Well, it's a tail as old as time the network industry has a need and
In our case that need would be gateway redundancy and so the industry standards
world can take a while to come up with a solution
And so what we have is we have vendor solutions and especially
Cisco very oftentimes steps in and says hey, we have a solution in this case
It was HSRP and this was the original HSRP version one
Well eventually the industry did catch up and said hey, we also have a solution WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well eventually the industry did catch up and said hey, we also have a solution
because Cisco proprietary protocols can only go on
Cisco devices and so if I have two non-SISCO routers, I can't use HSRP here
I would need something that is
Allowed to be deployed because Cisco owns the rights to HSRP so instead the
industry created the virtual router redundancy protocol or VRRP
Now by all rights VRRP and HSRP they are very similar WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now by all rights VRRP and HSRP they are very similar
They're going to operate very similarly and even the configuration can be
pretty similar
But the industry does like to differentiate themselves a little bit from what
Cisco
Creates and so we do have a few differences and there's actually one pretty
compelling difference
with a VRRP that might even entice us to use VRRP instead of HSRP and to be
clear
Cisco devices
So if we get a Cisco router or Cisco layer three switch we can choose HSRP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we get a Cisco router or Cisco layer three switch we can choose HSRP
version one and version two
We should always choose version two or we can choose VRRP
Cisco does allow us to deploy that which is important because we might have a
Cisco device and a non-SISCO device
That are on the same network and we want to be able to run a protocol between
them for gateway redundancy
At that point it would require us to run VRRP
So Cisco does play nice and deploys their own
Protocols alongside the industry standard ones and I will say this in many WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Protocols alongside the industry standard ones and I will say this in many
cases when this happens
The Cisco version of a protocol goes away
We think back all the way to when trunking was performed the Cisco's
Inter switch link or ISL protocol
They were the first ones to create the means for trunking between switches the
industry eventually created 802.1 Q
Or what we sometimes refer to as dot 1 Q trunking and
That's great and also Cisco supported both for a long time well eventually ISL WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That's great and also Cisco supported both for a long time well eventually ISL
disappeared even on Cisco devices these days
We can't run ISL and
So we might have expected HSRP to eventually disappear as well. I'd say the
opposite is happened with Cisco networks when we're deploying all Cisco
We typically see HSRP. It's just the protocol that a lot of Cisco engineers are
comfortable with
I say Cisco engineers. I mean you and I people who don't work for Cisco, but we
're deploying Cisco technologies a lot of times
We say okay, well HSRP is pretty simple. I understand it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We say okay, well HSRP is pretty simple. I understand it
I can configure it and therefore I'm good and I don't need VRRP
And if I'm running a fully Cisco network, there's no problem with that and in
fact
That's what we see a lot of today
But naturally we also need to know and understand VRRP in order to be complete
network engineers
Because guess what there's going to be a day where we have to support either
this topology or just flat out a
Non-Sysco network that is running VRRP instead of HSRP
Now again, we do have a lot of similarities WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now again, we do have a lot of similarities
between HSRP and VRRP and so for the most part
We want to focus on the differences because we understand that there's going to
be a node that is
Operating the virtual IP address and then that node can fail and the other one
takes over a lot of that initial FHRP conversation
Is going to hold true for both protocols. So let's focus on the differences
from HSRP
So first of all we do have new terminology instead of active and standby we are WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So first of all we do have new terminology instead of active and standby we are
going to have master and
Backup
These are the roles that we use for VRRP
Furthermore if we have lots of routers in this network before we had the listen
role for HSRP
But here we're just going to have many backup roles
So if I have four routers that are all part of this domain one will be the
master the other three will all be backup routers
Next we have to elect a master and we're still going to use the priority WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Next we have to elect a master and we're still going to use the priority
concept although
Interestingly at least on Cisco devices our priority is going to range from one
to two
54 so remember we had the full eight bit range zero to two fifty five with HSRP
with
VRP it's going to be between one and two fifty four
We do have a one reason for that and we'll see that here coming up where the
priority of two fifty five is reserved and
Actually utilized whereas zero is also reserved. It's just not actually WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Actually utilized whereas zero is also reserved. It's just not actually
Part of the framework at this time. So next we have timers same concept
We're going to send our packets at a particular hello rate and we're going to
Recognize that there's an outage after the hold timer expires except in our
case here
The default timers are different. It's going to be one second
Hello timers and three second hold timers meaning that will detect a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Hello timers and three second hold timers meaning that will detect a
Outage a whole lot faster with VRP if we use the default timers
Furthermore, and this is an interesting thing preemption
That's that same concept applies here, but it's actually enabled by default
Just kind of an interesting configuration change from HSRP if we don't want the
failover to
Fall back to the original active then we don't do anything to the HSRP config, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Fall back to the original active then we don't do anything to the HSRP config,
but for VRP we actually have to disable it
Since it's enabled by default
lastly authentication does still exist
Although on Cisco devices we actually only support open authentication, which
is kind of interesting
So that means that we have plain text
Passwords that are sent back and forth which doesn't help prevent the bad guys
from breaking into our network
But it does make it so we don't have accidental misconfigurations meaning that
I've got a multiple WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I've got a multiple
Maybe VRP groups on here and so I can authenticate with one password on these
two
authenticate with a different password on these two and that way
Words less likely to accidentally cross our VRP streams so to speak
Next we do need to talk about the addresses that are used from a multicast
