Netmanias 기술문서: VRRP(Virtual Router Redundancy Protocol) 상세동작원리

VRRP(Virtual Router Redundancy Protocol)
상세동작원리
2008년3월24일
NMC Consulting Group(tech@netmanias.com)

2
Contents
.VRRP의필요성
.Simple VRRP Scenario
.VRRP 동작원리
.VRRP Priority & Preemption
.VRRP Owner
.VRRP Terminology
.VRRP 운용방식
.VRRP Object Tracking
.VRRP Delay 설정

3
Single Point of Failure
To Avoid Single Point of Failure
.데이터센터내Server가외부Network과연결되는유일핚Gateway
Router R1이down 될경우Network에접속불가(Single Point of
Failure) .서비스단절
.1단계, 이러핚Single Point of Failure를막기위해Redundant
Router 도입결정
.2단계, 두개의Default Gateway에대핚Auto-Failover 기능을수행하는VRRP* 기능Enable
* VRRP는LAN상에존재하는Router (VRRP Router)들중하나의Virtual Router(Master)를선정하는데사용되는표준Protocol이다.
VRRP의필요성
Network
net
SW2
R1
VRRP
Network
GW#2
Master
Backup
1
2
3
net
R1R2
SW1
SW1
4
SW2
Server#1
Server#2
Server#3
Server#4
server_video
server_apps
server_da
server-web
Server#1
Server#2
Server#3
Server#4
server_video
server_apps
server_da
server-web

4
VRRP 구성및Master 선정
.R1, R2및Server에필요핚설정을핚다(오른쪽참조)
.VRRP를enable하면R1과R2 사이에VRRP advertisement
packet을주고받게되고, 이둘중Priority 값이높은R1이Master가된다.
(VRRP advertisement packet format은뒤에서설명함)
* Virtual MAC : 00-00-5E-00-01-XX(XX: VRID)
Network
Master
Priority=200
Backup
Priority=100
3
Bridge Table(SW1)
MAC
Port
Bridge Table(SW2)
MAC
Port
IP = 80.1.1.1
IP = 80.1.1.2
net
ARP Table(#1~4)
IP
MAC
R1
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.3
MAC: 0000.5e00.0101*
2
1
GW#2
SW2
4
R2(config)#interface ge2.101
R2(config-if)# ip address 80.1.1.2/24
R2(config)# router vrrp 1 interface ge2.101
R2(config-router)# virtual-ip 80.1.1.3backup
R2(config-router)# priority 100
R2(config-router)# preempt-mode true
R2(config-router)# advertisement-interval2
R2(config-router)# enable
R1(config)#interface ge2.101
.VRRP를enable핛인터페이스로들어간다R1(config-if)# ip address 80.1.1.1/24
.인터페이스에ip를설정핚다R1(config)# router vrrp 1 interface ge2.101
.인터페이스를VRRP Instance 1에포함시킨다R1(config-router)# virtual-ip 80.1.1.3backup
.Virtual-IP를설정핚다
.R1(config-router)# priority 200.뒤에서설명R1(config-router)# preempt-mode true.뒤에서설명R1(config-router)# advertisement-interval 2
.VRRP Hello 주기R1(config-router)# enable
VRRP advertisement
R1 설정
Server#1~4 설정
Server 의Default Gateway를Virtual-IP(80.1.1.3)으로설정핚다
R2 설정
Simple VRRP Scenario (1)
Server#1
Server#2
Server#3
Server#4
server_video
server_apps
server_da
server-web

5
Master 기능.GARP Request Packet송싞
.Master는Gratuitous ARP(GARP)를보내어L2 Switch의Bridge Table (MAC Address Table)과Server의ARP Table을갱싞시킨다.
Network
Master
Priority=200
BackupPriority=100
3
Bridge Table(SW1)
Bridge Table(SW2)
IP = 80.1.1.1
IP = 80.1.1.2
net
ARP Table(#1~4)
R1
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.3
MAC: 0000.5e00.0101
2
2
GW#2
SW2
4
GARP (Gratuitous ARP) Request
MAC
Port
0000.5E00.0101
1
IP
MAC
80.1.1.3
0000.5E00.0101
MAC
Port
0000.5E00.0101
3
Gratuitous ARP Request Format
Destination MAC address
FFFF.FFFF.FFFF
Source MAC address
0000.5E00.0101
Operation (Request = 1)
Sender Ethernet address
0000.5E00.0101
Sender IP address
80.1.1.3
Target Ethernet address
0000.0000.0000
Target IP address
80.1.1.3
Ethernet
Header
ARP
Payload
Ether Type
0x0806
Simple VRRP Scenario (2)
Server#1
Server#2
Server#3Server#4
server_video
server_apps
server_da
server-web

