2

enter image description here I have a pair of Juniper routers each one having drops from ISP. We advertise same IP blocks from both the routers on WAN interface. Now on the Lan side, we have pair of HP core switch running IRF mode. What we would like to do is,

  1. Confiugre VRRP on the router to have common gateway
  2. Configure MCLAG on routers for active-active LAN connections
  3. Each router connects to each switch through LACP active-active mode.

Now for any incoming traffic, it is active-active, traffic can reach any router and goes to any core switch and works. Question is,

  1. How outgoing traffic from LAN works? IMO, VRRP is active-backup. So if the switch send the outgoing traffic to backup VRRP router since they are active-active link, will it directly go out via that router or it will go out to master VRRP router and go out to Internet?
  2. If so is there a way to configure the router to use both the link for outgoing or my understanding about VRRP is wrong and the current model works as active-active or outgoing traffic also?
Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin ♦
    Aug 6, 2017 at 20:08

2 Answers 2

Reset to default
1

It looks like it is possible to configure VRRP as active/active when used with MC-LAG. See this document: https://www.juniper.net/techpubs/en_US/release-independent/nce/information-products/pathway-pages/nce/nce-145-mc-lag-ex-core-campus.pdf#page8

Improve this answer
5
  • 1
    That document specifically says VRRP is Active/Standby. That is how the VRRP protocol is.
    – Ron Maupin ♦
    Nov 5, 2016 at 17:54
  • 1
    Both the master and backup forward traffic, that's active/active in my book.
    – user27899
    Nov 5, 2016 at 18:02
  • Only if the standby gets the traffic. With VRRP the traffic will normally be sent to the master.
    – Ron Maupin ♦
    Nov 5, 2016 at 18:04
  • 1
    The hashing algorithm for the bridge aggregation group (LAG) on the HP switches will determine which MX gets the traffic. If the hashing algorithm is selected properly it will roughly load-balance traffic to both MXs and both will forward the traffic out to the Internet
    – user27899
    Nov 5, 2016 at 18:15
  • No standby forwards the traffic on its own. Having this setup running well...
    – user88975
    Nov 7, 2016 at 10:59
0

VRRP is active/passive.

VRRP works on a LAN between a router and hosts on the LAN, and it advertises virtual IP and MAC addresses to the hosts on the LAN. The routers trade messages on the host LAN to share their priority with the other router(s). The router with the highest priority is the active router on the host LAN. If the other router(s) can't contact the active router on the host LAN, the remaining router with the highest priority will take over. This takes some time, during which traffic will be lost.

I believe your switches are layer-3 switches, and by using IRF you can make them look like a single layer-3 switch which can be the gateway for all the user VLANs, obviating the need for VRRP. The links between the virtual layer-3 switch and the routers should be routed links, and a routing protocol will failover much, much, much faster than VRRP.

Improve this answer
5
  • We don't do routing between router and LAN. So based on your comment it is not possible to have active - active outgoing configuration for traffic using VRRP and Mclag ?
    – user88975
    Aug 7, 2016 at 18:40
  • You would need to have a LAN between the routers and the switches to use VRRP. If your switches are doing routing (layer-3 switches), then you want to route between the switches and the routers. That will have the advantage of choosing the best path, and it will failover several orders of magnitude faster than VRRP. VRRP is a FHRP (First Hop Redundancy Protocol) meant to provide redundancy for the first hop from a host to a router. It give the illusion of a single router to the hosts. It is not a router-to-router protocol, and that confuses people.
    – Ron Maupin ♦
    Aug 7, 2016 at 18:44
  • For me what you suggest appears like a routed leaf spine and ECMP model which we cannot have now. The current layer 3 switch just forwards all traffic to default gateway which is a VRRP IP.
    – user88975
    Aug 7, 2016 at 19:19
  • Well, VRRP is not really the proper thing to use between the switches and routers if the switches can route. VRRP is really for hosts, and the delay when a router fails is measured in seconds, not milliseconds as it is for routing protocols. You could get it to work if the links between the switches and routers are all on the same layer-2 LAN because that is how VRRP advertises, and how the routers check each other. It is on that layer-2 LAN.
    – Ron Maupin ♦
    Aug 7, 2016 at 19:24
  • Well, I am sure you are suggesting something better than what I do. But technically it is what I have now. If someone answer it specifically, it would be helpful...
    – user88975
    Aug 8, 2016 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.