Manual:Interface/VRRP: Difference between revisions

From MikroTik Wiki
Jump to navigation Jump to search
No edit summary
(35 intermediate revisions by 4 users not shown)
Line 1: Line 1:
<div class=manual>
{{Versions|v3, v4, v5}}


<h2>Summary</h2>


<p><b>Sub-menu level:</b> <code>/interface vrrp</code></p>
==Summary==
<p>
<br />


This chapter describes the Virtual Router Redundancy Protocol (VRRP) support in RouterOS.<br />
<p id="shbox"><b>Sub-menu level:</b> <code>/interface vrrp</code><br />
Mostly on larger LANs dynamic routing protocols (([[OSPF]] or [[RIP]])) are used, however there are number of factors that may make undesirable to use dynamic routing protocols. One alternative is to use static routing, but if statically configured first hop fails, then host will not be able to communicate with other hosts.<br />
<b>Standards:</b> <code>RFC 5798, RFC 3768 </code>
Virtual Router Redundancy Protocol (VRRP) provides a solution by combining number of routers into logical group called <i>Virtual Router</i> (VR).  VRRP implementation in RouterOS is compliant to [http://www.faqs.org/rfcs/rfc2338.html RFC2338] and any modern routers support this protocol. <br />
</p>
</p>


<h2>Virtual Router Redundancy Protocol</h2>
 
This chapter describes the Virtual Router Redundancy Protocol (VRRP) support in RouterOS.
 
Mostly on larger LANs dynamic routing protocols ([[M:Routing/OSPF | OSPF]] or [[M:Routing/RIP | RIP]]) are used, however there are number of factors that may make undesirable to use dynamic routing protocols. One alternative is to use static routing, but if statically configured first hop fails, then host will not be able to communicate with other hosts.
 
In IPv6 networks, hosts learn about routers by receiving Router Advertisements used by [[M:IPv6/ND | Neighbor Discovery (ND)]] protocol. ND already has built in mechanism to determine unreachable routers. However it can take up to 38seconds to detect unreachable router. It is possible to change parameters and make detection faster, but it will increase overhead of ND traffic especially if there are a lot of hosts. VRRP allows to detect unreachable router within 3seconds without additional traffic overhead.
 
Virtual Router Redundancy Protocol (VRRP) provides a solution by combining number of routers into logical group called ''Virtual Router'' (VR).  VRRP implementation in RouterOS is compliant to VRRPv2 RFC 3768 and VRRPv3 RFC 5798.
 
{{ Note | According to RFC authentication is deprecated for VRRP v3}}
 
==Protocol Overview==
[[Image:vrrp-simple.png|thumb|Simple VRRP example |400px|Simple VRRP example ]]
[[Image:vrrp-simple.png|thumb|Simple VRRP example |400px|Simple VRRP example ]]
<p>
The purpose of the VRRP is to communicate to all VRRP routers associated with the Virtual Router ID and support router redundancy through a prioritized election process among them.<br />
Each VRs node have configured virtual IP address and virtual MAC address. On one of nodes virtual IP is the same as real IP, this node is called <b>Owner</b>. By default owner has the highest priority (255), other routers has lower priorities and are configured to operate as <b>Backup</b> in case the Owner router is unreachable.<br />
Normally Owner operates as a Master router of VR. When Owner becomes unavailable, election process occur and Backup router becomes current Master.<br/>
<b>All VRRP routers belonging to the same VR must be configured with the same advertisement interval. If interval does not match router will discard received advertisement packet.</b><br />
VRRP packets are encapsulated in IP packets and are sent to the IPv4 multicast address. IP multicast address assigned by the IANA for VRRP is <i>224.0.0.18</i> and VRRP protocol number is <i>/112</i><br/>
Router will drop any VRRP packet if TTL is not 255. That protects against VRRP packets being injected from another remote network.  This limits most vulnerabilities to local attacks.
</p>


<h3>Virtual Router (VR)</h3>
The purpose of the VRRP is to communicate to all VRRP routers associated with the Virtual Router ID and support router redundancy through a prioritized election process among them.
<p>
 
A Virtual Router (VR) consists of one Ovner router and one or more backup routers belonging to the same network. <br />
All messaging is done by IPv4 or IPv6 multicast packets using protocol 112 (VRRP).  Destination address of IPv4 packet is ''224.0.0.18'' and for IPv6 it is ''FF02:0:0:0:0:0:0:12''. Source address of the packet is always the primary IP address of an interface from which the packet is being sent. In IPv6 networks source address is link-local address of an interface.
 
These packets are always sent with TTL=255 and are not forwarded by the router. If for any reason router receives a packet with lower TTL, packet is discarded.
 
