HP Load Balancing Module

Transcription

1 HP Load Balancing Module High Availability Configuration Guide Part number: Document version: 6PW

2 Legal and notice information Copyright 2012 Hewlett-Packard Development Company, L.P. No part of this documentation may be reproduced or transmitted in any form or by any means without prior written consent of Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.

3 Contents High availability overview 1 Availability requirements 1 Availability evaluation 1 High availability technologies 2 Fault detection technologies 2 Protection switchover technologies 2 VRRP configuration 3 Overview 3 VRRP standard protocol mode 4 VRRP load balancing mode 9 Configuring VRRP in the web interface 12 Configuration task list 12 VRRP configuration examples 18 Configuring VRRP in the command line interface 24 VRRP configuration task list 24 Configuring the association between virtual IP address and MAC address 25 Configuring VRRP working mode 25 Specifying the VRRP control VLAN 26 Creating VRRP group and configuring virtual IP address 27 Configuring router priority, preemptive mode and tracking function 28 Configuring VF tracking 29 Configuring VRRP packet attributes 30 Enabling the trap function of VRRP 31 Displaying and maintaining VRRP 31 VRRP configuration examples 31 Troubleshooting VRRP 43 Symptom 1 43 Symptom 2 43 Symptom 3 44 Stateful failover configuration 45 Overview 45 Introduction to stateful failover 45 Introduction to stateful failover states 46 Configuring stateful failover 47 Stateful failover configuration example 48 Configuration guidelines 49 NQA configuration 50 NQA overview 50 Benefits of NQA 50 Basic NQA concepts 52 NQA probe operation procedure 53 NQA configuration task list 53 Configuring the NQA server 54 Enabling the NQA client 54 Creating an NQA test group 55 Configuring an NQA test group 55 Configuring ICMP echo tests 55 i

4 Configuring DHCP tests 56 Configuring DNS tests 57 Configuring FTP tests 58 Configuring HTTP tests 59 Configuring UDP jitter tests 60 Configuring SNMP tests 61 Configuring TCP tests 62 Configuring UDP echo tests 63 Configuring DLSw tests 64 Configuring the collaboration function 65 Configuring threshold monitoring 65 Configuring the NQA statistics collection function 66 Configuring the history records saving function 67 Configuring optional parameters for an NQA test group 67 Configuring a schedule for an NQA test group 68 Displaying and maintaining NQA 69 NQA configuration examples 70 ICMP echo test configuration example 70 DHCP test configuration example 71 DNS test configuration example 72 FTP test configuration example 73 HTTP test configuration example 75 UDP jitter test configuration example 76 SNMP test configuration example 79 TCP test configuration example 80 UDP echo test configuration example 82 DLSw test configuration example 83 NQA collaboration configuration example 84 Support and other resources 87 Contacting HP 87 Subscription service 87 Related information 87 Documents 87 Websites 87 Conventions 88 Index 90 ii

5 High availability overview Communication interruptions can seriously affect widely-deployed value-added services such as IPTV and video conference. Therefore, the basic network infrastructures must be able to provide high availability. The following are the effective ways to improve availability: Increasing fault tolerance Speeding up fault recovery Reducing impact of faults on services Availability requirements Availability requirements fall into three levels based on purpose and implementation, as shown in Table 1. Table 1 Availability requirements Level Purpose Implementation 1 Decrease system software and hardware faults Hardware: Simplifying circuit design, enhancing production techniques, and performing reliability tests. Software: Reliability design and test 2 3 Protect system functions from being affected if faults occur Enable the system to recover as fast as possible Device and link redundancy and deployment of switchover strategies Providing fault detection, diagnosis, isolation, and recovery technologies The level 1 availability requirement should be considered during the design and production process of network devices. The level 2 availability requirement should be considered during network design. The level 3 availability requirement should be considered during network deployment, according to the network infrastructure and service characteristics. Availability evaluation MTBF MTTR Mean Time Between Failures (MTBF) and Mean Time to Repair (MTTR) are used to evaluate the availability of a network. MTBF is the predicted elapsed time between inherent failures of a system during operation. It is typically in the unit of hours. A higher MTBF means a high availability. MTTR is the average time required to repair a failed system. MTTR in a broad sense also involves spare parts management and customer services. 1

6 MTTR = fault detection time + hardware replacement time + system initialization time + link recovery time + routing time + forwarding recovery time. A smaller value of each item, a smaller MTTR and a higher availability. High availability technologies Increasing MTBF or decreasing MTTR can enhance the availability of a network. The high availability technologies described in this section meet the level 3 high availability requirements in the aspect of decreasing MTTR. High availability technologies can be classified into fault detection technologies and protection switchover technologies. Fault detection technologies Fault detection technologies enable detection and diagnosis of network faults. NQA is used for diagnosis and evaluation of network quality. Table 2 Fault detection technologies Technology Introduction Reference NQA Network Quality Analyzer (NQA) analyzes network performance, services and service quality through sending test packets, and provides you with network performance and service quality parameters such as jitter, TCP connection delay, FTP connection delay and file transfer rate. NQA configuration in the High Reliability Configuration Guide Protection switchover technologies Protection switchover technologies aim at recovering network faults. They back up hardware, link, routing, and service information for switchover in case of network faults to ensure continuity of network services. For more information about protection switchover technologies, see Table 3. Table 3 Protection switchover technologies Technology Introduction Reference Active and Standby Switchover VRRP Devices supporting active and standby switchover are normally equipped with two main boards, with one being the active main board (AMB), and the other being the standby main board (SMB). The configurations on the SMB are the same as those on the AMB. When the AMB fails or is unplugged, the SMB automatically becomes the AMB to ensure non-stop operating of the devices. Virtual Router Redundancy Protocol (VRRP) is an error-tolerant protocol, which provides highly reliable default links on multicast and broadcast LANs such as Ethernet, avoiding network interruption due to failure of a single link. Active and standby switchover configuration in the High Availability Configuration Guide VRRP configuration in the High Availability Configuration Guide A single availability technology cannot solve all problems. Therefore, a combination of availability technologies, chosen on the basis of detailed analysis of network environments and user requirements, should be used to enhance network availability. For example, access-layer devices should be connected to distribution-layer devices over redundant links, and core-layer devices should be fully meshed. Also, network availability should be considered during planning prior to building a network. 2

7 VRRP configuration NOTE: The term router in this document refers to a network device running a routing protocol. The interfaces that VRRP involves can only be Layer 3 Ethernet interfaces and VLAN interfaces unless otherwise specified. You cannot configure VRRP on an interface of an aggregation group. VRRP includes VRRPv2 and VRRPv3. VRRPv2 is based on IPv4, and VRRPv3 is based on IPv6. The web interface supports only IPv4 VRRP configuration. Overview Typically, as shown in Figure 1, you can configure a default route with the gateway as the next hop for every host on a network segment. All packets destined to other network segments are sent over the default route to the gateway and then forwarded by the gateway. However, when the gateway fails, all the hosts using the gateway as the default next-hop router fail to communicate with the external network. Figure 1 LAN networking Configuring a default route for network hosts facilitates your configuration, but also requires high performance stability of the device acting as the gateway. Using more egress gateways is a common way to improve system reliability, introducing the problem of routing among the multiple egresses. Virtual Router Redundancy Protocol (VRRP) is designed to address this problem. VRRP adds routers that can act as network gateways to a VRRP group, which forms a virtual router. Routers in the VRRP group elect a master through the VRRP election mechanism to take the responsibility of a gateway, and hosts on a LAN only need to configure the virtual router as their default network gateway. VRRP is an error-tolerant protocol, which improves the network reliability and simplifies configurations on hosts. Deploying VRRP on multicast and broadcast LANs such as Ethernet, you can ensure that the system can still provide highly reliable default links without changing configurations (such as dynamic routing 3

8 protocols, route discovery protocols) when a router fails, and prevent network interruption due to failure of a single link. VRRP works in one of the following two modes: Standard protocol mode Includes two versions based on RFCs: VRRPv2 and VRRPv3. VRRPv2 is based on IPv4, and VRRPv3 is based on IPv6. The two versions implement the same functions but are applied in different network environments. For more information, see VRRP standard protocol mode. Load balancing mode Extends the standard protocol mode and realizes load balancing. For more information, see VRRP load balancing mode. VRRP standard protocol mode VRRP group overview VRRP combines a group of routers (including a master and multiple backups) on a LAN into a virtual router called VRRP group. A VRRP group has the following features: A virtual router has an IP address, called virtual IP address. A host on the LAN only needs to know the IP address of the virtual router and uses the IP address as the next hop of the default route. Every host on the LAN communicates with external networks through the virtual router. Routers in the VRRP group elect the gateway according to their priorities. The other routers function as the backups. When the master acting as the gateway fails, to ensure that the hosts in the network segment can communicate with the external networks uninterruptedly, the backups in the VRRP group elect a new gateway to undertake the responsibility of the failed master. Figure 2 Network diagram for VRRP As shown in Figure 2, Router A, Router B, and Router C form a virtual router, which has its own IP address. Hosts on the Ethernet use the virtual router as the default gateway. The router with the highest priority of the three routers is elected as the master to act as the gateway, and the other two are backups. 4

