, do not configure the ospfv3 area command on the interface to use the IPv6 address of the interface, or the virtual IPv6 address of the VRRP group, to establish an OSPFv3 neighbor relationship with the adjacent router. For more information about ospfv3 area command, see Layer 3 IP Routing Command Reference. In load balancing mode, the virtual IPv6 address of a VRRP group cannot be the same as the IPv6 address of any interface in the VRRP group. If you create an IPv6 VRRP group but do not assign any virtual IPv6 address for it, the VRRP group stays in inactive state and does not function. Removal of the VRRP group on the IP address owner causes IP address collision. To avoid the collision, change the IPv6 address of the interface on the IP address owner before you remove the VRRP group from the interface. The virtual IPv6 addresses of an IPv6 VRRP group and the IPv6 address of the interface where the VRRP group is configured must be in the same subnet. Otherwise, the hosts on the subnet cannot access external networks. Configuration procedure To create a VRRP group and assign a virtual IPv6 address: Step Command Remarks 1. Enter system view. system-view N/A 2. Enter interface view. interface interface-number interface-type N/A 3. Create a VRRP group and assign a virtual IPv6 address, which is a link-local address. 4. (Optional) Assign a virtual IPv6 address, which is a global unicast address. vrrp ipv6 vrid virtual-router-id virtual-ip virtual-address link-local vrrp ipv6 vrid virtual-router-id virtual-ip virtual-address By default, no VRRP group exists. The first virtual IPv6 address that you assign for an IPv6 VRRP group must be a link-local address, and it must be removed the last. Only one link local address is allowed in a VRRP group. By default, no global unicast address is assigned for an IPv6 VRRP group. Configuring the router priority and preemptive mode The router priority and preemptive mode can determine which router in the VRRP group serves as the master. Configuration guidelines The running priority of an IP address owner is always 255 and you do not need to configure it. An IP address owner always works in preemptive mode. 17

24 Configuration procedure To configure the router priority and preemptive mode: Step Command Remarks 1. Enter system view. system-view N/A 2. Enter interface view. 3. Configure the priority of the router in the VRRP group. 4. Enable the preemptive mode for the router in a VRRP group and configure the preemption delay time. interface interface-number interface-type vrrp ipv6 vrid virtual-router-id priority priority-value vrrp ipv6 vrid virtual-router-id preempt-mode [ delay delay-value ] N/A The default setting is 100. By default, the router in a VRRP group works in preemptive mode and the preemption delay time is 0 seconds, which means an immediate preemption. Configuring the IPv6 VRRP advertisement sending interval This section describes how to configure the IPv6 VRRP advertisement sending interval. Configuration guidelines The routers in an IPv6 VRRP group can have different intervals for sending VRRP advertisements. The master in the VRRP group sends VRRP advertisements at the specified interval and carries the interval attribute in the advertisements. After a backup receives the advertisement, it records the interval in the advertisement. If the backup does not receive a new VRRP advertisement from the master when the timer (3 * recorded interval + Skew_Time) expires, it regards the master failed and takes over as the master. Large network traffic might cause a backup failed to receive VRRP advertisements from the master within the specified time, and that an unexpected master switchover is triggered. To solve this problem, you can use this command to configure a larger interval. Configuration procedure To configure the IPv6 VRRP advertisement sending interval: Step Command Remarks 1. Enter system view. system-view N/A 2. Enter interface view. 3. Configure the IPv6 VRRP advertisement sending interval. interface interface-number interface-type vrrp ipv6 vrid virtual-router-id timer advertise adver-interval N/A The default setting is 100 centiseconds. Disabling an IPv6 VRRP group You can temporarily disable an IPv6 VRRP group. After this configuration, the VRRP group stays in initialized state and its configurations remain unchanged. You can change the configuration of a VRRP group when the VRRP group is disabled. Your changes take effect when you enable the VRRP group again. 18