Each VR node has a single assigned MAC address. This MAC address is used as a source for all periodic messages sent by Master.
 
Virtual Router is defined by VRID and mapped set of IPv4 or IPv6 addresses. Master router is said to be the '''owner''' of mapped IPv4/IPv6 addresses. There are no limits to use the same VRID for IPv4 and IPv6, however these will be two different Virtual Routers.
 
Only Master router is sending periodic Advertisement messages to minimize the traffic. Backup will try to preempt the Master only if it has the higher priority and preemption is not prohibited.
 
'''All VRRP routers belonging to the same VR must be configured with the same advertisement interval. If interval does not match router will discard received advertisement packet.'''
 
{{ Warning | In case VRRP is used with Reverse Path Filtering, then it is recommended that <code>rp-filter</code> is set to <code>loose</code>, otherwise the VRRP interface might not be reachable. }}
 
===Virtual Router (VR)===
 
A Virtual Router (VR) consists of one Owner router and one or more backup routers belonging to the same network.  
 
VR includes:
VR includes:
<ul>
<ul class="bullets">
:<li>VRID configured on each VRRP router
<li>VRID configured on each VRRP router
:<li>the same virtual IP on each router
<li>the same virtual IP on each router
:<li>Owner and Backup configured on each router. On a given VR there can be only one Owner.
<li>Owner and Backup configured on each router. On a given VR there can be only one Owner.
</ul>
</ul>
</p>


<h3>Virtual MAC address</h3>
<p>
VRRP automatically assigns MAC address to VRRP interface based on standard MAC prefix for VRRP packets and VRID number. First five octets are 00:00:5E:00:01 and last octet is configured VRID. For example, Virtual Routers VRID is 49, then virtual MAC address will be <i>00:00:5E:00:01:31</i>.<br />
Virtual mac address can not be manually set or edited.
</p>
<h3>Virtual IP address</h3>
<p>
Virtual IP associated with VR must be identical and set on all VR nodes. On Owner router Virtual IP must be the same as real IP. For example on Owner router real IP and virtual IP is 192.168.1.1, on Backup router virtual IP is 192.168.1.1, but real IP is 192.168.1.2. All virtual and real addresses should be from the same network. <br/>
</p>


<h4>Multiple Virtual IPs</h4>
===Virtual MAC address===
<p>
 
If the Master of VR is associated with multiple IP addresses, then Backup routers belonging to the same VR must also be associated with the same set of virtual IP addresses. If virtual address on the Master is not also on Backup a misconfiguration exists and VRRP advertisement packets will be discarded.
VRRP automatically assigns MAC address to VRRP interface based on standard MAC prefix for VRRP packets and VRID number. First five octets are 00:00:5E:00:01 and last octet is configured VRID. For example, Virtual Routers VRID is 49, then virtual MAC address will be <i>00:00:5E:00:01:31</i>.
</p>
 
{{Note | Virtual mac address can not be manually set or edited.}}
 
 
===Owner===
[[Image:vrrp-no-owner.png|thumb|VRRP without Owner|400px|VRRP without Owner ]]


<h3>ARP</h3>
<p>
The Master for a given VR responds to ARP requests with the VR's assigned MAC address. Virtual MAC address is also used as the source MAC address for advertisement packets sent by Master. To ARP requests for non-virtual IP addresses router responds with the system MAC address. Backup routers are not responding to ARP requests for Virtual IPs.
</p>
<h3>Owner</h3>
<p>
An Owner router for a VR is default Master router and operates as the Owner for all subnets included in the VR. As mentioned before priority on an owner router must be the highest value (255). In example network <b>R1</b> is an Owner. It's priority is set to 255 and virtual IP is the same as real IP (owns the virtual IP address).
An Owner router for a VR is default Master router and operates as the Owner for all subnets included in the VR. As mentioned before priority on an owner router must be the highest value (255). In example network <b>R1</b> is an Owner. It's priority is set to 255 and virtual IP is the same as real IP (owns the virtual IP address).
</p>
 
<h3>Master</h3>
All Virtual Router members can be configured so that virtual IP is not the same as physical IP. Such Virtual address can be called floating or pure virtual IP address.
<p>
 
Advantage of this setup is flexibility given to the administrator. Since the virtual IP address is not the real address of any one of the participant routers, the administrator can change these physical routers or their addresses without any need to reconfigure the virtual router itself.
 