9 VRRP timers NOTE: A virtual IP address can be either an unused IP address on the segment where the VRRP group resides or the IP address of an interface on a router in the VRRP group. In the latter case, the router is called the IP address owner. In a VRRP group, you can configure only one IP address owner. Status of a router in a VRRP group includes master, backup, and initialize. 1. VRRP priority VRRP determines the role (master or backup) of each router in the VRRP group by priority. A router with a higher priority has more opportunity to become the master. VRRP priority is in the range of 0 to 255. A bigger number means a higher priority. Priorities 1 to 254 are configurable. Priority 0 is reserved for special uses and priority 255 for the IP address owner. When a router acts as the IP address owner, its priority is always 255. That is, the IP address owner in a VRRP group acts as the master as long as it works properly. 2. Working mode A router in a VRRP group works in one of the following two modes: Non-preemptive mode When a router in the VRRP group becomes the master, it stays as the master as long as it operates normally, even if a backup is assigned a higher priority later. Preemptive mode When a backup finds its priority higher than that of the master, the backup sends VRRP advertisements to start a new master election in the VRRP group and becomes the master. Accordingly, the original master becomes a backup. 3. Authentication mode To avoid being attacked by unauthorized users, VRRP authenticates the received packets by adding authentication keys into the packets. VRRP provides two authentication modes: simple Simple text authentication A router sending a packet fills an authentication key into the packet, and the router receiving the packet compares its local authentication key with that of the received packet. If the two authentication keys are the same, the received VRRP packet is considered real and valid; otherwise, the received packet is considered invalid. md5 MD5 authentication The router computes the digest of a packet to be sent using the authentication key and MD5 algorithm and saves the result in the authentication header. The router receiving the packet performs the same operation using the authentication key and MD5 algorithm, and compares the result with the content in the authentication header. If the results are the same, the router receiving the packet considers the packet an authentic and valid VRRP packet; otherwise, the router considers the packet invalid. On a secure network, you do not need to set the authentication mode. VRRP timers include VRRP advertisement interval timer and VRRP preemption delay timer. 1. VRRP advertisement interval timer The master in a VRRP group sends VRRP advertisements periodically to inform the other routers in the VRRP group that it operates properly. 5

10 You can adjust the interval for sending VRRP advertisements by setting the VRRP advertisement interval timer. If a backup receives no advertisements in a period three times the interval, the backup regards itself as the master and sends VRRP advertisements to start a new master election. 2. VRRP preemption delay timer To avoid members in a VRRP group from changing their states frequently and make backups have enough time to collect information (such as routing information), each backup waits for a period of time (the preemption delay time) after it receives an advertisement with the priority lower than the local priority, then sends VRRP advertisements to start a new master election in the VRRP group and finally becomes the master. Format of VRRP packets The master multicasts VRRP packets periodically to declare its existence. VRRP packets are also used for checking the parameters of the virtual router and electing the master. Figure 3 shows the format of a VRRPv2 packet. Figure 3 Format of a VRRPv2 packet Version Type Virtual Rtr ID Priority Count IP Addrs Auth Type Adver Int Checksum IP address 1 IP address n Authentication data 1 Authentication data 2 As shown in Figure 3, an IPv4-based VRRP packet consists of the following fields: Version Version number of the protocol, 2 for VRRPv2. Type Type of the VRRP packet. Only one VRRP packet type is present, that is, VRRP advertisement, which is represented by 1. Virtual Rtr ID (VRID) Serial number of the virtual router, that is, serial number of the VRRP group. It ranges from 1 to 255. Priority Priority of the router in the VRRP group, in the range 0 to 255. A greater value represents a higher priority. Count IP Addrs Number of virtual IP addresses for the VRRP group. A VRRP group can have multiple virtual IP addresses. Auth Type Authentication type. 0 means no authentication, 1 means simple text authentication, and 2 means MD5 authentication. Adver Int Interval for sending advertisements. For VRRPv2, the interval is in seconds and defaults to 1. Checksum 16-bit checksum for validating the data in VRRP packets. IP Address Virtual IP address entry of the VRRP group. The Count IP Addrs field defines the number of the virtual IP addresses. Authentication Data Authentication key. This field is used only for simple authentication and is 0 for any other authentication modes. 6

11 Principles of VRRP VRRP tracking 1. Routers in a VRRP group decide their respective roles by priority and IP address. The router with the highest priority becomes the master, and the others are the backups. If the routers have the same priority, the one with the highest IP address becomes the master. The master sends VRRP advertisements periodically to notify the backups that it is working properly, and each of the backups starts a timer to wait for advertisements from the master. 2. In preemptive mode, when a backup receives a VRRP advertisement, it compares the priority in the packet with that of its own. If the priority of the backup is higher, the backup becomes the master; otherwise, it remains a backup. 3. In non-preemptive mode, the router in the VRRP group remains as a master or backup as long as the master does not fail. The backup does not become the master even if the backup is configured with a higher priority. 4. If the timer of a backup expires but the backup still does not receive any VRRP advertisement, it considers that the master fails. In this case, the backup considers itself as the master and sends VRRP advertisements to start a new master election. 1. Tracking a Track object By monitoring a Track object, you can: Monitor an uplink and modify the priority of a router according to the state of the uplink. If there is a fault on the upper link, hosts in the LAN cannot access the external network through the router. In this case, the state of the monitored Track object is negative and the priority of the router decreases by a specified value. After that, a higher priority router in the VRRP group becomes the master to maintain the proper communication between the hosts in the LAN and the external network. Monitor the master on a backup. If there is a fault on the master, the backup working in the switchover mode switches to the master immediately to maintain normal communication. 2. Tracking a specified interface The interface tracking function expands the backup functionality of VRRP. It provides backup not only when the interface to which a VRRP group is assigned fails but also when other interfaces (such as uplink interfaces) on the router become unavailable. If the uplink interface of a router in a VRRP group fails, normally the VRRP group cannot be aware of the uplink failure. If the router is the master of the VRRP group, hosts on the LAN are not able to access the external network because of the uplink failure. You can solve the problem through the function of tracking a specified interface. In this case, it is the uplink interface. After you configure to monitor the uplink interface, when the uplink interface is in the down or removed status, the priority of the master is automatically decreased by a specified value and a higher priority router in the VRRP group becomes the master. VRRP application (taking IPv4-based VRRP as an example) 1. Master/backup In master/backup mode, only one router, the master, forwards packets. When the master fails, a new master is elected from the original backups. This mode requires only one VRRP group, in which each router holds a different priority and the one with the highest priority becomes the master, as shown in Figure 4. 7

12 Figure 4 VRRP in master/backup mode At the beginning, Router A is the master and therefore can forward packets to external networks, whereas Router B and Router C are backups and are thus in the state of listening. If Router A fails, Router B and Router C elect for a new master. The new master takes over the forwarding task to provide services to hosts on the LAN. 2. Load balancing You can create more than one VRRP group on an interface of a router, and allow the router to be the master of one VRRP group but a backup of another at the same time. In load balancing mode, multiple routers provide services at the same time. This mode requires two or more VRRP groups, each of which includes a master and one or more backups. The masters of the VRRP groups can be assumed by different routers, as shown in Figure 5. Figure 5 VRRP in load balancing mode A router can be in multiple VRRP groups and hold a different priority in different group. 8

13 In Figure 5, three VRRP groups are present: VRRP group 1 Router A is the master; Router B and Router C are the backups. VRRP group 2 Router B is the master; Router A and Router C are the backups. VRRP group 3 Router C is the master; Router A and Router B are the backups. To balance load among Router A, Router B, and Router C, configure hosts on the LAN to use VRRP group 1, 2, and 3 as the default gateways respectively. When configuring VRRP priorities, make sure that each router holds such a priority in each VRRP group that it will take the expected role in the group. VRRP load balancing mode Overview When VRRP works in the standard protocol mode, only the master can forward packets and the backups are in the state of listening. Although you can create multiple VRRP groups to implement load sharing among multiple routers, hosts on the LAN need to be configured with different gateways, thus making the configuration complicated. When VRRP works in the load balancing mode, namely, besides virtual gateway redundancy, VRRP realizes load balancing. The working principle is as follows: associate a virtual IP address with multiple virtual MAC addresses to make each router in a VRRP group correspond to a virtual MAC address. In this way, each router in this VRRP group can forward packets. In the load balancing mode, you need to create only one VRRP group to realize load balancing among multiple routers, thus avoiding that the backups are always in the idle state and the network resources are not fully utilized. NOTE: The VRRP load balancing mode is based on the VRRP standard protocol mode, so mechanisms, such as master election, preemption, and tracking functions, in the standard protocol mode are also supported in the load balancing mode. Besides, VRRP load balancing mode has some new mechanisms, which are introduced in the following parts. Allocating virtual MAC addresses When VRRP works in the load balancing mode, the master allocates virtual MAC addresses to routers in the VRRP group and replies the ARP requests from different hosts by allocating different virtual MAC addresses to the hosts. The backup routers, however, do not reply the ARP requests from the hosts. 9

