Virtual Router Redundancy Protocol

The Virtual Router Redundancy Protocol (VRRP) eliminates the single point of failure inherent in the static default routed environment. VRRP specifies an election protocol that dynamically assigns responsibility for a virtual router to one of the VRRP routers on a LAN. The VRRP router controlling the IP addresses associated with a virtual router is called the Master, and forwards packets sent to these IP addresses. The election process provides dynamic fail-over in the forwarding responsibility should the Master become unavailable. Any of the virtual router's IP addresses on a LAN can then be used as the default first hops router by end-hosts.

To achieve redundancy between pairs of platforms, Radware recommends using Virtual Router Redundancy Protocol (VRRP). VRRP lets you maintain dynamic redundancy using a logical entity called virtual router (VRRP was initially developed to provide high availability for routers).

A VR (virtual router), has a Virtual Router Identifier (VRID) with one or more associated IP addresses. Each VR has a VRMAC, which is a MAC address associated with the VR. This saves the need for a MAC address update in case of a failover. The VRMAC address is determined by the VRID and does not need to be configured manually.

The same VR needs to be configured on multiple platforms to achieve redundancy between them for the VR. Each platform has a priority for a VR, and the primary platform for the VR is the platform with the highest priority. Using VRRP, the primary platform constantly sends advertisements to other VRRP platforms to indicate that it is online. When the advertisements stop, the primary platform is assumed to be inactive. A new primary platform is then selected for this VR; that is, the platform with the next highest priority for that VR. However this protocol can be supported by a wide range of platforms that are not routers as it is not a routing protocol - it does not advertise IP routes or affect the routing table in any way. With VRRP, IP addresses are associated with the Virtual MAC Addresses that are owned by the primary platform, and are taken over by the backup platform at failover time.

To set up the VRRP Table

1.	From the AppDirector menu, select Redundancy > Global Configuration. The Global Redundancy Configuration pane displays.

2.	Ensure that IP Redundancy Admin Status is set to VRRP.

3.	From the AppDirector menu, select Redundancy >VRRP > Virtual Routers. The Virtual Router Table pane displays.

4.	Click Create. The Virtual Router Table Create pane displays.

5.	Set the parameters.

 

Parameter	Description
IP Version	Select IPv4 or IPv6.
If Index	Interface number. Default: F-1
VR ID	Virtual router’s identification number. Values: 1 – 255
Admin Status	Displays the status of the administration, Up or Down.
Priority	The highest priority (255) must be assigned to the VR associated with a platform’s physical IP address (IP address that AppDirector owns). Values: 1 – 255 Default: 100 Notes:   When two platforms are configured with VRRP and the master platform has a priority of 255 set for its virtual routers, shutting down all virtual routers causes the backup state to move to master but causes the client connections to cease. This is because when you down Virtual Routers, you DO NOT down the port. This port continues functioning and as soon as you down the virtual router, the port broadcasts its MAC as the owner of the platform interface IP address. It continues sending health checks with source IP address and interface IP and ARPs for IPs on the directly connected networks. These ARPs poison the ARP cache of all machines on this network and they record the interface MAC of the primary platform as the holder of the interface IP address that the backup platform tried to take over using VRRP. Therefore, all traffic sent to the primary platform interface IP address as a gateway (reply traffic from the servers) reaches the primary platform and is routed straight to the default gateway of the platform. This is not where this traffic should be heading, because traffic sent to a VIP that was taken over by the backup platform (the primary platform does not fix the IP headers) routes the packet as it stands, breaking the session. When you use VR priority of 255 on the primary platform, you must manually add its interface IP address in the associated IP table. When you do not use VR priority of 255 on the primary platform, you cannot place its interface IP address in the associated IP table. This means that the default gateway is a different IP address that has no problems being poisoned but with the interface activities of the primary platform.
Primary IP	This is used internally only, as the source IP address of VRRP messages sent by AppDirector. Radware recommends leaving the default in this parameter. AppDirector adds a default unless the user defines one.
Advertise Interval	Interval at which packets are checked in seconds. Default: 1 Note: Configuring the specific advertisement interval value for a VRRP entry is only possible when the global value is set to 0. When the global value is not 0, the specific values for VRRP entries are discarded and the global value is used. See Global Redundancy Configuration.
Preempt Mode	Defines takeover procedure for VR when a platform fails and then resumes functioning. When a platform with a certain priority fails, the platform with the next highest priority takes control of the VR. Then, when the platform with the higher priority for this VR resumes functioning, Preemption Mode decides whether to retake control of VR from the platform with the lower priority. Values: True — The higher priority platform takes over the VR False — Only if the backup priority is higher than the difference of the base priority of the master and backup, then the Master takes over. Default: False Note: The router owning the IP address associated with the VR is an exception as it always preempts independently of parameter setting.
VR MAC	The virtual MAC address of the virtual router. Although this object can be derived from the 'vrrpOperVrId' object, it is defined so that it is easily obtainable by a management application and can be included in VRRP-related SNMP traps.
Address Count	The number of IP addresses that are associated with this virtual router. This number is equal to the number of rows in the vrrpAssoIpV6AddrTable that correspond to a given IF index/VRID pair
Master IP	The master router's real (primary) IP address. This is the IP address listed as the source in VRRP advertisement last received by this virtual router.
Up Time	This is the value of the `sysUpTime' object when this virtual router (that is, the `vrrpOperState') transitioned out of `initialized'.
Preferred State	The preferred state of the virtual router. This field affects the configuration of the peer platform's parallel VRRP entry. Values: Backup — Indicates that the peer's VRRP entry should have a higher priority. Master — Indicates that the peer's VRRP entry should have a lower priority.

6.	Click Set.

To activate or shut down the platforms

1.	In the VRIDs Up/Down drop-down list, set the desired parameter.

 

Parameter	Description
VRIDs Up/Down	All Down — Sets Admin Status for all VRIDs to Down. This shuts down the main platform. All Up — Sets the Admin status of all VRIDs to Up. So that the main AppDirector is activated and takes control from the backup platform. No Change — There is no change in the Admin Status. Default: No Change

2.	Click Set.