{{Note | RouterOS can not be configured as Owner. Pure virtual IP configuration is the only valid configuration unless non-RouterOS device is set as owner. }}
 
 
===Master===
 
Master router in a VR operates as the physical gateway for the network for which it is configured. Selection of the Master is controlled by priority value. [[#Master_state|Master state]] describes behavior of Master router. In example network <b>R1</b> is the Master router. When R1 is no longer available R2 becomes master.
Master router in a VR operates as the physical gateway for the network for which it is configured. Selection of the Master is controlled by priority value. [[#Master_state|Master state]] describes behavior of Master router. In example network <b>R1</b> is the Master router. When R1 is no longer available R2 becomes master.
</p>
<h3>Backup</h3>
<p>
VR must contain at least one Backup router. Backup router must be configured with the same [[#Virtual_IP_address|virtual IP]] as Master for that VR. Default priority for Backup routers is 100. When current master router is no longer available, backup router with highest priority will become current master. Every time when router with higher higher priority becomes available it is switched to master. Sometimes this behavior is not necessary. To override it [[#Property_reference|preemption mode]] should be disabled.
</p>


<h2>VRRP state machine</h2>
===Backup===
 
VR must contain at least one Backup router. Backup router must be configured with the same [[#Virtual_IP_address|virtual IP]] as Master for that VR. Default priority for Backup routers is 100. When current master router is no longer available, backup router with highest priority will become current master. Every time when router with higher priority becomes available it is switched to master. Sometimes this behavior is not necessary. To override it [[#Property_reference|preemption mode]] should be disabled.
 
 
===Virtual Address===
 
Virtual IP associated with VR must be identical and set on all VR nodes. On Owner router Virtual IP must be the same as real IP. For example on Owner router real IP and virtual IP is 192.168.1.1, on Backup router virtual IP is 192.168.1.1, but real IP is 192.168.1.2. All virtual and real addresses should be from the same network.
 
If the Master of VR is associated with multiple IP addresses, then Backup routers belonging to the same VR must also be associated with the same set of virtual IP addresses. If virtual address on the Master is not also on Backup a misconfiguration exists and VRRP advertisement packets will be discarded.
 
{{Note|It is not recommended to set up Mikrotik router as an Owner router. VRRP address and real IP address should not be the same.}}
 
 
 
In IPv6 networks first address is always link-local address associated to VR. If multiple IPv6 addresses are configured, then they are added in advertisement packet after the link-local address.
 
 
 
===IPv4 ARP===
 
The Master for a given VR responds to ARP requests with the VR's assigned MAC address. Virtual MAC address is also used as the source MAC address for advertisement packets sent by the Master. To ARP requests for non-virtual IP addresses router responds with the system MAC address. Backup routers are not responding to ARP requests for Virtual IPs.
 
===IPv6 ND===
 
As you already know there are no ARP in IPv6 networks, routers are discovered by Neighbor Discovery protocol.
When router becomes the Master, unsolicited ND Neighbor Advertisement with the Router Flag is sent for each IPv6 address associated with the virtual router.
 
==VRRP state machine==


[[Image:Vrrp-State.png|thumb|VRRP state transition flow|400px|VRRP state transition flow]]
[[Image:Vrrp-State.png|thumb|VRRP state transition flow|400px|VRRP state transition flow]]
<p>
 
As you can see from diagram, each VRRP node can be in one of three states:<ul>
As you can see from diagram, each VRRP node can be in one of three states:
:<li> Init state
<ul class="bullets">
:<li> Backup state
<li> Init state
:<li> Master state
<li> Backup state
<li> Master state
</ul>
</ul>
</p>




<h3>Init state</h3>
===Init state===
<p>
 
The purpose of this state is to wait for a Startup event. When this event is received, then following actions are taken:
The purpose of this state is to wait for a Startup event. When this event is received, then following actions are taken:
<ul>
:<li>if priority is 255, then send advertisement packet, broadcast ARP requests and transit to [[#Master_state|MASTER state]];
:<li>else transit to [[#Backup_state|BACKUP state]].
</ul>
</p>


<h3>Backup state</h3>
* if priority is 255,
<p>
* * for IPv4 send advertisement packet and broadcast ARP requests
When in backup state, node is not responding to ARP requests and is not forwarding traffic for the IP associated with the VR.<br/>
* * for IPv6 send an unsolicited ND Neighbor Advertisement for each IPv6 address associated with the virtual router and set target address to link-local address associated with VR.
Routers main task is to receive advertisement packets and check if master node is available. <br />
* * transit to [[#Master_state|MASTER state]];
Backup router will send out advertisement packets, broadcast ARP requests and transit itself to master state in two cases:
* else transit to [[#Backup_state|BACKUP state]].
<ul>
 
:<li>If priority in advertisement packet is 0;
 
:<li>When Preemption_Mode is set to no, or Priority in the ADVERTISEMENT is greater than or equal to the local Priority
===Backup state===
</ul>
 
In other cases advertisement packets will be discarded.<br />
When in backup state,
When shutdown event is received, transit to Init state.<br/>
* in IPv4 networks, node is not responding to ARP requests and is not forwarding traffic for the IP associated with the VR.
<b>Note: Preemption mode is ignored if Owner router becomes available</b>
* in IPv6 networks, node is not responding to ND Neighbor Solicitation messages and is not sending ND Router Advertisement messages for VR associated IPv6 addresses.
</p>
 
Routers main task is to receive advertisement packets and check if master node is available.  
 