14 Figure 6 Allocating virtual MAC addresses As shown in Figure 6, the virtual IP address of the VRRP group is /24; Router A is the master; Router B and Router C are the backups. Router A allocates different virtual MAC addresses to Routers A, B and C. Host A, Host B, and Host C send ARP requests to obtain the MAC address corresponding to the gateway with the virtual IP address The master (Router A) replies ARP requests of the hosts with different virtual MAC addresses. The MAC address obtained by Host A is the virtual MAC address of Router A, that is, Host A takes the virtual MAC address of Router A as the MAC address of the gateway, and thus to ensure that the packets from Host A are forwarded by Router A. The MAC address obtained by Host B is the virtual MAC address of Router B, and thus to ensure that the packets from Host B are forwarded by Router B. The MAC address obtained by Host C is the virtual MAC address of Router C, and thus to ensure that the packets from Host C are forwarded by Router C. Virtual forwarder When working in the load balancing mode, VRRP uses VFs to realize load balancing. Each VF associates with a virtual MAC address of the VRRP group and forwards packets destined to this virtual MAC address. The master allocates virtual MAC addresses to all routers (including the master and the backups) in the VRRP group. After obtaining its virtual MAC address, a router in the VRRP group will create a VF corresponding to this MAC address, and then the router becomes the owner of this VF. 1. VF weight and priority The weight of a VF indicates the forwarding capability of a router. The higher the weight, the higher the forwarding capability. When the weight is lower than a specified value which is the lower limit of failure, the router will not be capable of forwarding packets for the hosts. 10

15 The priority of a VF decides the VF state. A VF with the highest priority is in the active state and is known as the active virtual forwarder (AVF), which forwards packets; other VFs are in the listening state and are known as the listening virtual forwarders (LVFs), which listen to the state of the AVF. The priority value of a VF ranges from 0 to 255, where 255 is reserved for the VF owner. The priority value of a VF is calculated based on its weight. 2. VF backup If the weight of the VF owner is no less than the lower limit of failure, the priority of the VF owner is the highest value 255. Therefore, the VF owner is the AVF and forwards packets destined to the MAC address of the AVF. After receiving the advertisements sent by the AVF, other routers in the VRRP group create their own VFs, which are in the listening state. Figure 7 illustrates the VF information on each router in the VRRP group. Figure 7 VF information LVFs listen the AVF. When the AVF fails, the LVFs elect a new AVF with the highest priority value among the LVFs. A VF always works in the preemption mode. When an LVF finds its priority higher than that in the advertisement sent by the AVF, the LVF declares itself as the AVF. 3. VF tracking The AVF forwards packets destined to the MAC address of the AVF. If the uplink of the AVF fails and no LVF is notified to take over the AVF's work, hosts (on the LAN) that take the MAC address of the AVF as their gateway MAC address cannot access the external network. You can solve this problem through the VF tracking function. You can monitor the uplink state by using network quality analyzer (NQA) and bidirectional forwarding detection (BFD), and establish the collaboration between the VF and the NQA or between the VF and the BFD through the tracking function. When the uplink fails, the state of the monitored Track object changes to negative and the weight of the VF decreases by a specified value. After that, the VF with a higher priority becomes the AVF and forwards packets. 11

16 Packet Types VRRP standard protocol mode defines only VRRP advertisement. Only the master in a VRRP group sends VRRP advertisements periodically, and the backups do not send VRRP advertisements. To realize load balancing, VRRP load balancing mode defines the following types of packets: Advertisement VRRP uses the advertisements to notify the VRRP group state on the local router and the information of the VF that is in the active state. Both the master and the backups send VRRP advertisements periodically. Request If a backup router is not the VF owner, it sends a request to ask the master for virtual MAC address. Reply After receiving a request, the master sends a reply to the backup router to allocate a virtual MAC address. Upon receiving the reply, the backup router creates a VF corresponding to the virtual MAC address, and then the backup router becomes the owner of this VF. Release After a VF owner failed for a specified time, the router that takes over its responsibility will send a release to notify the other routers in the VRRP group to delete the VF of the failed VF owner. NOTE: The format of the above four types of packets is similar to that of the advertisement in the VRRP standard protocol mode. The difference is that a packet used in the load balancing mode is appended with option fields, which carry information for load balancing. Configuring VRRP in the web interface Configuration task list Table 4 VRRP configuration task list Task Creating a VRRP group Configuring a VRRP group Remarks Required Create a VRRP group on a VRRP interface and configure the virtual IP address. TIP: Before creating a VRRP group on an interface, you must configure an IP address for the interface and ensure that the virtual IP address to be configured is in the same network segment as the IP address of the interface. Configure router priority, preemption mode, authentication mode, packet attributes, and tracking function of the VRRP group. Creating a VRRP group Select High Availability > VRRP from the navigation tree to enter the VRRP interfaces page, as shown in Figure 8. Click the icon corresponding to the interface to be configured to enter the VRRP Configuration on Interface page, as shown in Figure 9. Click Add to enter the Create VRRP Group page. 12

17 Figure 8 VRRP interfaces page Figure 9 VRRP group page Figure 10 Create a VRRP group 13

18 Table 5 VRRP group configuration items Item VRID Virtual IP Description Set the group number of the VRRP group. Configure the virtual IP address of the VRRP group. If the VRRP interface connects to multiple subnets, you can configure multiple virtual IP addresses for the VRRP group to implement router backup on different subnets. TIP: The virtual IP address cannot be all 0s ( ), a broadcast address ( ), a loopback address, any other invalid IP address (like ), or an address that does not belong to class A, B or C. The virtual IP address can be either an unused IP address on the segment where the VRRP group resides or the IP address of an interface on a router in the VRRP group. In the latter case, the router is called the IP address owner. Removal of the VRRP group on the IP address owner will cause IP address collision. In such a case, it is recommended to modify the IP address of the interface on the IP address owner to resolve the collision. The VRRP group can operate normally only when the virtual IP address is valid and on the same network segment with the interface IP address. If the configured virtual IP address and the interface IP address do not belong to the same network segment, or the configured IP address is the network address or network broadcast address of the network segment that the interface IP address belongs to, the state of the VRRP group is always initialize though you can perform the configuration successfully, that is, VRRP does not take effect in this case. Table 6 VRRP group list items Item Run Priority Status Description Running status of a router, that is, the current status of the router. After you configure to monitor the specified interface or Track object, the priority of a router changes with the change of the interface or Track object. Status of the current router in the VRRP group, which takes the value of Master, Backup or Initialize. Return to VRRP configuration task list. Configuring a VRRP group Select High Availability > VRRP from the navigation tree to enter the VRRP interfaces page, as shown in Figure 8. Click the icon corresponding to the interface to be configured to enter the VRRP Configuration on Interface page, as shown in Figure 9. Click the icon corresponding to the VRRP group to be configured to enter the Modify VRRP Group page, and then click Display Track Config to expand the configuration items of the tracking function, as shown in Figure

19 Figure 11 Modify VRRP group Table 7 Configuration items of VRRP group attributes Item VRID Description Display group number of the VRRP group. 15

20 Item Description Configure the virtual IP address of the VRRP group. If an interface connects to multiple subnets, you can configure multiple virtual IP addresses for the VRRP group to implement router backup on different subnets. TIP: The virtual IP address cannot be , , a loopback address, any other invalid IP address (like ), or an address that does not belong to class A, B or C. Virtual IP The virtual IP address can be either an unused IP address on the segment where the VRRP group resides or the IP address of an interface on a router in the VRRP group. In the latter case, the router is called the IP address owner. Removal of the VRRP group on the IP address owner will cause IP address collision. In such a case, it is recommended to modify the IP address of the interface on the IP address owner to resolve the collision. The VRRP group can operate normally only when the configured virtual IP address and the interface IP address belong to the same segment and are valid host addresses. If the configured virtual IP address and the interface IP address do not belong to the same network segment, or the configured IP address is the network address or network broadcast address of the network segment that the interface IP address belongs to, the state of the VRRP group is always initialize though you can perform the configuration successfully, that is, VRRP does not take effect in this case. Set the priority of the routers in a VRRP group. The greater the value, the higher the priority. Priority TIP: VRRP determines the role (master or backup) of each router in the VRRP group by priority. A router with a higher priority has more opportunity to become the master. VRRP priority is in the range of 0 to 255. Priority 0 is reserved for special uses and priority 255 for the IP address owner. When a router acts as the IP address owner, its priority is always 255. That is, the IP address owner in a VRRP group acts as the master as long as it works properly. Preempt Mode Set the working mode of the VRRP group. Preemptive preemptive mode. After setting the preempt mode to Preemptive, you need to configure the preemption delay time. Non-preemptive non-preemptive mode. Delay TIP: An IP address owner always works in the preemptive mode. 16

