Basic Operation
In essence, FHRPs are used to provide transparent gateway failover for end hosts. FHRPs enable a set of routers to work together to present the illusion of a single virtual router. This is achieved by multiple gateways sharing the same virtual IP address, and end hosts using this virtual IP address as their default gateway.Look at the scenario below. The PCs have their default gateways set to the virtual IP address. They are basically unaware of the physical routers operating behind the scenes. The PCs only send packets towards their default gateway (the virtual IP) but they do not know which router is actually forwarding the traffic. If a router goes down, the other one will assume its role. The process is transparent and non-disruptive from the PCs' perspective.
This is the basic operation of FHRPs, but each protocol has a unique implementation.
HSRP
HSRP is a Cisco proprietary protocol, but it is also specified in RFC 2281. This means that HSRP can be implemented by other vendors, but special licensing is required. HSRP operates by electing one active router based on highest priority (100 by default, 0-255 range). The active router is responsible for forwarding packets. The other router remains in standby mode. If there are more than two routers in the HSRP group, the rest will stay in the Listen state (i.e. they know the virtual IP address and listen for Hello messages). If the active router fails, the standby router assumes its duties.In addition to the virtual IP address, the routers in the same HSRP group share a virtual MAC address. The virtual MAC address is 0000.0C07.ACxx, where xx is the HSRP group ID. The group ID does not have to match the VLAN ID, but they are typically configured as the same value for consistency. If no group ID is specified, group ID 0 is assumed (default). The active router "owns" the virtual IP and MAC addresses. When a PC sends an ARP request for its default gateway IP address (the virtual IP), the active router will reply with the virtual MAC address.
The HSRP routers communicate by exchanging UDP-based multicast Hello packets. The Hello packets are sent in the multicast IP address 224.0.0.2 in UDP port 1985 (specific to version 1) every three seconds by default. If Hellos are not heard in ten seconds (the default HoldTime value), the active router is considered dead, and the standby router will assume its role.
Preemption is disabled by default. This means that a router will not attempt to take control as the active router, when it has a higher priority than the current active router. Note that this behavior effects the order of configuration. If preemption is not used, the active router must be configured first to guarantee that it will, in fact, become the active router. Preemption is required to successfully operate certain features (more in upcoming post about object tracking).
Because of the active/standby behavior, load balancing can only be implemented similar to STP. Load balancing is achieved by assigning different active routers for different HSRP groups (similar to STP having different root switches for different VLANs).
HSRP supports clear-text and MD5 authentication.
Other than basic IP connectivity (the routers must have individual IP addresses), the absolute minimum configuration for HSRP is to define the virtual IP address. The other parameters will then use their default values, namely, priority 100, group ID 0, and no preemption.
Example:
A#
interface vlan 10
ip address 10.1.1.101 255.255.255.0
standby ip 10.1.1.1
S#
interface vlan 10
ip address 10.1.1.100 255.255.255.0
standby ip 10.1.1.1
VRRP
VRRP has only minor differences to HSRP. The main separating factor is that VRRP is a standards-based alternative to HSRP, so it will run in multi-vendor environments. More differences include:- terminology: master/backup vs. active/standby
- communication: uses its own Transport protocol 112, and multicast IP address 224.0.0.18
- virtual IP address: can use the Master's interface IP address (HSRP requires unique physical IP addresses)
- virtual MAC address: 0000.5E00.01xx, where xx is the VRRP group number
- preemptive by default
Example configuration:
A#
interface vlan 10
ip address 10.1.1.101 255.255.255.0
vrrp 10 ip 10.1.1.1
S#
interface vlan 10
ip address 10.1.1.102 255.255.255.0
vrrp 10 ip 10.1.1.1
GLBP
GLBP performs similar, but not identical, to HSRP and VRRP. It is a Cisco proprietary protocol, and extends HSRP functionality to natively support load balancing. GLBP provides load balancing over multiple router using a single virtual IP address and multiple virtual MAC addresses. Contrary to HSRP and VRRP where only a single router (the active router) processes packets, all routers in a GLBP group participate in forwarding packets. GLBP members communicate with each others by sending Hello messages every 3 seconds to the multicast address 224.0.0.102, UDP port 3222.Routers in a GLBP group operate in one of two roles: Active Virtual Gateway (AVG) or Active Virtual Forwarder (AVF). Members of a GLBP group elect one router to act as the AVG for that group. The election is based on the highest priority (range 1-255). The priority also determines the order of ascendancy to becoming an AVG if the current AVG fails. In case of a tie, the higher IP address is preferred. The remaining routers in the GLBP group assume the role of AVF. The AVG assigns a virtual MAC address for each AVF, and each AVF is responsible for forwarding packets sent to their virtual MAC address. The AVG operates as an AVF itself. The AVG also replies to ARP requests for the virtual IP address. Up to four virtual MAC addresses per GLBP group is allowed. Load sharing is achieved by the AVG replying to the ARP requests with different virtual MAC addresses.
By default, preemption is disabled. A backup AVG can become the active AVG only if the current AVG fails, regardless of a higher priority.
Example configuration:
AVG#
interface vlan 10
ip address 10.1.1.102 255.255.255.0
glbp 10 ip 10.1.1.1
glbp 10 priority 150
AVF#
interface vlan 10
ip address 10.1.1.101 255.255.255.0
glbp 10 ip 10.1.1.1
No comments:
Post a Comment