Backup router will transit itself to master state in two cases:
* If priority in advertisement packet is 0;
* When Preemption_Mode is set to no, or Priority in the ADVERTISEMENT is greater than or equal to the local Priority
 
After transition to Master state node is:
* in IPv4 broadcasts gratuitous ARP request;
* in IPv6 sends an unsolicited ND Neighbor Advertisement for every associated IPv6 address.
 
In other cases advertisement packets will be discarded.
When shutdown event is received, transit to Init state.
{{Note | Preemption mode is ignored if Owner router becomes available.}}
 
 
===Master state===
 
When MASTER state is set, node functions as a forwarding router for IPv4/IPv6 addresses associated with the VR.
 
In IPv4 networks Master node responds to ARP requests for the IPv4 address associated with the VR.
In IPv6 networks Master node:
* responds to ND Neighbor Solicitation message for the associated IPv6 address;
* sends ND Router Advertisements for the associated IPv6 addresses.
 
 
If advertisement packet is received by master node:
* If priority is 0, send advertisement immediately;
* If priority in advertisement packet is greater than nodes priority then transit to [[#Backup_state|backup state]]
* If priority in advertisement packet is equal to nodes priority and primary IP Address of the sender is greater than the local primary IP Address, then transit to [[#Backup_state|backup state]]
* Ignore advertisement in other cases


<h3>Master state</h3>
<p>
When MASTER state is set, VRRP node is responding to ARP requests and forwarding traffic for the IP addresses associated with the VR.<br />
Master router is sending advertisement packets within interval defined in VRRP configuration. <br />
If advertisement packet is received by master node:<ul>
:<li>If priority is 0, send advertisement immediately;
:<li>If priority in advertisement packet is greater than nodes priority then transit to [[#Backup_state|backup state]]
:<li>If priority in advertisement packet is equal to nodes priority and primary IP Address of the sender is greater than the local primary IP Address, then transit to [[#Backup_state|backup state]]
:<li>Ignore advertisement in other cases
</ul>
When shutdown event is received, send advertisement packet with priority=0 and transit to [[#Init_state|Init state]].
When shutdown event is received, send advertisement packet with priority=0 and transit to [[#Init_state|Init state]].
</p>


<h2>Configuring VRRP</h2>
==Configuring VRRP==
<p>
 
Setting up Virtual Router is quite easy, only two actions are required - create vrrp interface and set Virtual Routers IP address.<br/>
===IPv4===
Setting up Virtual Router is quite easy, only two actions are required - create vrrp interface and set Virtual Routers IP address.
 
For example, add vrrp to ether1 and set VRs address to 192.168.1.1
For example, add vrrp to ether1 and set VRs address to 192.168.1.1
<pre>
<pre>
/interface vrrp add interface=ether1
/interface vrrp add name=vrrp1 interface=ether1
/ip address add address=192.168.1.1/32 interface=vrrp1
/ip address add address=192.168.1.1/32 interface=vrrp1
</pre>
</pre>
Notice that only 'interface' parameter was specified when adding vrrp. It is the only parameter required to be set manually, [[#Property_reference|other parameters]] if not specified will be set to their defaults: <code>vrid=1, priority=100</code> and <code>authentication=none</code>.<br />
<b>Note that address on VRRP interface must have /32 netmask.</b><br/>
Before VRRP can operate correctly correct IP address is required on ether1. In this example it is <code>192.168.1.2/24 </code><br/>
[[VRRP-examples|VRRP Examples section]] contains several configuration examples.
</p>


<h2>Property reference</h2>
Notice that only 'interface' parameter was specified when adding vrrp. It is the only parameter required to be set manually, [[#Property_reference|other parameters]] if not specified will be set to their defaults: <code>vrid=1, priority=100</code> and <code>authentication=none</code>.
<h3>/interface vrrp</h3>
 
{{Note | address on VRRP interface must have /32 netmask if address configured on VRRP is from the same subnet as on router's  any other interface.}}
 
Before VRRP can operate correctly correct IP address is required on ether1. In this example it is <code>192.168.1.2/24 </code>
 
[[VRRP-examples|VRRP Examples section]] contains several configuration examples.
 