21 Item Authentication Description Set the authentication mode and plain text authentication key of the VRRP group. Null no authentication and no authentication key. Simple simple text authentication. In this case, you need to configure a plain text authentication key. MD5 MD5 authentication. In this case, you need to configure a plain text authentication key. Key TIP: You can configure different authentication modes and authentication keys for the VRRP groups on an interface. However, the members of the same VRRP group must use the same authentication mode and authentication key. Set the interval at which the master sends VRRP advertisements. Advertise Time Excessive traffic or different timer setting on routers can cause the Backup timer to time out abnormally and trigger a change of the state. To solve this problem, you can prolong the time interval to send VRRP packets. TIP: Routers in the same VRRP group must use the same setting of advertisement interval. Track Object Track Interface Object Reduced Priority Switchover Interface Reduced Priority Configure the track object function: add the Track object to be monitored and the processing method. Object Specify the serial number of the Track object to be monitored. You can specify an uncreated object. Reduced Priority If the status of the monitored Track object changes to negative, the priority of the router decreases by a specified value. Switchover If the status of the monitored Track object changes to negative, the router immediately switches to the master. TIP: When the router is the IP address owner, you cannot perform the configuration. When the status of the monitored Track object turns from negative to positive, the corresponding router restores its priority automatically. In the list box of added Track object, the Priority/Switchover column displays a value or the letter S, where the value represents the decreased value of the router priority, and S represents the switchover mode. Configure the track interface function: add the specified interface to be monitored and the processing method. Interface name of the interface to be tracked. Reduced Priority If the status of the monitored interface turns from up to down, the priority of the router decreases by a specified value. TIP: When the router is the IP address owner, you cannot perform the configuration. When the status of the tracked interface turns from down or removed to up, the corresponding router restores its priority automatically. The specified interface can be a Layer 3 Ethernet interface or a VLAN interface. Return to VRRP configuration task list. 17

22 VRRP configuration examples Single VRRP group configuration example 1. Network requirements As shown in Figure 12: Host A needs to access Host B on the Internet, using /24 as its default gateway. LB A and LB B belong to VRRP group 1 with the virtual IP address of /24. If LB A operates normally, packets sent from Host A to Host B are forwarded by LB A; if Ten-GigabitEthernet 0/0.2 connecting LB A with the Internet becomes unavailable, packets sent from Host A to Host B are forwarded by LB B. Figure 12 Network diagram for single VRRP group configuration 2. Configure LB A # Configure the IP address of each interface and the zones. The configuration is omitted here. # Create VRRP group 1 on Ten-GigabitEthernet 0/0.1 and configure the virtual IP address as Select High Availability > VRRP from the navigation tree to enter the VRRP interfaces page. Click the icon corresponding to Ten-GigabitEthernet 0/0.1, and click Add to enter the page shown in Figure 13. Figure 13 Create VRRP group 1 18

23 Type 1 in the VRID box. Type in the Virtual IP box and then click Add to add the virtual IP address to the Virtual IP Members box. Click Apply. # Configure VRRP group attributes. On the VRRP group page of Ten-GigabitEthernet 0/0.1, click the icon corresponding to VRRP group 1 to enter the page shown in Figure 14. Figure 14 Configure VRRP group attributes Type 110 in the Priority box. Select Preemptive from the Preempt Mode box. Type 5 in the Delay box. Select Simple from the Authentication box. Type hello in the Key box. Type 5 in the Advertise Time box. Click Display Track Config. 19

24 Select Ten-GigabitEthernet0/0.2 from the Interface box, type 30 in the Reduced Priority box, and then click Add to add the interface to the list box of tracked interface. Click Apply. 3. Configure LB B # Configure the IP address of each interface and the zones. The configuration is omitted here. # Create VRRP group 1 on Ten-GigabitEthernet 0/0.1 and configure the virtual IP address as Select High Availability > VRRP from the navigation tree to enter the VRRP interfaces page. Click the icon corresponding to Ten-GigabitEthernet 0/0.1, and click Add to enter the page shown in Figure 15. Figure 15 Create VRRP group 1 Type 1 in the VRID box. Type in the Virtual IP box and click Add to add the virtual IP address to the Virtual IP Members box. Click Apply. # Configure VRRP group attributes. On the VRRP group page of Ten-GigabitEthernet 0/0.1, click the icon corresponding to VRRP group 1 to enter the page shown in Figure

25 Figure 16 Configure VRRP group attributes Select Preemptive from the Preempt Mode box. Type 5 in the Delay box. Select Simple from the Authentication box. Type hello in the Key box. Type 5 in the Advertise Time box. Click Apply. 4. Verify the configuration After the configuration, Host A can ping Host B. You can view the VRRP group information on Ten -GigabitEthernet 0/0.1 respectively on LB A and LB B. In VRRP group 1, LB A is the master and LB B is the backup router. LB A is responsible for forwarding packets sent from Host A to Host B. If the interface that connects LB A to the Internet (Ten -GigabitEthernet 0/0.2) fails, Host A can still ping Host B. In this case, the VRRP group information shows that LB A becomes a backup router with the priority being 80 and LB B becomes the master. LB B forwards the packets from Host A to Host B. Multiple VRRP groups configuration example 1. Network requirements As shown in Figure 17: In the segment /24, some hosts use /24 as their default gateway and some hosts use /24 as their default gateway. Use VRRP groups to implement load balancing and mutual backup between default gateways. 21

26 Figure 17 Network diagram for multiple VRRP groups configuration Virtual IP address 2: /24 Virtual IP address 1: /24 Host A Gateway: /24 XGE0/ /24 LB A Host B Gateway: /24 Gateway: /24 XGE0/ /24 LB B Internet Host C 2. Configure LB A # Configure the IP address of each interface and the zones. The configuration is omitted here. # Create VRRP group 1 on Ten -GigabitEthernet 0/0.1 and configure the virtual IP address as Select High Availability > VRRP from the navigation tree to enter the VRRP interfaces page. Click the icon corresponding to Ten -GigabitEthernet 0/0.1, and click Add to enter the page shown in Figure 18. Figure 18 Create VRRP group 1 Type 1 in the VRID box. Type in the Virtual IP box and click Add to add the virtual IP address to the Virtual IP Members box. Click Apply. # Create VRRP group 2 on Ten-GigabitEthernet 0/0.1 and configure the virtual IP address as On the VRRP group page of Ten-GigabitEthernet 0/0.1, click Add to enter the page shown in Figure

27 Figure 19 Create VRRP group 2 Type 2 in the VRID box. Type in the Virtual IP box and click Add to add the virtual IP address to the Virtual IP Members box. Click Apply. # Set the priority of LB A in VRRP group 1 to 110. On the VRRP group page of Ten-GigabitEthernet 0/0.1, click the icon corresponding to VRRP group 1 to enter the page shown in Figure 20. Figure 20 Set the priority of LB A in VRRP group 1 Type 110 in the Priority box. Click Apply. 3. Configure LB B The web interfaces for configuring LB B are similar to those for configuring LB A. The configuration procedure is omitted here. # Configure the IP address of each interface and the zones. (Omitted) # Create VRRP group 1 on Ten-GigabitEthernet 0/0.1 and configure the virtual IP address as

28 Select High Availability > VRRP from the navigation tree to enter the VRRP interfaces page. Click the icon corresponding to Ten-GigabitEthernet 0/0.1, and click Add. Type 1 in the VRID box. Type in the Virtual IP box and click Add to add the virtual IP address to the Virtual IP Members box. Click Apply. # Create VRRP group 2 on Ten-GigabitEthernet 0/0.1 and configure the virtual IP address as On the VRRP group page of Ten-GigabitEthernet 0/0.1, click Add. Type 2 in the VRID box. Type in the Virtual IP box and click Add to add the virtual IP address to the Virtual IP Members box. Click Apply. # Set the priority of LB B in VRRP group 2 to 110. Click the icon corresponding to VRRP group 2 on the VRRP group page of Ten-GigabitEthernet 0/0.1. Type 110 in the Priority box. Click Apply. 4. Verify the configuration After the configuration, the VRRP group information on Ten-GigabitEthernet 0/0.1 respectively on LB A and LB B shows that: In VRRP group 1, LB A is the master while LB B is the backup. Hosts on /24 access the Internet through LB A. In VRRP group 2, LB A is the backup while LB B is the master. Hosts on /24 access the Internet through LB B. Configuring VRRP in the command line interface VRRP configuration task list Task Configuring the association between virtual IP address and MAC address Configuring VRRP working mode Specifying the VRRP control VLAN Creating VRRP group and configuring virtual IP address Configuring router priority, preemptive mode and tracking function Remarks When VRRP works in the load balancing mode, the association between the virtual IP address and the MAC address can be configured but is not effective. Required 24

