6

I'm trying to setup a redundant route link for our internal network using brocade layer 3 switches. I have setup up VRRP on both the green/blue and red/black networks. The reason for doing this is to simulate an active passive pairing.

I thought about it and noticed one issue. If the red connection fails VRRP will work and switch over to the black network but the green network doesn't know this fail over occurred and could be the default path for network traffic.

I'm not sure what things I could do to prevent this issue from occurring. Is there a better way to implement them being an active passive pair?

The simple diagram of how the network is setup.

enter image description here

EDIT 2013-11-05
All connected or reconnected

SSH@R1(config-vif-70)#show ip vrrp-extended bri
Inte- VRID Current  Flags  State  Master IP       Backup IP       Virtual IP      Short-
rface      Priority               Address         Address         Address         Path-Fwd
------------------------------------------------------------------------------------------
v3    3    105      P2     Master Local           Unknown         172.31.0.254
v70   70   105      P2     Master Local           Unknown         10.64.1.53
SSH@R2(config-vif-3)#show ip vrrp-e bri
Inte- VRID Current  Flags  State  Master IP       Backup IP       Virtual IP      Short-
rface      Priority               Address         Address         Address         Path-Fwd
------------------------------------------------------------------------------------------
v3    3    100      P2     Backup 172.31.0.1      Local           172.31.0.254
v70   70   100      P2     Backup 10.64.1.51      Local           10.64.1.53

Connection Broken at R1b(v3)

SSH@R1(config-vif-70)#show ip vrrp-extended bri
Inte- VRID Current  Flags  State  Master IP       Backup IP       Virtual IP      Short-
rface      Priority               Address         Address         Address         Path-Fwd
------------------------------------------------------------------------------------------
v3    3    105      P2     Init   Unknown         Unknown         172.31.0.254
v70   70   95       P2     Backup 10.64.1.52      Local           10.64.1.53

SSH@R2(config-vif-3)#show ip vrrp-e bri
Inte- VRID Current  Flags  State  Master IP       Backup IP       Virtual IP      Short-
rface      Priority               Address         Address         Address         Path-Fwd
------------------------------------------------------------------------------------------
v3    3    100      P2     Master Local           Unknown         172.31.0.254
v70   70   100      P2     Master Local           Unknown         10.64.1.53
7

This is the logical view of what you're trying to achieve:

Dual VRRP Logical Architecture

Configure the router priorities for both VRRP 'a' and VRRP 'b' as follows:

  • Router 1: 110 (master)
  • Router 2: 100 (backup)

The configure interface tracking as follows:

  • Router 1 VRRP a: track interface R1b with a track priority of 90
  • Router 1 VRRP b: track interface R1a with a track priority of 90
  • Router 2 VRRP a: track interface R2b with a track priority of 90
  • Router 2 VRRP b: track interface R2a with a track priority of 90

If interface R1b goes down, Router 1 will change its VRRP 'a' priority to 90. This priority is now less than the VRRP 'a' priority that Router 2 has, so it will preempt and take over mastership for VRRP 'a'.

In addition, because interface R1b has gone down, then the VRRP hello packets will fail across VLAN 'b'. This will be detected by Router 2 (after failing to receive a hello packet within the dead timer interval), at which point it will take over mastership for VRRP 'b'.

If interface R1a goes down, then in a similar fashion, Router 2 will take over mastership for both VRRP groups (Router 1 VRRP 'b' priority = 90, and the VRRP hello packets will fail across VLAN 'a').

If either interface R2a or R2b goes down, then Router 1 will continue to be master for both VRRP groups.

Note that the priority value I've chosen above are quite arbitrary -- you may want to choose different values. Also, if the VIP address of a particular VRRP group is the same as the interface address for one of the routers in that VRRP group, then that router will automatically take a priority of 255 (i.e. it will always be the master unless that interface goes down).

As a side note, to get the above logical architecture, you will need a physical architecture similar to the following:

Dual VRRP Physical Architecture

You can read up on VRRP on Wikipedia here:

http://en.wikipedia.org/wiki/Virtual_Router_Redundancy_Protocol

Brocade's VRRP documentation is here:

http://www.brocade.com/support/Product_Manuals/ServerIron_SwitchRouterGuide/VRRP.7.2.html

Brocade also have some VRRP configuration examples here:

http://www.brocade.com/support/Product_Manuals/ServerIron_SwitchRouterGuide/VRRP.7.11.html

Hope this helps! :)

  • Much better answer than mine, however unless you know that this works differently than the documentation (and from what I recall from prior experience - I don't have access currently to Brocade devices I can test on to verify), the track priority value is not subtracted from the configured priority, it actually replaces it. So while your example will still work, the description is not correct. I would also use a higher track priority on the master, so that way if the opposite side fails for both devices, you still contol which takes priority. – YLearn Nov 5 '13 at 15:43
  • Good point regarding how Brocade treats the priority value when tracking an interface. I was thinking how IOS and Junos works, where the priority value specified in the tracking command will be subtracted from the current VRRP group priority value -- but as you point out, Brocade is different. I'll update my post to correct it! – Rob Nov 5 '13 at 19:26
  • 1
    @LF4, R1a should track R1b and R1b should track R1a. The same should take place on R2. – YLearn Nov 5 '13 at 22:56
  • Sorry, I miss clicked and removed my previous comment. The current priority is the value of the priority - the track priority. When R1b went down R1a changed it's current priority to 95 as expected. Which allowed R2a to become the master and since R1b was "broken" R2b became the master. – LF4 Nov 5 '13 at 23:01
  • 1
    @LF4, I would look at your firewall configuration (or the switches on either side of your L3 switches), but this is getting out of the scope of this question and you may want to ask about this as an additional second question. – YLearn Nov 6 '13 at 0:01
5

You are really looking for the Brocade Track Ports and Track Priority features.

With these features configured, when the red connection fails, it will lower the priority of the green connection. This should then allow the blue connection to take over as master in the group.

Personally, I would also add a direct link between the two L3 switches as well.

You may also want to consider running a routing protocol between the two L3 switches and the firewall, if they all support one (such as OSPF), rather than VRRP. However that may be overly complicated (not many details about your environment, equipment, staffing or the level of redundancy you hope to ultimately achieve).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.