perspective
VRP is going to have its own reserved address of 224.0.0.18 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So unlike HSRP version 1 which started with the all routers address
VRP does have its own IP or MAC address
multicast address from the beginning and also does have its own virtual MAC
address range just like with HSRP
And this one is going to be 00000.5e
And then from here we have 0001xx
Meaning that these last two are going to be based on the group ID
Now just like we talked about before the fact that we have two hex characters WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now just like we talked about before the fact that we have two hex characters
means that we're going to have a total of
256 groups
And this doesn't change with different versions of VRRP we're going to be
locked to 256 groups
Meaning that if we do have that conversation we said if we have VLAN 500 for
example
We're going to have to match that up with group ID of
17 something probably pretty random and we can do our best to associate it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
17 something probably pretty random and we can do our best to associate it
again
Maybe 50s available, but
Ultimately we're not able to lock in our group ID to match our VLAN ID using VR
RP
Now lastly we have one other really nifty feature that VRRP has that HSRP doesn
't
And that is that we can use a physical address as
Our virtual address
This is very interesting and first of all let's describe exactly what we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is very interesting and first of all let's describe exactly what we're
talking about and then we can explain why it matters
So let's say that we have a pair of routers and we have these layer three
interfaces
That are connected to a broadcast domain
A VLAN so we'll just say this is VLAN 100
And if we wanted to configure this via HSRP or with VRRP the traditional way
We would have a virtual IP address shared and therefore we'd have something
like that dot 253 on the left WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
like that dot 253 on the left
dot 254 on the right and
Dot 252 I guess up here I meant to start with 252, but we have three IP
addresses in use here
But we do have an option that we could use that
Changes this up a little bit we could point to one of these physical addresses
and say this is our virtual IP address
Now it's no longer virtual. It's a physical address
But here's what's interesting about this. I'm going to set my default gateway
to whatever that IP address is so let's say it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to whatever that IP address is so let's say it's
Dot 253 we've said before so my default gateway points to 253
I'm still going to configure this router with its own IP address of dot 254
And so if we
Think about this is interesting because now I'm going to be pointing to this IP
address
And if this device were to go down I just lost access to my gateway. I lost
access to 253
Except if I'm running WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Except if I'm running
VRRP here
And I specify that this virtual address is dot 253
Then that still allows me to have my master
It allows me to have my backup and in the event that this interface goes down
This device can take over for 253
Pretty interesting
We're not specifying a third IP address here. We're just taking
Advantage or making use of the IP address that's already WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Advantage or making use of the IP address that's already
Configured on the router on the left. So that's kind of cool
Now there's a couple of things to note about this first and foremost is pre
emption
Preemption is not only must be enabled it also requires that we
Keep one of the device that owns the IP address that has to be the master
Which makes sense because if this device comes back online I could try to have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Which makes sense because if this device comes back online I could try to have
preemption disabled
But I own dot 253 I must fail back to the original master node because it needs
to be online with the physical IP address
So I would shut down my operations of dot 253 here on the right and defer to
the original master
So we have no choice about that second of all that priority value that we
mentioned
It's going to be locked to 255
For this node again ensuring that it is the master WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
For this node again ensuring that it is the master
So long story short here that master device the device that owns that physical
address
Must be the master and it must always be the master if it's online meaning if
it goes offline
It has to preempt when it comes back online and that's just again the nature of
running with the physical IP address
If it's online it has to have ownership of it
Now then we have to ask the question of why
Why would we go to all of this trouble to have this feature WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Why would we go to all of this trouble to have this feature
If we have a slash 24 subnet range we've got
256 addresses, 254 usable and if I'm going to use three of those for my gate
ways then I still have 251 addresses
Not a big deal
Well, there's probably not a compelling reason for us to do this with a slash
24
But now think about something much smaller
Let's think about a slash 29
A slash 29 has eight addresses and only six usable WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
A slash 29 has eight addresses and only six usable
And now let's imagine that this isn't a laptop connecting in let's imagine
This is another layer three device that is pointing up to a gateway maybe some
kind of internet edge topology
So now we have a scenario where we only have six usable
And I'm going to want to maximize my space if I'm using three of those for VRRP
That only leaves me with three left one of which by the way needs to go right
here
So if I'm trying to perform any NAT type of operations my IP address usage is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if I'm trying to perform any NAT type of operations my IP address usage is
limited
Meanwhile if I only use two for VRRP
Well that increases it by an entire IP address
And even though it's only one address percentage wise that's actually pretty
good
It gives me one more address that I can use for whatever it is that I need to
use it
Maybe it's other devices maybe it's NAT like I mentioned
But either way this concept here where we have a very limited number of IP
addresses WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
addresses
And we're using a first-hop redundancy protocol
In order to facilitate gateway operations
Well at that point we very well might need to rely on this physical address
concept
Which would lead us to turn off HSRP that was our plan or that's what we had
running
And enable VRRP to recover that IP address and be able to leverage it fully
But oh at the end of this conversation we see that outside of this specific
scenario
VRRP operation is very similar to HSRP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
VRRP operation is very similar to HSRP
We just have to understand the new address format
And we have to understand that configuration wise there are going to be
differences
And a little bit of difference in terminology when compared to HSRP