29 Task Configuring VF tracking Configuring VRRP packet attributes Enabling the trap function of VRRP Remarks The VF tracking function is effective only when VRRP works in the load balancing mode. Configuring the association between virtual IP address and MAC address After the virtual IP address of a VRRP group is associated with a MAC address, the master takes the configured MAC address as the source MAC address of the packets to be sent, so that the hosts in the internal network can learn the association between the IP address and the MAC address and thus forward the packets to be forwarded to the other network segments to the master. There are two types of association between virtual IP address and MAC address: Virtual IP address is associated with virtual MAC address By default, a MAC address is created for a VRRP group after the VRRP group is created, and the virtual IP address is associated with the virtual MAC address. With such association adopted, the hosts in the internal network do not need to update the association between IP address and MAC address when the master changes. Virtual IP address is associated with real MAC address of the interface If an IP address owner exists in a VRRP group and you associate the virtual IP address with the virtual MAC address, two MAC addresses are associated with an IP address. In this case, you can associate the virtual IP address of the VRRP group with the real MAC address, so that the packets from a host are forwarded to the IP address owner according to the real MAC address. Follow these steps to configure the association between MAC address and virtual IP address: To do Use the command Remarks Enter system view system-view Configure the association between virtual IP address and MAC address vrrp method { real-mac virtual-mac } The virtual MAC address is associated with the virtual IP address by default. NOTE: When VRRP works in the load balancing mode, the association between the virtual IP address and the MAC address can be configured but is not effective. In this mode, the virtual IP address is always associated with the virtual MAC address. You should configure this function before creating a VRRP group. Otherwise, you cannot modify the mapping between the virtual IP address and the MAC address. Configuring VRRP working mode VRRP works in one of the following two modes: Standard protocol mode In a VRRP group, only the master forwards packets. 25

30 Load balancing mode In a VRRP group, all routers (master and backups) that have AVF can forward packets to realize load balancing. After you configure the working mode of a VRRP group, all VRRP groups on the router work in the same mode. Follow these steps to configure the VRRP working mode: To do Use the command Remarks Enter system view system-view Configure VRRP to work in the standard protocol mode Configure VRRP to work in the load balancing mode undo vrrp mode vrrp mode load-balance By default, VRRP works in the standard protocol mode. By default, VRRP works in the standard protocol mode. Specifying the VRRP control VLAN Figure 21 Network diagram for VRRP control VLAN To realize inter-vlan or LAN-WAN communication, you need to configure VLAN termination on the subinterfaces of Layer 3 Ethernet interfaces on routers. As shown in Figure 21, configure ambiguous VLAN termination for VLAN 10 and VLAN 20 on the Layer 3 Ethernet subinterfaces on routers. At this time, if you enable the subinterfaces configured with VLAN termination to transmit broadcast/multicast packets, the master sends VRRP advertisements within all VLANs whose VLAN packets are configured to be terminated by the subinterfaces. If the Layer 3 Ethernet subinterfaces are configured to terminate packets from many VLANs, there will be many VRRP advertisements to be transmitted through the subinterfaces, and the performance of the router will be seriously affected. If you disable the subinterfaces configured with VLAN termination from transmitting broadcast/multicast packets, the master cannot send VRRP advertisements to the backups. To solve this problem, you can configure a VRRP control VLAN to allow the master to send VRRP advertisements only within the control VLAN when the subinterfaces configured with VLAN termination are disabled from transmitting broadcast/multicast packets VRRP control VLAN falls into two categories: 26

31 Specify a single VLAN tag For subinterfaces configured with ambiguous Dot1q termination, this type of control VLAN should be specified. Specify both inner and outer VLAN tags For subinterfaces configured with ambiguous QinQ termination, this type of control VLAN should be specified. Follow these steps to specify the VRRP control VLAN: To do Use the command Remarks Enter system view system-view Layer 3 Ethernet subinterface view Specify a VRRP control VLAN for the subinterface configured with ambiguous Dot1q termination Specify a VRRP control VLAN for the subinterface configured with ambiguous QinQ termination interface interface-type interface-number.subnumber vrrp dot1q vid vlan-id vrrp dot1q vid vlan-id secondary-dot1q secondary-vlan-id Required Use either command. By default, no VRRP control VLAN is specified for the subinterface configured with VLAN termination, that is, the master sends VRRP advertisements within all VLANs whose VLAN packets are configured to be terminated by the subinterface. Creating VRRP group and configuring virtual IP address You need to configure a virtual IP address for a VRRP group when creating the VRRP group on an interface. If the interface connects to multiple sub-networks, you can configure multiple virtual IP addresses for the VRRP group to realize router backup on different sub-networks. A VRRP group is created automatically when you specify the first virtual IP address for the VRRP group. If you specify another virtual IP address for the VRRP group later, the virtual IP address is added to the virtual IP address list of the VRRP group. Configuration prerequisites Before creating a VRRP group and configuring a virtual IP address on an interface, you should first configure an IP address for the interface and ensure that the virtual IP address to be configured is in the same network segment as the IP address of the interface. Configuration procedure Follow these steps to create VRRP group and configure virtual IP address: To do Use the command Remarks Enter system view system-view Enter the specified interface view Create VRRP group and configure virtual IP address of the VRRP group interface interface-type interface-number vrrp vrid virtual-router-id virtual-ip virtual-address Required VRRP group is not created by default. 27

32 NOTE: When VRRP works in the load balancing mode, the virtual IP address cannot be the same with IP address of any interface in the VRRP group, that is, in the load balancing mode, the VRRP group does not have an IP address owner. A VRRP group is removed after you remove all the virtual IP addresses in it. In addition, configurations on that VRRP group no longer take effect. The virtual IP address of the virtual router can be either an unused IP address on the segment where the VRRP group resides or the IP address of an interface on a router in the VRRP group. In the latter case, the router is called the IP address owner. Removal of the VRRP group on the IP address owner will cause IP address collision. In such a case, it is recommended to modify the IP address of the interface on the IP address owner to resolve the collision. The virtual IP address of the VRRP group cannot be , , loopback addresses, non class A/B/C addresses or other illegal IP addresses such as Only when the configured virtual IP address and the interface IP address belong to the same segment and are legal host addresses can the VRRP group operate normally. If the configured virtual IP address and the interface IP address do not belong to the same network segment, or the configured IP address is the network address or network broadcast address of the network segment that the interface IP address belongs to, the state of the VRRP group is always initialize though you can perform the configuration successfully, that is, VRRP does not take effect in this case. Configuring router priority, preemptive mode and tracking function Configuration prerequisites Before you configure these features, you should first create a VRRP group on the interface and configure a virtual IP address for it. Configuration procedure By configuring router priority, preemptive mode, interface tracking, or a Track object, you can decide which router in the VRRP group serves as the Master. Follow these steps to configure router priority, preemptive mode and the Track object tracking function: To do Use the command Remarks Enter system view system-view Enter interface view Configure router priority in the VRRP group Configure the router in the VRRP group to work in preemptive mode and configure preemption delay interface interface-type interface-number vrrp vrid virtual-router-id priority priority-value vrrp vrid virtual-router-id preempt-mode [ timer delay delay-value ] 100 by default. The router in the VRRP group works in preemptive mode and the preemption delay is 0 seconds by default. 28

33 To do Use the command Remarks Configure the interface to be tracked Configure VRRP to track a specified Track object vrrp vrid virtual-router-id track interface interface-type interface-number [ reduced priority-reduced ] vrrp vrid virtual-router-id track track-entry-number [ reduced priority-reduced switchover ] No interface is being tracked by default. Not configured by default. NOTE: The running priority of an IP address owner is always 255 and you do not need to configure it. An IP address owner always works in the preemptive mode. Do not configure VRRP tracking of an interface or an object on an IP address owner. The tracked interface can be a Layer 3 Ethernet interface or a VLAN interface. If the state of the interface under tracking changes from down or removed to up, the priority of the router corresponding to the interface is restored automatically. If the state of a track object changes from negative to positive or invalid, the priority of the router corresponding to the Track object is restored automatically. Configuring VF tracking Configuration prerequisites Before configuring the VF tracking function, create a VRRP group and configure a virtual IP address for it. Configuration procedure VRRP works in the load balancing mode. Suppose that the VF is configured to monitor the Track object. When the state of the Track object becomes negative, the weight values of all VFs on the routers decrease by a specified value; when the state of the Track object becomes positive or invalid, the weight values of all VFs on the routers restore their original values. Follow these steps to configure VF tracking: To do Use the command Remarks Enter system view system-view Enter the specified interface view interface interface-type interface-number Configure the VF to monitor a specified Track object vrrp vrid virtual-router-id weight track track-entry-number [ reduced weight-reduced ] Required No Track object is specified by default. 29