 
===IPv6===
 
To make VRRP work in IPv6 networks, several additional options must be enabled - v3 support is required and protocol type should be set to IPv6:
<pre>
/interface vrrp add name=vrrp1 interface=ether1 version=3 v3-protocol=ipv6
</pre>
 
Now when VRRP interface is set, we can add global address and enable ND advertisement:
<pre>
/ipv6 address add address=FEC0:0:0:FFFF::1/64 advertise=yes interface=vrrp1
</pre>
 
No additional address configuration is required as it is in IPv4 case. IPv6 uses link-local addresses to communicate between nodes.
 
==Property reference==
<p><b>Sub-menu:</b> <code>/interface vrrp</code></p>
<br />
 
{{Mr-arg-table-h
|prop=Property
|desc=Description
}}
 
{{Mr-arg-table
|arg=arp
|type=disabled {{!}} enabled {{!}} proxy-arp {{!}} reply-only
|default=enabled
|desc=ARP resolution protocol mode
}}
 
{{Mr-arg-table
|arg=authentication
|type=ah {{!}} none {{!}} simple
|default=none
|desc=Authentication method to use for VRRP advertisement packets.
* <var>none</var> - should be used only in low security networks (e.g., two VRRP nodes on LAN).
* <var>ah</var> - IP Authentication Header. This algorithm provides strong protection against configuration errors, replay attacks and packet corruption/modification. Recommended when there is limited control over the administration of nodes on a LAN.
* <var>simple</var> - uses clear text password. Protects against accidental misconfiguration of routers on local network.
 
}}
 
{{Mr-arg-table
|arg=interface
|type=string
|default=
|desc=Interface name on which VRRP instance will be running
}}
 
{{Mr-arg-table
|arg=interval
|type=time [10ms..4m15s]
|default=1s
|desc=VRRP update interval in seconds. Defines how often master sends advertisement packets.
}}
 
{{Mr-arg-table
|arg=mtu
|type=integer
|default=1500
|desc=Layer3 MTU size
}}
 
{{Mr-arg-table
|arg=name
|type=string
|default=
|desc=VRRP interface name
}}
 
{{Mr-arg-table
|arg=on-backup
|type=string
|default=
|desc=Script to execute when the node is switched to backup state
}}
 
{{Mr-arg-table
|arg=on-master
|type=string
|default=
|desc=Script to execute when the node is switched to master state
}}
 
{{Mr-arg-table
|arg=password
|type=string
|default=
|desc=Password required for authentication. Can be ignored if authentication is not used.
}}
 
{{Mr-arg-table
|arg=preemption-mode
|type=yes {{!}} no
|default=yes
|desc=Whether master node always has the priority. When set to 'no' backup node will not be elected to be a master until the current master fails, even if the backup node has higher priority than the current master. This setting is ignored if [[#Owner|Owner router]] becomes available
}}
 
{{Mr-arg-table
|arg=priority
|type=integer: 1..254
|default=100
|desc=Priority of VRRP node used in Master election algorithm. Higher number means higher priority. '255' is reserved to Router that owns VR IP and '0' is reserved for Master router to indicate that it is releasing responsibility.
}}
 
{{Mr-arg-table
|arg=v3-protocol
|type=ipv4 {{!}} ipv6
|default=ipv4
|desc=Protocol that will be used by VRRPv3. Valid only if '''version''' is 3
}}
 
{{Mr-arg-table
|arg=version
|type=integer [2, 3]
|default=3
|desc=Which VRRP version to use.
}}
 
{{Mr-arg-table-end
|arg=vrid
|type=integer: 1..255
|default=1
|desc=Virtual Router identifier. Each Virtual router must have unique id number
}}
 
 
There are two ways to add scripts to <var>on-backup</var> and <var>on-master</var>
* specify scripts name added to [[Scripting#Script_repository|script repository]]
* write [[Scripting|script]] directly by putting it in scopes '{ }'.