6
Master 기능.VRRP Advertisement Packet 송싞
.Master는설정된advertisement-interval 주기(본자료에서는2초)로VRRP advertisement packet을Backup으로송싞하여,
자싞이살아있음을알린다.
Network
Master
Priority=200
Backup
Priority=100
3
Bridge Table(SW1)
Bridge Table(SW2)
IP = 80.1.1.1
IP = 80.1.1.2
net
ARP Table(#1~4)
R1
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.3
MAC: 0000.5e00.0101
2
3
GW#2
SW2
4
MAC
Port
0000.5E00.0101
1
IP
MAC
80.1.1.3
0000.5E00.0101
MAC
Port
0000.5E00.0101
3
VRRP advertisement
VRRP Advertisement Packet Format
Destination MAC address
0100.5E00.0012 (Reserved MAC)
Source MAC address
0000.5E00.0101
Ethernet
Header
Ver
4
Identification
Total Length
TOS
IHL
5
Fragment Offset
TTL
255
Header Checksum
Protocol
112 (VRRP)
Source IP address
80.1.1.3
Destination IP address
224.0.0.18 (Reserved IP)
Authentication Data
0
IP Address
80.1.1.3
Auth Type*
No
Advertisement Interval
2
Checksum
Ver
2
Virtual RID
1
Priority
200
# of IP1
Type
Advertise
Ether Type
0x0800 (IP)
IP
Header
VRRP
Payload
* Auth Type
#NAME?
#NAME?
#NAME?
If all VRRP fields are not matched,
discarded
Flag
Simple VRRP Scenario (3)
Server#1
Server#2
Server#3
Server#4
server_video
server_apps
server_da
server-web

7
정상Packet Forwarding 상태
.Server#1~4가Default Gateway 80.1.1.3으로보내는패킷은Switch의Bridge Table에의해서Master인R1으로가게된다.
Simple VRRP Scenario (4)
4
Network
Master
Priority=200
Backup
Priority=100
3
Bridge Table(SW1)
Bridge Table(SW2)
IP = 80.1.1.1
IP = 80.1.1.2
net
ARP Table(#1~4)
R1
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.3
MAC: 0000.5e00.0101
2
GW#2
SW2
4
MAC
Port
0000.5E00.0101
1
IP
MAC
80.1.1.3
0000.5E00.0101
MAC
Port
0000.5E00.0101
3
Data Packet
Server#1
Server#2
Server#3
Server#4
server_video
server_apps
server_da
server-web

8
Master(R1) Fail시Failover
Failover후Packet Forwarding
.R1에서더이상VRRP packet을보내지않으면R2는일정시간(Dead Timer.뒤에서설명) 후에R1에문제가생겼음을인지핚다
.R2가자싞이Master가되었음을알리기위해VRRP
advertisement packet과GARP packet을보내게되고, 이에따라Switch는Bridge Table을갱싞하게된다.
.Server#1~4의Default Gateway에대핚ARP Table은변경되지않은상태에서L2 Switch의Bridge Table 변경으로R2로패킷들이전달된다.
Simple VRRP Scenario (5)
5
6
Network
MasterPriority=100
3
Bridge Table(SW1)
Bridge Table(SW2)
IP = 80.1.1.1
IP = 80.1.1.2
net
ARP Table(#1~4)
R1
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.3
MAC: 0000.5e00.0101
2
GW#2
SW2
4
MAC
Port
0000.5E00.0101
2
IP
MAC
80.1.1.3
0000.5E00.0101
MAC
Port
0000.5E00.0101
4
VRRP advertisement
GARP (Gratuitous ARP) Request
.변경없음!!
Network
Master
Priority=100
3
Bridge Table(SW1)
Bridge Table(SW2)
IP = 80.1.1.1
IP = 80.1.1.2
net
ARP Table(#1~4)
R1
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.3
MAC: 0000.5e00.0101
2
GW#2
SW2
4
MAC
Port
0000.5E00.0101
2
IP
MAC
80.1.1.3
0000.5E00.0101
MAC
Port
0000.5E00.0101
4
.변경없음!!
Data Packet
Priority=200
Priority=200
Server#1
Server#2
Server#3
Server#4
server_video
server_apps
server_da
server-web
Server#1
Server#2
Server#3
Server#4
server_video
server_apps
server_da
server-web

9
Simple VRRP Scenario (6)
SW1 Fail시Failover
Failover후Packet Forwarding
.SW1의다운으로인하여, SW1과연결된모든포트가down된다.
이로인해R1의VRRP instance는disable되며,또핚Server의Active teaming interface가down상태로됨과동시에backup
interface가active 상태로된다.(점선-backup, 실선-active)
.VRRP advertisement를수싞하지못핚R2는자싞이Master가되었음을알리기위해VRRP advertisement packet과GARP
packet을보내게되고, 이에따라Switch는Bridge Table을갱싞하게된다.
.Server#1~4의Default Gateway에대핚ARP Table은변경되지않은상태에서L2 Switch의Bridge Table 변경으로R2로패킷들이전달된다.
7
8
Network
Master
Priority=100
3
Bridge Table(SW2)
IP = 80.1.1.1
IP = 80.1.1.2
net
ARP Table(#1~4)
R1
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.3
MAC: 0000.5e00.0101
2
GW#2
SW2
4
IP
MAC
80.1.1.3
0000.5E00.0101
MAC
Port
0000.5E00.0101
4
VRRP advertisement
GARP (Gratuitous ARP) Request
.변경없음!!
Network
Master
Priority=100
3
Bridge Table(SW2)
IP = 80.1.1.1
IP = 80.1.1.2
net
ARP Table(#1~4)
R1
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.3
MAC: 0000.5e00.0101
2
GW#2
SW2
4
IP
MAC
80.1.1.3
0000.5E00.0101
MAC
Port
0000.5E00.0101
4
.변경없음!!
Data Packet
Priority=200
Priority=200
Server#1
Server#2
Server#3
Server#4
server_video
server_apps
server_da
server-web
Server#1
Server#2
Server#3
Server#4
server_video
server_apps
server_da
server-web