34 NOTE: You can configure the VF tracking function when VRRP works in either the standard protocol mode or the load balancing mode; however, the VF tracking function is effective only when VRRP works in the load balancing mode. Do not configure VF tracking on an IP address owner. By default, the weight of a VF is 255, and its lower limit of failure is 10. If the weight of a VF owner is higher than or equal to the lower limit of failure, the priority of the VF owner is always 255 and does not change with the weight value. Therefore, in case of an uplink failure, only when the weight of the VF owner decreases a properly specified value and becomes lower than the lower limit of failure, can another VF takes over the VF owner's work and becomes the AVF. Configuring VRRP packet attributes Configuration prerequisites Before configuring the relevant attributes of VRRP packets, you should first create a VRRP group and configure a virtual IP address for it. Configuration procedure Follow these steps to configure VRRP packet attributes: To do Use the command Remarks Enter system view system-view Enter the specified interface view Configure the authentication mode and authentication key when the VRRP groups send and receive VRRP packets Configure the time interval for the Master in the VRRP group to send VRRP advertisement Disable TTL check on VRRP packets interface interface-type interface-number vrrp vrid virtual-router-id authentication-mode { md5 simple } key vrrp vrid virtual-router-id timer advertise adver-interval vrrp un-check ttl Authentication is not performed by default 1 second by default Enabled by default You do not need to create a VRRP group before executing this command. NOTE: You may configure different authentication modes and authentication keys for the VRRP groups on an interface. However, the members of the same VRRP group must use the same authentication mode and authentication key. Excessive traffic or different timer setting on routers can cause the Backup timer to time out abnormally and trigger a change of the state. To solve this problem, you can prolong the time interval to send VRRP packets. 30

35 Enabling the trap function of VRRP After the trap function is enabled for a VRRP module, the VRRP module will generate traps with severity level errors to report its key events. The generated traps will be sent to the information center of the LB module, where you can configure whether to output the trap information and the output destination. For more information about information center configuration, see System Management Configuration Guide. Follow these steps to enable the trap function of VRRP: To do Use the command Remarks Enter system view system-view Enable the trap function of VRRP snmp-agent trap enable vrrp [ authfailure newmaster ] Enabled by default. Displaying and maintaining VRRP To do Use the command Remarks Display VRRP group status display vrrp [ verbose ] [ interface interface-type interface-number [ vrid virtual-router-id ] ] Available in any view Display VRRP group statistics Clear VRRP group statistics display vrrp statistics [ interface interface-type interface-number [ vrid virtual-router-id ] ] reset vrrp statistics [ interface interface-type interface-number [ vrid virtual-router-id ] ] Available in any view Available in user view VRRP configuration examples This section provides the following configuration examples: Single VRRP group configuration example VRRP interface tracking configuration example Multiple VRRP groups configuration example VRRP load balancing mode configuration example Single VRRP group configuration example 1. Network requirements Host A needs to access Host B on the Internet, using /24 as its default gateway. LB A and LB B belong to VRRP group 1 with the virtual IP address of /24. If LB A operates normally, packets sent from Host A to Host B are forwarded by LB A; if LB A fails, packets sent from Host A to Host B are forwarded by LB B. 31

36 Figure 22 Network diagram for single VRRP group configuration Virtual IP address: /24 XGE0/ /24 LB A / /24 Internet Host A XGE0/ /24 Host B LB B 2. Configure LB A <LB A> system-view [LB A] interface Ten-GigabitEthernet 0/0.1 [LB A-Ten-GigabitEthernet0/0.1] ip address # Create VRRP group 1 and configure its virtual IP address as [LB A-Ten-GigabitEthernet0/0.1] vrrp vrid 1 virtual-ip # Configure the priority of LB A in the VRRP group 1 as 110. [LB A-Ten-GigabitEthernet0/0.1] vrrp vrid 1 priority 110 # Configure LB A to work in preemptive mode and configure the preemption delay as five seconds. [LB A-Ten-GigabitEthernet0/0.1] vrrp vrid 1 preempt-mode timer delay 5 3. Configure LB B <LB B> system-view [LB B] interface Ten-GigabitEthernet 0/0.1 [LB B-Ten-GigabitEthernet0/0.1] ip address # Create VRRP group 1 and configure its virtual IP address as [LB B-Ten-GigabitEthernet0/0.1] vrrp vrid 1 virtual-ip # Configure LB B to work in the preemptive mode, with the preemption delay set to 5 seconds. [LB B-Ten-GigabitEthernet0/0.1] vrrp vrid 1 preempt-mode timer delay 5 4. Verify the configuration After the configuration, Host B can be pinged through on Host A. You can use the display vrrp verbose command to verify the configuration. # Display detailed information of VRRP group 1 on LB A. [LB A-Ten-GigabitEthernet0/0.1] display vrrp verbose IPv4 Standby Information: Run Mode : Standard Run Method : Virtual MAC Total number of virtual routers : 1 Interface Ten-GigabitEthernet0/0.1 VRID : 1 Adver Timer : 1 Admin Status : Up State : Master 32

37 Config Pri : 110 Running Pri : 110 Preempt Mode : Yes Delay Time : 5 Auth Type : None Virtual IP : Virtual MAC : e Master IP : # Display detailed information of VRRP group 1 on LB B. [LB B-Ten-GigabitEthernet0/0.1] display vrrp verbose IPv4 Standby Information: Run Mode : Standard Run Method : Virtual MAC Total number of virtual routers : 1 Interface Ten-GigabitEthernet0/0.1 VRID : 1 Adver Timer : 1 Admin Status : Up State : Backup Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time : 5 Auth Type : None Virtual IP : Master IP : The above information indicates that in VRRP group 1 LB A is the master, LB B is the backup and packets sent from Host A to Host B are forwarded by LB A. If LB A fails, you can still ping through Host B on Host A. You can use the display vrrp verbose command to view the detailed information of the VRRP group on LB B. # If LB A fails, the detailed information of VRRP group 1 on LB B is displayed. [LB B-Ten-GigabitEthernet0/0.1] display vrrp verbose IPv4 Standby Information: Run Mode : Standard Run Method : Virtual MAC Total number of virtual routers : 1 Interface Ten-GigabitEthernet0/0.1 VRID : 1 Adver Timer : 1 Admin Status : Up State : Master Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time : 5 Auth Type : None Virtual IP : Virtual MAC : e Master IP : The above information indicates that if LB A fails, LB B becomes the master, and packets sent from host A to host B are forwarded by LB B. VRRP interface tracking configuration example 1. Network requirements Host A needs to access Host B on the Internet, using /24 as its default gateway. LB A and LB B belong to VRRP group 1 with the virtual IP address of /24. 33

38 If LB A operates normally, packets sent from Host A to Host B are forwarded by LB A; if interface Ten-GigabitEthernet 0/0.1 through which LB A connects to the internet is not available, packets sent from Host A to Host B are forwarded by LB B. Figure 23 Network diagram for interface tracking in VRRP 2. Configure LB A <LB A> system-view [LB A] interface Ten-GigabitEthernet 0/0.2 [LB A-Ten-GigabitEthernet0/0.2] ip address # Create VRRP group 1 and configure its virtual IP address as [LB A-Ten-GigabitEthernet0/0.2] vrrp vrid 1 virtual-ip # Set the priority of LB A in the VRRP group to 110. [LB A-Ten-GigabitEthernet0/0.2] vrrp vrid 1 priority 110 # Configure the authentication mode of the VRRP group as simple and authentication key as hello. [LB A-Ten-GigabitEthernet0/0.2] vrrp vrid 1 authentication-mode simple hello # Configure the master to send VRRP packets every five seconds. [LB A-Ten-GigabitEthernet0/0.2] vrrp vrid 1 timer advertise 5 # Set LB A to work in preemptive mode. The preemption delay is five seconds. [LB A-Ten-GigabitEthernet0/0.2] vrrp vrid 1 preempt-mode timer delay 5 # Set the interface to be tracked. [LB A-Ten-GigabitEthernet0/0.2] vrrp vrid 1 track interface Ten-GigabitEthernet 0/0.1 reduced Configure LB B <LB B> system-view [LB B] interface Ten-GigabitEthernet 0/0.2 [LB B-Ten-GigabitEthernet0/0.2] ip address # Create VRRP group 1 and configure its virtual IP address as [LB B-Ten-GigabitEthernet0/0.2] vrrp vrid 1 virtual-ip # Configure the authentication mode of the VRRP group as simple and authentication key as hello. [LB B-Ten-GigabitEthernet0/0.2] vrrp vrid 1 authentication-mode simple hello # Configure the master to send VRRP packets every five seconds. 34

