1

Does anyone know what internal criteria various routers use to sense when their WAN connection has gone down when configured for VRRP, in order to then decide to switch over from the master to the backup router? I have some thirdhand reports that Fortigate devices simply use the presence or absence of an internal route to a specific external subnet or host (e.g. 4.2.2.1). This to me seems wrong - because the route could still exist on the master, but the actual connectivity is not there, which would mean that the master would not fail over to the backup.

Curious if anyone knows the internal implementation details of various routers (e.g. FG, Cisco).

Forgive me if this has already been answered, or if my question doesn't quite make sense. I'm kind of a network n00b.

  • 1
    Each manufacturer is different, and it also depends on the WAN media. – Ron Trunk Aug 24 '16 at 14:58
  • What router do you have, and what WAN media? – Ron Trunk Aug 24 '16 at 15:16
  • Several. One config is two FG30Ds connected to a Cradlepoint IBR350LPE LTE modem. In another configuration I have two Cisco C891s connected to a Zyxel P660-HN51 DSL modem. – Jeff Wright Aug 24 '16 at 16:18
  • Can you post the config of the Cisco C891? Otherwise, we're just guessing. – Ron Trunk Aug 24 '16 at 18:56
  • 2
    You can configure the Cisco router to switch on different criteria. By "default" it would check the physical status of the port. But you can configure the router to check many other things such as reachability to some endpoint, packet loss, latency, etc. That why we need to see the configuration before answering. – Ron Trunk Aug 25 '16 at 11:27
3

First Hop Redundancy Protocols Configuration Guide, Cisco IOS XE Release 3S

VRRP Object Tracking

Object tracking is an independent process that manages creating, monitoring, and removing tracked objects such as the state of the line protocol of an interface. Clients such as the Hot Standby Router Protocol (HSRP), Gateway Load Balancing Protocol (GLBP), and VRRP register their interest with specific tracked objects and act when the state of an object changes.

Each tracked object is identified by a unique number that is specified on the tracking CLI. Client processes such as VRRP use this number to track a specific object.

The tracking process periodically polls the tracked objects and notes any change of value. The changes in the tracked object are communicated to interested client processes, either immediately or after a specified delay. The object values are reported as either up or down.

VRRP object tracking gives VRRP access to all the objects available through the tracking process. The tracking process allows you to track individual objects such as a the state of an interface line protocol, state of an IP route, or the reachability of a route.

VRRP provides an interface to the tracking process. Each VRRP group can track multiple objects that may affect the priority of the VRRP device. You specify the object number to be tracked and VRRP is notified of any change to the object. VRRP increments (or decrements) the priority of the virtual device based on the state of the object being tracked.

How VRRP Object Tracking Affects the Priority of a Device

The priority of a device can change dynamically if it has been configured for object tracking and the object that is being tracked goes down. The tracking process periodically polls the tracked objects and notes any change of value. The changes in the tracked object are communicated to VRRP, either immediately or after a specified delay. The object values are reported as either up or down. Examples of objects that can be tracked are the line protocol state of an interface or the reachability of an IP route. If the specified object goes down, the VRRP priority is reduced. The VRRP device with the higher priority can now become the virtual device master if it has the vrrp preempt command configured. See the “VRRP Object Tracking” section for more information on object tracking.

VRRP Advertisements

The virtual router master sends VRRP advertisements to other VRRP routers in the same group. The advertisements communicate the priority and state of the virtual router master. The VRRP advertisements are encapsulated in IP packets and sent to the IP Version 4 multicast address assigned to the VRRP group. The advertisements are sent every second by default; the interval is configurable.

Although the VRRP protocol as per RFC 3768 does not support millisecond timers, Cisco routers allow you to configure millisecond timers. You need to manually configure the millisecond timer values on both the primary and the backup routers. The master advertisement value displayed in the show vrrp command output on the backup routers is always 1 second because the packets on the backup routers do not accept millisecond values.

You must use millisecond timers where absolutely necessary and with careful consideration and testing. Millisecond values work only under favorable circumstances, and you must be aware that the use of the millisecond timer values restricts VRRP operation to Cisco devices only.

  • So not entirely different in concept than FortiGate's "health monitor," mentioned above. Thanks. – Jeff Wright Aug 25 '16 at 18:42
1

You're right in stating that in FortiOS the vrdst option does not actively ping the target address but decides whether an active route to this destination exists or not. In a second stage, you configure a 'health monitor' on e.g. the WAN interface which can use ICMP, UDP or TCP pings to determine the accessability of an external target host. If this monitor fails, the route to the ping target is removed and VRRP is failing over.

If you think about it there are more reasons why a particular route is removed - manual deletion, dynamic routing protocols, physical link failure etc. The two-stage setup provides status monitoring without having to rely on 'ping' access (which may be blocked for security reasons).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.