FHRP (First Hop Redundancy Protocol) is a family of protocols designed to create redundancy for the default gateway. The common concept for these protocols is to combine multiple routers into a single virtual router with a shared IP address. This IP address will be assigned to hosts as the default gateway address. A free implementation of this idea is the VRRP (Virtual Router Redundancy Protocol). In this article, we will cover the basics of the VRRP protocol.
VRRP routers are grouped into a single virtual router. All routers in the group share a common virtual IP (VIP) address and a common group number or VRID (Virtual Router Identifier). One router can belong to multiple groups, each having its own unique pair of VIP/VRID.
In the case of Cisco, the virtual router is configured on the desired interface with the command:
R1(config-if)# vrrp ipAll routers are divided into two types: VRRP Master and VRRP Backup.
VRRP Master is the router that handles packet forwarding for this virtual group.
VRRP Backup is the router that waits for packets from the Master. If packets from the Master stop arriving, the Backup attempts to become the Master.
A router becomes the Master if it has the highest priority. The Master continuously sends messages to the broadcast address 224.0.0.18 to inform Backup routers that it is operational. The Master sends messages according to the Adver Timer, which is set to 1 second by default.
The MAC address of the sender uses the group address 00:00:5E:00:01:xx, where xx is the VRID in hexadecimal format. In this example, the first group is used.
If Backup routers do not receive messages for three Adver Timers (Master Down Timer), the new Master becomes the router with the highest priority, or the router with the highest IP. In this case, a Backup router with a higher priority will take over the role of Master from a lower-priority one. However, when the Backup's preempt mode is disabled, the Backup will not take over the Master role.
R1(config-if)# no vrrp preemptIf the VRRP router is the owner of the VIP address, it always takes over the Master role.
The VRRP priority is set to values from 1 to 254. The value 0 is reserved for cases when the Master needs to be removed. is responsible for routing. The value 255 is assigned to the VIP owner router. The default priority is 100 but can be set administratively:
R1(config-if)#vrrp priorityHere we can see the router's priority when it is set administratively:
And here is a case where the router is the owner of the VIP:
A VRRP router can have three states: Initialize, Backup, Master. These states are changed sequentially by the router.
In the Initialize state, the router is waiting to start working. If this router is the owner of the VIP address (priority equal to 255), it sends messages indicating it becomes the Master. It also sends , where the source MAC address equals the address of the virtual router. Then it transitions to the Master state. If the router is not the owner of the VIP, it moves to the Backup state.
In the Backup state, the router waits for packets from the Master. The router in this state does not respond to ARP requests from the VIP address. It also does not accept packets that have the virtual router's MAC address as the destination.
If the Backup does not receive messages from the Master during the Master Down Timer, it sends a VRRP message indicating it intends to become the Master. Then it sends a broadcast VRRP message, where the source MAC address equals that of the virtual router. In this message, the router specifies its priority.
In the Master state, the router processes packets addressed to the virtual router. It also responds to ARP requests for the VIP. The Master sends VRRP messages every Adver Timer to confirm that it is operational.
*May 13 19:52:18.531: %VRRP-6-STATECHANGE: Et1/0 Grp 1 state Init -> Backup
*May 13 19:52:21.751: %VRRP-6-STATECHANGE: Et1/0 Grp 1 state Backup -> MasterVRRP also allows load balancing among multiple routers. For this, two VRRP groups are created on one interface. One group is assigned a higher priority than the other. Meanwhile, the second router's priority is set oppositely. That is, if one router's priority for the first group is 100, and for the second group is 200, then on the other router, the priority for the first group will be 200, and for the second, 100.
As stated earlier, each group must have its unique VIP. In the end, we have two IP addresses served by two routers, each of which can act as the default gateway.
Half of the computers are assigned one default gateway address, while the other half receives another. This way, half of the traffic will go through one router, and the other half will go through the other. In the event of one router failing, the second takes over the workload of both VIPs.
Thus, VRRP enables the establishment of redundancy for the default gateway, enhancing network reliability. Additionally, using multiple virtual routers allows for load balancing among the actual routers. The response time to a failure can be reduced by decreasing timers.
Source: habr.com