<p><var><b>interface</b></var> (<em>string</em>; Default: <b></b>) - interface name on which VRRP instance will be running run.</p>
<p><var><b>vrid</b></var> (<em>integer: 1..255</em>; Default: <b>1</b>) - Virtual Router identifier. Each Virtual router must have unique id number.</p>
<p><var><b>priority</b></var> (<em>integer: 1..254</em>; Default: <b>100</b>) - priority of VRRP node used in Master election algorithm. Higher number i higher priority. '255' is reserved to Router that owns VR IP and '0' is reserved for Master router to indicate that it is releasing responsibility.</p>
<p><var><b>interval</b></var> (<em>string</em>; Default: <b>1</b>) - VRRP update interval in seconds. Defines how often master sends advertisement packets.</p>
<p><var><b>preemption-mode</b></var> (<em>yes,no</em>; Default: <b>yes</b>) - whether master node always has the priority. When set to 'no' backup node will not be elected to be a master until the current master fail even if the backup node has higher priority than the current master. This setting is ignored if [[#Owner|Owner router]] becomes available</p>
<p><var><b>authentication</b></var> (<em>ah,none,simple</em>; Default: <b>none</b>) - authentication method to use for VRRP advertisement packets.
<table class="styled_table">
<tr>
  <td ><var>none</var></td>
  <td >should be used only in low security networks (e.g., two VRRP nodes on LAN).</td>
</tr>
<tr>
  <td ><var>ah</var></td>
  <td >IP Authentication Header. This algorithm provides strong protection against configuration errors, replay attacks, and and packet corruption/modification. Recommended when there is limited control over the administration of nodes on a LAN.</td>
</tr>
<tr>
  <td ><var>simple</var></td>
  <td >uses clear text password. Protects against accidental misconfiguration of routers on local network.</td>
</tr>
</table>
</p>
<p><var><b>password</b></var> (<em>string</em>; Default: <b></b>) - password required for authentication. Can be ignored if authentication is not used.</p>
<p><var><b>name</b></var> (<em>string</em>; Default: <b>"vrrp[num]"</b>) - VRRP interface name.</p>
<p><var><b>on-backup</b></var> (<em>string</em>; Default: <b></b>) - script to execute when the node switch to backup state.</p>
<p><var><b>on-master</b></var> (<em>string</em>; Default: <b></b>) - script to execute when the node switch to master state.</p>
<p>
There are two ways to add scripts to <var>on-backup</var> and <var>on-master</var>:<ul>
:<li>specify scripts name added to [[Script|script repository]]
:<li>write [[Scripting|script]] directly by putting it in scopes '{ }'.
</ul>
</p>


<h2>See more</h2>
==See more==


* [[VRRP-examples]]
* [[VRRP-examples]]


</div>




[[Category:Manual]]
{{Cont}}
[[Category:Unfinished]]
 
[[Category:Manual|V]]
[[Category:Interface|V]]

Revision as of 09:58, 27 August 2018

Version.png

Applies to RouterOS: v3, v4, v5


Summary

Sub-menu level: /interface vrrp
Standards: RFC 5798, RFC 3768


This chapter describes the Virtual Router Redundancy Protocol (VRRP) support in RouterOS.

Mostly on larger LANs dynamic routing protocols ( OSPF or RIP) are used, however there are number of factors that may make undesirable to use dynamic routing protocols. One alternative is to use static routing, but if statically configured first hop fails, then host will not be able to communicate with other hosts.

In IPv6 networks, hosts learn about routers by receiving Router Advertisements used by Neighbor Discovery (ND) protocol. ND already has built in mechanism to determine unreachable routers. However it can take up to 38seconds to detect unreachable router. It is possible to change parameters and make detection faster, but it will increase overhead of ND traffic especially if there are a lot of hosts. VRRP allows to detect unreachable router within 3seconds without additional traffic overhead.

Virtual Router Redundancy Protocol (VRRP) provides a solution by combining number of routers into logical group called Virtual Router (VR). VRRP implementation in RouterOS is compliant to VRRPv2 RFC 3768 and VRRPv3 RFC 5798.

Icon-note.png

Note: According to RFC authentication is deprecated for VRRP v3


Protocol Overview

Simple VRRP example

The purpose of the VRRP is to communicate to all VRRP routers associated with the Virtual Router ID and support router redundancy through a prioritized election process among them.

All messaging is done by IPv4 or IPv6 multicast packets using protocol 112 (VRRP). Destination address of IPv4 packet is 224.0.0.18 and for IPv6 it is FF02:0:0:0:0:0:0:12. Source address of the packet is always the primary IP address of an interface from which the packet is being sent. In IPv6 networks source address is link-local address of an interface.

These packets are always sent with TTL=255 and are not forwarded by the router. If for any reason router receives a packet with lower TTL, packet is discarded.

Each VR node has a single assigned MAC address. This MAC address is used as a source for all periodic messages sent by Master.

Virtual Router is defined by VRID and mapped set of IPv4 or IPv6 addresses. Master router is said to be the owner of mapped IPv4/IPv6 addresses. There are no limits to use the same VRID for IPv4 and IPv6, however these will be two different Virtual Routers.

Only Master router is sending periodic Advertisement messages to minimize the traffic. Backup will try to preempt the Master only if it has the higher priority and preemption is not prohibited.