25 To disable an IPv6 VRRP group: Step Command Remarks 1. Enter system view. system-view N/A 2. Enter interface view. interface interface-number interface-type N/A 3. Disable an IPv6 VRRP group. vrrp ipv6 vrid virtual-router-id shutdown By default, an IPv6 VRRP group is enabled. Displaying and maintaining IPv6 VRRP Perform display commands in any view and reset commands in user view. Task Display the states of IPv6 VRRP groups. Display statistics for IPv6 VRRP groups. Clear statistics for IPv6 VRRP groups. Command display vrrp ipv6 [ interface interface-type interface-number [ vrid virtual-router-id ] ] [ verbose ] display vrrp ipv6 statistics [ interface interface-type interface-number [ vrid virtual-router-id ] ] reset vrrp ipv6 statistics [ interface interface-type interface-number [ vrid virtual-router-id ] ] IPv4 VRRP configuration examples This section gives examples of how to configure IPv4 VRRP applications on switches. Single VRRP group configuration example This section gives an example of how to configure a single VRRP group on switches. Network requirements Switch A and Switch B form a VRRP group and use the virtual IP address /24 to provide gateway service for the subnet where Host A resides. Switch A works as the master to forward packets from Host A to Host B. When Switch A fails, Switch B takes over to forward packets for Host A. 19

26 Figure 11 Network diagram Configuration procedure 1. Configure Switch A: # Configure VLAN 2. <SwitchA> system-view [SwitchA] vlan 2 [SwitchA-vlan2] port ten-gigabitethernet 1/0/5 [SwitchA-vlan2] quit [SwitchA] interface vlan-interface 2 [SwitchA-Vlan-interface2] ip address # Create VRRP group 1 on VLAN-interface 2 and set its virtual IP address to [SwitchA-Vlan-interface2] vrrp vrid 1 virtual-ip # Assign Switch A a higher priority than Switch B in VRRP group 1 so Switch A can become the master. [SwitchA-Vlan-interface2] vrrp vrid 1 priority 110 # Configure Switch A to work in preemptive mode so it can become the master whenever it works properly, and set the preemption delay to five seconds to avoid frequent status switchover. [SwitchA-Vlan-interface2] vrrp vrid 1 preempt-mode delay 5 2. Configure Switch B: # Configure VLAN 2. <SwitchB> system-view [SwitchB] vlan 2 [SwitchB-Vlan2] port ten-gigabitethernet 1/0/5 [SwitchB-vlan2] quit [SwitchB] interface vlan-interface 2 [SwitchB-Vlan-interface2] ip address # Create VRRP group 1 on VLAN-interface 2 and set its virtual IP address to [SwitchB-Vlan-interface2] vrrp vrid 1 virtual-ip # Configure Switch B to work in preemptive mode and set the preemption delay to five seconds. [SwitchB-Vlan-interface2] vrrp vrid 1 preempt-mode delay 5 3. Verify the configuration: 20

27 # Ping Host B from Host A. (Details not shown) # Display detailed information about VRRP group 1 on Switch A. [SwitchA-Vlan-interface2] display vrrp verbose IPv4 Virtual Router Information: Running Mode : Standard Total number of virtual routers : 1 Interface Vlan-interface2 VRID : 1 Adver Timer : 1 Admin Status : Up State : Master Config Pri : 110 Running Pri : 110 Preempt Mode : Yes Delay Time : 5 Auth Type : None Virtual IP : Virtual MAC : e Master IP : # Display detailed information about VRRP group 1 on Switch B. [SwitchB-Vlan-interface2] display vrrp verbose IPv4 Virtual Router Information: Running Mode : Standard Total number of virtual routers : 1 Interface Vlan-interface2 VRID : 1 Adver Timer : 1 Admin Status : Up State : Backup Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time : 5 Auth Type : None Virtual IP : Master IP : The output shows that Switch A is working as the master in VRRP group 1 to forward packets from Host A to Host B. # Disconnect the link between Host A and Switch A and verify that Host A can still ping Host B. (Details not shown) # Display detailed information about VRRP group 1 on Switch B. [SwitchB-Vlan-interface2] display vrrp verbose IPv4 Virtual Router Information: Running Mode : Standard Total number of virtual routers : 1 Interface Vlan-interface2 VRID : 1 Adver Timer : 1 Admin Status : Up State : Master Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time : 5 Auth Type : None Virtual IP : Virtual MAC : e Master IP :