39 [LB B-Ten-GigabitEthernet0/0.2] vrrp vrid 1 timer advertise 5 # Set LB B to work in preemptive mode. The preemption delay is five seconds. [LB B-Ten-GigabitEthernet0/0.2] vrrp vrid 1 preempt-mode timer delay 5 4. Verify the configuration After the configuration, Host B can be pinged through on Host A. You can use the display vrrp verbose command to verify the configuration. # Display detailed information of VRRP group 1 on LB A. [LB A-Ten-GigabitEthernet0/0.2] display vrrp verbose IPv4 Standby Information: Run Mode : Standard Run Method : Virtual MAC Total number of virtual routers : 1 Interface Ten-GigabitEthernet0/0.2 VRID : 1 Adver Timer : 5 Admin Status : Up State : Master Config Pri : 110 Running Pri : 110 Preempt Mode : Yes Delay Time : 5 Auth Type : Simple Key : hello Virtual IP : Virtual MAC : e Master IP : VRRP Track Information: Track Interface: XGE0/0.1 State : Up Pri Reduced : 30 # Display detailed information of VRRP group 1 on LB B. [LB B-Ten-GigabitEthernet0/0.2] display vrrp verbose IPv4 Standby Information: Run Mode : Standard Run Method : Virtual MAC Total number of virtual routers : 1 Interface Ten-GigabitEthernet0/0.2 VRID : 1 Adver Timer : 5 Admin Status : Up State : Backup Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time : 5 Auth Type : Simple Key : hello Virtual IP : Master IP : The output shows that in VRRP group 1 LB A is the master, LB B is the backup and packets sent from Host A to host B are forwarded by LB A. If interface Ten-GigabitEthernet 0/0.1 through which LB A connects to the Internet is not available, you can still successfully ping Host B on Host A. # If interface Ten-GigabitEthernet 0/0.1 on LB A is not available, use the display vrrp verbose command to view the detailed information of the VRRP group 1 on LB A. [LB A-Ten-GigabitEthernet0/0.2] display vrrp verbose IPv4 Standby Information: Run Mode : Standard 35

40 Run Method : Virtual MAC Total number of virtual routers : 1 Interface Ten-GigabitEthernet0/0.2 VRID : 1 Adver Timer : 5 Admin Status : Up State : Backup Config Pri : 110 Running Pri : 80 Preempt Mode : Yes Delay Time : 5 Auth Type : Simple Key : hello Virtual IP : Master IP : VRRP Track Information: Track Interface: XGE0/0.1 State : Down Pri Reduced : 30 # If interface Ten-GigabitEthernet 0/0.1 on LB A is not available, use the display vrrp verbose command to view the detailed information of the VRRP group 1 on LB B. [LB B-Ten-GigabitEthernet0/0.2] display vrrp verbose IPv4 Standby Information: Run Mode : Standard Run Method : Virtual MAC Total number of virtual routers : 1 Interface Ten-GigabitEthernet0/0.2 VRID : 1 Adver Timer : 5 Admin Status : Up State : Master Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time : 5 Auth Type : Simple Key : hello Virtual IP : Virtual MAC : e Master IP : The output shows that if interface Ten-GigabitEthernet 0/0.1 on LB A is not available, the priority of LB A is reduced to 80 and it becomes the backup. LB B becomes the master and packets sent from Host A to Host B are forwarded by LB B. Multiple VRRP groups configuration example 1. Network requirements In the segment /24, some hosts use /24 as their default gateway and some hosts use /24 as their default gateway. Load sharing and mutual backup between default gateways can be implemented by using VRRP groups. 36

41 Figure 24 Network diagram for multiple VRRP groups configuration Virtual IP address 2: /24 Virtual IP address 1: /24 Gateway: /24 Host A XGE0/ /24 Gateway: /24 LB A Internet Host B XGE0/ /24 Gateway: /24 LB B Host C 2. Configure LB A <LB A> system-view [LB A] interface Ten-GigabitEthernet 0/0.1 [LB A-Ten-GigabitEthernet0/0.1] ip address # Create VRRP group 1 and configure its virtual IP address as [LB A-Ten-GigabitEthernet0/0.1] vrrp vrid 1 virtual-ip # Set the priority of LB A in VRRP group 1 to 110. [LB A-Ten-GigabitEthernet0/0.1] vrrp vrid 1 priority 110 # Create VRRP group 2 and configure its virtual IP address as [LB A-Ten-GigabitEthernet0/0.1] vrrp vrid 2 virtual-ip Configure LB B <LB B> system-view [LB B] interface Ten-GigabitEthernet 0/0.1 [LB B-Ten-GigabitEthernet0/0.1] ip address # Create VRRP group 1 and configure its virtual IP address as [LB B-Ten-GigabitEthernet0/0.1] vrrp vrid 1 virtual-ip # Create VRRP group 2 and configure its virtual IP address as [LB B-Ten-GigabitEthernet0/0.1] vrrp vrid 2 virtual-ip # Set the priority of LB B in VRRP group 2 to 110. [LB B-Ten-GigabitEthernet0/0.1] vrrp vrid 2 priority Verify the configuration You can use the display vrrp verbose command to verify the configuration. # Display detailed information of the VRRP group on LB A. [LB A-Ten-GigabitEthernet0/0.1] display vrrp verbose IPv4 Standby Information: Run Mode : Standard Run Method : Virtual MAC 37

42 Total number of virtual routers : 2 Interface Ten-GigabitEthernet0/0.1 VRID : 1 Adver Timer : 1 Admin Status : Up State : Master Config Pri : 110 Running Pri : 110 Preempt Mode : Yes Delay Time : 0 Auth Type : None Virtual IP : Virtual MAC : e Master IP : Interface Ten-GigabitEthernet0/0.1 VRID : 2 Adver Timer : 1 Admin Status : Up State : Backup Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time : 0 Auth Type : None Virtual IP : Master IP : # Display detailed information of the VRRP group on LB B. [LB B-Ten-GigabitEthernet0/0.1] display vrrp verbose IPv4 Standby Information: Run Mode : Standard Run Method : Virtual MAC Total number of virtual routers : 2 Interface Ten-GigabitEthernet0/0.1 VRID : 1 Adver Timer : 1 Admin Status : Up State : Backup Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time : 0 Auth Type : None Virtual IP : Master IP : Interface Ten-GigabitEthernet0/0.1 VRID : 2 Adver Timer : 1 Admin Status : Up State : Master Config Pri : 110 Running Pri : 110 Preempt Mode : Yes Delay Time : 0 Auth Type : None Virtual IP : Virtual MAC : e Master IP : The output shows that in VRRP group 1 LB A is the master, LB B is the backup and the host with the default gateway of /24 accesses the Internet through LB A; in VRRP group 2 LB A is the backup, LB B is the master and the host with the default gateway of /24 accesses the Internet through LB B. VRRP load balancing mode configuration example 1. Network requirements 38

43 LB A, LB B, and Router C belong to VRRP group 1 with the virtual IP address of /24. Hosts on network segment /24 use /24 as their default gateway. Use the VRRP group to ensure that when a gateway (LB A, LB B, or LB C) fails, the hosts on the LAN can access the external network through another gateway. VRRP group 1 works in the load balancing mode to make good use of network resources. Figure 25 Network diagram for VRRP load balancing mode 2. Configure LB A # Configure VRRP to work in the load balancing mode. <LB A> system-view [LB A] vrrp mode load-balance # Create VRRP group 1 and configure its virtual IP address as [LB A] interface Ten-GigabitEthernet 0/0.1 [LB A-Ten-GigabitEthernet0/0.1] ip address [LB A-Ten-GigabitEthernet0/0.1] vrrp vrid 1 virtual-ip # Set the priority of LB A in VRRP group 1 to 120. [LB A-Ten-GigabitEthernet0/0.1] vrrp vrid 1 priority 120 # Set LB A to work in preemptive mode. The preemption delay is five seconds. [LB A-Ten-GigabitEthernet0/0.1] vrrp vrid 1 preempt-mode timer delay 5 3. Configure LB B # Configure VRRP to work in load balancing mode. <LB B> system-view [LB B] vrrp mode load-balance # Create VRRP group 1 and configure its virtual IP address as [LB B] interface Ten-GigabitEthernet 0/0.1 39

44 [LB B-Ten-GigabitEthernet0/0.1] ip address [LB B-Ten-GigabitEthernet0/0.1] vrrp vrid 1 virtual-ip # Set the priority of LB B in VRRP group 1 to 110. [LB B-Ten-GigabitEthernet0/0.1] vrrp vrid 1 priority 110 # Set LB B to work in preemptive mode. The preemption delay is five seconds. [LB B-Ten-GigabitEthernet0/0.1] vrrp vrid 1 preempt-mode timer delay 5 4. Configure LB C # Configure VRRP to work in the load balancing mode. <LBC> system-view [LBC] vrrp mode load-balance # Create VRRP group 1 and configure its virtual IP address as [LBC] interface Ten-GigabitEthernet 0/0.1 [LBC-Ten-GigabitEthernet0/0.1] ip address [LBC-Ten-GigabitEthernet0/0.1] vrrp vrid 1 virtual-ip # Set LB C to work in the preemptive mode. The preemption delay is five seconds. [LBC-Ten-GigabitEthernet0/0.1] vrrp vrid 1 preempt-mode timer delay 5 5. Verify the configuration After the configuration, Host A can ping the external network. You can use the display vrrp verbose command to verify the configuration. # Display detailed information of VRRP group 1 on LB A. [LB A-Ten-GigabitEthernet0/0.1] display vrrp verbose IPv4 Standby Information: Run Mode : Load Balance Run Method : Virtual MAC Total number of virtual routers : 1 Interface Ten-GigabitEthernet0/0.1 VRID : 1 Adver Timer : 1 Admin Status : Up State : Master Config Pri : 120 Running Pri : 120 Preempt Mode : Yes Delay Time : 5 Auth Type : None Virtual IP : Master IP : Forwarder Information: 3 Forwarders 1 Active Config Weight : 255 Running Weight : 255 Forwarder 01 State : Active Virtual MAC : 000f-e2ff-0011 (Owner) Owner ID : e Priority : 255 Active : local Forwarder 02 State : Listening Virtual MAC : 000f-e2ff-0012 (Learnt) 40