All VRRP routers belonging to the same VR must be configured with the same advertisement interval. If interval does not match router will discard received advertisement packet.

Icon-warn.png

Warning: In case VRRP is used with Reverse Path Filtering, then it is recommended that rp-filter is set to loose, otherwise the VRRP interface might not be reachable.


Virtual Router (VR)

A Virtual Router (VR) consists of one Owner router and one or more backup routers belonging to the same network.

VR includes:

  • VRID configured on each VRRP router
  • the same virtual IP on each router
  • Owner and Backup configured on each router. On a given VR there can be only one Owner.


Virtual MAC address

VRRP automatically assigns MAC address to VRRP interface based on standard MAC prefix for VRRP packets and VRID number. First five octets are 00:00:5E:00:01 and last octet is configured VRID. For example, Virtual Routers VRID is 49, then virtual MAC address will be 00:00:5E:00:01:31.

Icon-note.png

Note: Virtual mac address can not be manually set or edited.



Owner

VRRP without Owner

An Owner router for a VR is default Master router and operates as the Owner for all subnets included in the VR. As mentioned before priority on an owner router must be the highest value (255). In example network R1 is an Owner. It's priority is set to 255 and virtual IP is the same as real IP (owns the virtual IP address).

All Virtual Router members can be configured so that virtual IP is not the same as physical IP. Such Virtual address can be called floating or pure virtual IP address.

Advantage of this setup is flexibility given to the administrator. Since the virtual IP address is not the real address of any one of the participant routers, the administrator can change these physical routers or their addresses without any need to reconfigure the virtual router itself.

Icon-note.png

Note: RouterOS can not be configured as Owner. Pure virtual IP configuration is the only valid configuration unless non-RouterOS device is set as owner.



Master

Master router in a VR operates as the physical gateway for the network for which it is configured. Selection of the Master is controlled by priority value. Master state describes behavior of Master router. In example network R1 is the Master router. When R1 is no longer available R2 becomes master.

Backup

VR must contain at least one Backup router. Backup router must be configured with the same virtual IP as Master for that VR. Default priority for Backup routers is 100. When current master router is no longer available, backup router with highest priority will become current master. Every time when router with higher priority becomes available it is switched to master. Sometimes this behavior is not necessary. To override it preemption mode should be disabled.


Virtual Address

Virtual IP associated with VR must be identical and set on all VR nodes. On Owner router Virtual IP must be the same as real IP. For example on Owner router real IP and virtual IP is 192.168.1.1, on Backup router virtual IP is 192.168.1.1, but real IP is 192.168.1.2. All virtual and real addresses should be from the same network.

If the Master of VR is associated with multiple IP addresses, then Backup routers belonging to the same VR must also be associated with the same set of virtual IP addresses. If virtual address on the Master is not also on Backup a misconfiguration exists and VRRP advertisement packets will be discarded.

Icon-note.png

Note: It is not recommended to set up Mikrotik router as an Owner router. VRRP address and real IP address should not be the same.



In IPv6 networks first address is always link-local address associated to VR. If multiple IPv6 addresses are configured, then they are added in advertisement packet after the link-local address.


IPv4 ARP

The Master for a given VR responds to ARP requests with the VR's assigned MAC address. Virtual MAC address is also used as the source MAC address for advertisement packets sent by the Master. To ARP requests for non-virtual IP addresses router responds with the system MAC address. Backup routers are not responding to ARP requests for Virtual IPs.

IPv6 ND

As you already know there are no ARP in IPv6 networks, routers are discovered by Neighbor Discovery protocol. When router becomes the Master, unsolicited ND Neighbor Advertisement with the Router Flag is sent for each IPv6 address associated with the virtual router.

VRRP state machine

VRRP state transition flow

As you can see from diagram, each VRRP node can be in one of three states:

  • Init state
  • Backup state
  • Master state


Init state

The purpose of this state is to wait for a Startup event. When this event is received, then following actions are taken:

  • if priority is 255,
  • * for IPv4 send advertisement packet and broadcast ARP requests
  • * for IPv6 send an unsolicited ND Neighbor Advertisement for each IPv6 address associated with the virtual router and set target address to link-local address associated with VR.
  • * transit to MASTER state;
  • else transit to BACKUP state.


Backup state

When in backup state,

  • in IPv4 networks, node is not responding to ARP requests and is not forwarding traffic for the IP associated with the VR.
  • in IPv6 networks, node is not responding to ND Neighbor Solicitation messages and is not sending ND Router Advertisement messages for VR associated IPv6 addresses.

Routers main task is to receive advertisement packets and check if master node is available.