28 The output shows that when Switch A fails, Switch B takes over to forward packets from Host A to Host B. # Recover the link between Host A and Switch A and display detailed information about VRRP group 1 on Switch A. [SwitchA-Vlan-interface2] display vrrp verbose IPv4 Virtual Router Information: Running Mode : Standard Total number of virtual routers : 1 Interface Vlan-interface2 VRID : 1 Adver Timer : 1 Admin Status : Up State : Master Config Pri : 110 Running Pri : 110 Preempt Mode : Yes Delay Time : 5 Auth Type : None Virtual IP : Virtual MAC : e Master IP : The output shows that after Switch A resumes normal operation, it becomes the master to forward packets from Host A to Host B. Multiple VRRP groups configuration example This section gives an example of how to configure multiple VRRP groups on switches. Network requirements Switch A and Switch B form two VRRP groups. VRRP group 1 uses the virtual IP address /25 to provide gateway service for hosts in VLAN 2, and VRRP group 2 uses the virtual IP address /25 to provide gateway service for hosts in VLAN 3. Assign Switch A a higher priority than Switch B in VRRP group 1 but a lower priority in VRRP group 2 to distribute the traffic from VLAN 2 and VLAN 3 between the two switches. When one of the switches fails, the healthy switch provides gateway service for both VLANs. Figure 12 Network diagram VLAN 2 Gateway: /25 Virtual IP address 1: /25 XGE1/0/5 Vlan-int /25 XGE1/0/6 Vlan-int /25 Switch A Internet VLAN 3 Gateway: /25 XGE1/0/5 Vlan-int /25 XGE1/0/6 Vlan-int /25 Virtual IP address 2: /25 Switch B 22

29 Configuration procedure 1. Configure Switch A: # Configure VLAN 2. <SwitchA> system-view [SwitchA] vlan 2 [SwitchA-vlan2] port ten-gigabitethernet 1/0/5 [SwitchA-vlan2] quit [SwitchA] interface vlan-interface 2 [SwitchA-Vlan-interface2] ip address # Create VRRP group 1 and set its virtual IP address to [SwitchA-Vlan-interface2] vrrp vrid 1 virtual-ip # Assign Switch A a higher priority than Switch B in VRRP group 1 so Switch A can become the master in the group. [SwitchA-Vlan-interface2] vrrp vrid 1 priority 110 [SwitchA-Vlan-interface2] quit # Configure VLAN 3. [SwitchA] vlan 3 [SwitchA-vlan3] port ten-gigabitethernet 1/0/6 [SwitchA-vlan3] quit [SwitchA] interface vlan-interface 3 [SwitchA-Vlan-interface3] ip address # Create VRRP group 2 and set its virtual IP address to [SwitchA-Vlan-interface3] vrrp vrid 2 virtual-ip Configure Switch B: # Configure VLAN 2. <SwitchB> system-view [SwitchB] vlan 2 [SwitchB-vlan2] port ten-gigabitethernet 1/0/5 [SwitchB-vlan2] quit [SwitchB] interface vlan-interface 2 [SwitchB-Vlan-interface2] ip address # Create VRRP group 1 and set its virtual IP address to [SwitchB-Vlan-interface2] vrrp vrid 1 virtual-ip [SwitchB-Vlan-interface2] quit # Configure VLAN 3. [SwitchB] vlan 3 [SwitchB-vlan3] port ten-gigabitethernet 1/0/6 [SwitchB-vlan3] quit [SwitchB] interface vlan-interface 3 [SwitchB-Vlan-interface3] ip address # Create VRRP group 2 and set its virtual IP address to [SwitchB-Vlan-interface3] vrrp vrid 2 virtual-ip # Assign Switch B a higher priority than Switch A in VRRP group 2 so Switch B can become the master in the group. [SwitchB-Vlan-interface3] vrrp vrid 2 priority