45 Owner ID : e Priority : 127 Active : Forwarder 03 State : Listening Virtual MAC : 000f-e2ff-0013 (Learnt) Owner ID : e Priority : 127 Active : # Display detailed information of VRRP group 1 on LB B. [LB B-Ten-GigabitEthernet0/0.1] display vrrp verbose IPv4 Standby Information: Run Mode : Load Balance Run Method : Virtual MAC Total number of virtual routers : 1 Interface Ten-GigabitEthernet0/0.1 VRID : 1 Adver Timer : 1 Admin Status : Up State : Backup Config Pri : 110 Running Pri : 110 Preempt Mode : Yes Delay Time : 5 Auth Type : None Virtual IP : Master IP : Forwarder Information: 3 Forwarders 1 Active Config Weight : 255 Running Weight : 255 Forwarder 01 State : Listening Virtual MAC : 000f-e2ff-0011 (Learnt) Owner ID : e Priority : 127 Active : Forwarder 02 State : Active Virtual MAC : 000f-e2ff-0012 (Owner) Owner ID : e Priority : 255 Active : local Forwarder 03 State : Listening Virtual MAC : 000f-e2ff-0013 (Learnt) Owner ID : e Priority : 127 Active : # Display detailed information of VRRP group 1 on LB C. [LBC-Ten-GigabitEthernet0/0.1] display vrrp verbose IPv4 Standby Information: Run Mode : Load Balance 41

46 Run Method : Virtual MAC Total number of virtual routers : 1 Interface Ten-GigabitEthernet0/0.1 VRID : 1 Adver Timer : 1 Admin Status : Up State : Backup Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time : 5 Auth Type : None Virtual IP : Master IP : Forwarder Information: 3 Forwarders 1 Active Config Weight : 255 Running Weight : 255 Forwarder 01 State : Listening Virtual MAC : 000f-e2ff-0011 (Learnt) Owner ID : e Priority : 127 Active : Forwarder 02 State : Listening Virtual MAC : 000f-e2ff-0012 (Learnt) Owner ID : e Priority : 127 Active : Forwarder 03 State : Active Virtual MAC : 000f-e2ff-0013 (Owner) Owner ID : e Priority : 255 Active : local The output shows that in VRRP group 1, LB A is the master and LB B and LB C are the backups. On each of the three LBs, there are one AVF and two LVFs acting as the backups. # If LB A fails, use the display vrrp verbose command to display the detailed information of VRRP group 1 on LB C. [LBC-Ten-GigabitEthernet0/0.1] display vrrp verbose IPv4 Standby Information: Run Mode : Load Balance Run Method : Virtual MAC Total number of virtual routers : 1 Interface Ten-GigabitEthernet0/0.1 VRID : 1 Adver Timer : 1 Admin Status : Up State : Backup Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time : 5 Auth Type : None Virtual IP : Master IP :

47 Forwarder Information: 3 Forwarders 2 Active Config Weight : 255 Running Weight : 255 Forwarder 01 State : Active Virtual MAC : 000f-e2ff-0011 (Take Over) Owner ID : e Priority : 85 Active : local Redirect Time : 577 secs Time-out Time : 1777 secs Forwarder 02 State : Listening Virtual MAC : 000f-e2ff-0012 (Learnt) Owner ID : e Priority : 85 Active : Forwarder 03 State : Active Virtual MAC : 000f-e2ff-0013 (Owner) Owner ID : e Priority : 255 Active : local The output shows that if LB A fails, LB B becomes the master, LB C becomes the AVF among the VFs corresponding to the virtual MAC address 000f-e2ff-0011, and packets sent from Host A to the external network are forwarded by LB C. Troubleshooting VRRP Symptom 1 The screen displays error prompts frequently. Analysis: This error is probably caused by the following: Inconsistent configuration of the LB modules in the VRRP group. A LB module is attempting to send illegitimate VRRP packets. Solution: In the first case, modify the configuration. In the latter case, you have to resort to non-technical measures. Symptom 2 Multiple masters are present in the same VRRP group. Analysis: Multiple masters coexist for a short period: This is normal and requires no manual intervention. 43

48 Multiple masters coexist for a long period: This is because LB modules in the VRRP group cannot receive VRRP packets, or the received VRRP packets are illegal. Solution: Ping between these masters, and do the following: If the ping fails, check network connectivity. If the ping succeeds, check that their configurations are consistent in terms of number of virtual IP addresses, virtual IP addresses, advertisement interval, and authentication. Symptom 3 Frequent VRRP state transition. Analysis: The VRRP advertisement interval is set too short. Solution: Increase the interval to sent VRRP advertisement or introduce a preemption delay. 44

49 Stateful failover configuration NOTE: The LB module supports configuring stateful failover only in the web interface. Overview Introduction to stateful failover Some customers require the key entries or access points of their networks, such as the Internet access point of an enterprise or a database server of a bank, to be highly reliable to ensure continuous data transmission. Deploying only one device (even with high reliability) in such a network risks a single point of failure and therefore cannot meet the requirement, as shown in Figure 26. Figure 26 Network with one device deployed The stateful failover feature is introduced to meet the requirement. In Figure 27, two devices installed with LB modules (supporting NAT, ALG, blacklist, DHCP server, and load balancing) that are enabled with stateful failover are deployed in the network. On each LB module, you need to specify an Ethernet interface as the failover interface. The failover interfaces form a failover link, through which the two devices exchange state negotiation messages periodically. After the two devices go into the synchronization state, they back up the services of each other to ensure that the services on them are consistent. If one device fails, the other device can take over the services using VRRP or dynamic routing protocols (such as OSPF). Because the other device has already backed up the services, service traffic can pass through the other device, avoiding service interruption. 45

50 NOTE: The failover link transmits only state negotiation messages and backup data. Stateful failover can be configured only on management Ethernet interfaces. Figure 27 Network diagram for stateful failover Internet XGE0/0.1 XGE0/0.1 LB A GE0/2 GE0/2 Backup Link LB B XGE0/0.2 XGE0/0.2 Intranet 内网 Host A Host B Introduction to stateful failover states The stateful failover states include: Silence: Indicates that the device is just started and waiting for the stable running of the system, or the state between synchronization and independence. Independence: Indicates that the silence timer expires, but no failover link to any other device is established. Synchronization: Indicates that state negotiation with another device is complete and ready for data backup. The following figure shows state relations. Figure 28 Stateful failover state diagram The device is started Silence The silence timer expires State negotiation fails Independence State negotiation succeeds Synchronization 46

51 Configuring stateful failover Select High Availability > Stateful Failover from the navigation tree to enter the stateful failover configuration page, as shown in Figure 29. The upper part of the page allows you to configure stateful failover parameters. The lower part of the page displays the current stateful failover configuration and the failover interface information. Figure 29 Stateful failover configuration page Table 8 Stateful failover configuration items Item Enable Stateful Failover Backup Type Description Enable/disable the stateful failover feature. Select whether to support asymmetric path. Unsupport Asymmetric Path. When two devices operate properly, traffic passes through one device to the internal network and goes out through the same device. The devices work in the master/backup mode, that is, one device processes services while the other device serves as backup. Support Asymmetric Path. When two devices operate properly, traffic can pass through one device to the internal network and go out through the other device. That is, the session passes through one of the two devices randomly when leaving the internal network, thus to achieve load sharing. The two devices work in the load sharing mode and serve as backup for each other. Set failover interfaces and specify the working mode (electrical or optical interface mode) for the currently effective failover interfaces. Backup Interface Click Modify Backup Interface to enter the Backup Interface Configuration page, and then you can: Select one or more interfaces from the Backup Interface(s) list, and then click the << button to add the selected interfaces to the Backup Interface(s) list. Select one or more interfaces from the Backup Interface(s) list, and then click the >> button to remove the selected interfaces from the list. Modify the working mode of any failover interface in the list at the lower part. All currently effective failover interfaces are displayed in the list. If no failover interface is specified, the list is not displayed. After completing the settings, click Apply to return to the stateful failover configuration page. 47