Backup router will transit itself to master state in two cases:

  • If priority in advertisement packet is 0;
  • When Preemption_Mode is set to no, or Priority in the ADVERTISEMENT is greater than or equal to the local Priority

After transition to Master state node is:

  • in IPv4 broadcasts gratuitous ARP request;
  • in IPv6 sends an unsolicited ND Neighbor Advertisement for every associated IPv6 address.

In other cases advertisement packets will be discarded. When shutdown event is received, transit to Init state.

Icon-note.png

Note: Preemption mode is ignored if Owner router becomes available.



Master state

When MASTER state is set, node functions as a forwarding router for IPv4/IPv6 addresses associated with the VR.

In IPv4 networks Master node responds to ARP requests for the IPv4 address associated with the VR. In IPv6 networks Master node:

  • responds to ND Neighbor Solicitation message for the associated IPv6 address;
  • sends ND Router Advertisements for the associated IPv6 addresses.


If advertisement packet is received by master node:

  • If priority is 0, send advertisement immediately;
  • If priority in advertisement packet is greater than nodes priority then transit to backup state
  • If priority in advertisement packet is equal to nodes priority and primary IP Address of the sender is greater than the local primary IP Address, then transit to backup state
  • Ignore advertisement in other cases

When shutdown event is received, send advertisement packet with priority=0 and transit to Init state.

Configuring VRRP

IPv4

Setting up Virtual Router is quite easy, only two actions are required - create vrrp interface and set Virtual Routers IP address.

For example, add vrrp to ether1 and set VRs address to 192.168.1.1

/interface vrrp add name=vrrp1 interface=ether1
/ip address add address=192.168.1.1/32 interface=vrrp1

Notice that only 'interface' parameter was specified when adding vrrp. It is the only parameter required to be set manually, other parameters if not specified will be set to their defaults: vrid=1, priority=100 and authentication=none.

Icon-note.png

Note: address on VRRP interface must have /32 netmask if address configured on VRRP is from the same subnet as on router's any other interface.


Before VRRP can operate correctly correct IP address is required on ether1. In this example it is 192.168.1.2/24

VRRP Examples section contains several configuration examples.


IPv6

To make VRRP work in IPv6 networks, several additional options must be enabled - v3 support is required and protocol type should be set to IPv6:

/interface vrrp add name=vrrp1 interface=ether1 version=3 v3-protocol=ipv6

Now when VRRP interface is set, we can add global address and enable ND advertisement:

/ipv6 address add address=FEC0:0:0:FFFF::1/64 advertise=yes interface=vrrp1

No additional address configuration is required as it is in IPv4 case. IPv6 uses link-local addresses to communicate between nodes.

Property reference

Sub-menu: /interface vrrp


Property Description
arp (disabled | enabled | proxy-arp | reply-only; Default: enabled) ARP resolution protocol mode
authentication (ah | none | simple; Default: none) Authentication method to use for VRRP advertisement packets.
  • none - should be used only in low security networks (e.g., two VRRP nodes on LAN).
  • ah - IP Authentication Header. This algorithm provides strong protection against configuration errors, replay attacks and packet corruption/modification. Recommended when there is limited control over the administration of nodes on a LAN.
  • simple - uses clear text password. Protects against accidental misconfiguration of routers on local network.
interface (string; Default: ) Interface name on which VRRP instance will be running
interval (time [10ms..4m15s]; Default: 1s) VRRP update interval in seconds. Defines how often master sends advertisement packets.
mtu (integer; Default: 1500) Layer3 MTU size
name (string; Default: ) VRRP interface name
on-backup (string; Default: ) Script to execute when the node is switched to backup state
on-master (string; Default: ) Script to execute when the node is switched to master state
password (string; Default: ) Password required for authentication. Can be ignored if authentication is not used.
preemption-mode (yes | no; Default: yes) Whether master node always has the priority. When set to 'no' backup node will not be elected to be a master until the current master fails, even if the backup node has higher priority than the current master. This setting is ignored if Owner router becomes available
priority (integer: 1..254; Default: 100) Priority of VRRP node used in Master election algorithm. Higher number means higher priority. '255' is reserved to Router that owns VR IP and '0' is reserved for Master router to indicate that it is releasing responsibility.
v3-protocol (ipv4 | ipv6; Default: ipv4) Protocol that will be used by VRRPv3. Valid only if version is 3
version (integer [2, 3]; Default: 3) Which VRRP version to use.
vrid (integer: 1..255; Default: 1) Virtual Router identifier. Each Virtual router must have unique id number


There are two ways to add scripts to on-backup and on-master


See more


[ Top | Back to Content ]