10
VRRP 동작원리
R1Priority=200Advertisement-Interval=2sPreemption=TruePriority=100Advertisement-Interval=2sPreemption=TrueADVERTISEMENTGratuitous ARP*
Master Down
TimerSet MasterDownTimer
(Advertise Interval x 3 = 6s)
ADVERTISEMENTSet MasterDownTimer
(Advertise Interval x 3 = 6s)
“MasterDownTimer
Expired” EventADVERTISEMENTAdvertisement
TimerSet AdverTimer (2s)
Gratuitous ARP*
Advertisement
TimerMaster Down
TimerSet AdverTimer (2s)t = 0t = 2ADVERTISEMENTSet MasterDownTimer
(Advertise Interval x 3 = 6s)t = 4t = 10R1 FailureSet AdverTimer (2s)
Set AdverTimer (2s)
StartADVERTISEMENTGratuitous ARP*
…
MasterBackupMasterADVERTISEMENTBackupMasterSet MasterDownTimer
(Advertise Interval x 3 = 6s)Set AdverTimer (2s)
R2자신이Master가되었음을알림
.Master Down Interval: Backup Router에서Master가down 되었다고판단하는시간, Backup Router는이Timer 만료시자싞이Master임을주장하는Advertisement를보냄(Default: (3XAdvertisement Interval)+Skew Time
.Skew Time: Master 선정시Backup Router들이반응하는시간의변이값, Backup Router들이동시에Burst핚Advertisement를보내지않게하기위해, Router들간에반응Timing에차이를둔다. 이를Skew Time 이라고함, 이값은Priority에영향을받는데, Priority가클수록빠르게반응핚다. (skew time= 1-(priority/256))
AdverTimer
Cisco/Juniper에서는msec(20~3000) 단위로
설정가능.빠른Convergence

11
VRRP Priority & Preemption
Master
Priority=200
Backup
Priority=100
3
IP = 80.1.1.1
IP = 80.1.1.2
R1
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.3
MAC: 0000.5e00.0101
2
GW#2
SW2
4
Master
Priority=100
1
2
Network
net
3
IP = 80.1.1.2
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.3
MAC: 0000.5e00.0101
2
GW#2
SW2
4
Network
net
Priority=200
IP = 80.1.1.1
R1
Master
Priority=100
3.1
3
IP = 80.1.1.2
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.3
MAC: 0000.5e00.0101
2
GW#2
SW2
4
Network
net
Priority=200
IP = 80.1.1.1
R1
Backup
Priority=100
3.2
3
IP = 80.1.1.2
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.3
MAC: 0000.5e00.0101
2
GW#2
SW2
4
Network
net
IP = 80.1.1.1
R1
Preemption=False
Preemption=True
Master
Priority=200
1.VRRP Priority가큰R1이Master가됨(R1 priority=200, R2 priority=100)
2.R1 node fail을감지핚R2(Dead Interval동안VRRP advertisement 수싞못함)가Master가됨
3.[3.1] Preemption=False로설정되어있는경우, Priority=200인R1이다시살아나도R2가Mastership를유지하게됨
[3.2] Preemption=True로설정되어있는경우, Priority=200인R1이다시살아나면R1이Mastership을R2로부터빼앗아R1이Master가됨
Server#1
Server#2
Server#3
Server#4
server_video
server_apps
server_da
server-web
Server#1
Server#2
Server#3
Server#4server_video
server_apps
server_da
server-web
Server#1
Server#2
Server#3
Server#4
server_video
server_apps
server_da
server-web
Server#1
Server#2
Server#3
Server#4
server_video
server_apps
server_da
server-web

12
VRRP Owner
Master
Priority=255
Backup
Priority=100
3
IP = 80.1.1.1 IP = 80.1.1.2
R1
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.1
MAC: 0000.5e00.0101
2
GW#2
SW2
4
Network
net
.VRRP 구성시, 그림과같이Virtual IP 주소로R1의실제주소를사용하는경우, 이때R1을Owner라부르며, VRRP Master 선정시최우선순위(255)를가짐과동시에항상Preempt mode=true를가정함(이미설정된값무시)
.Priority=255이기때문에항상Master가되고, Preemption=True이기때문에Node down되었다가다시살아올라오면무조건Owner가다시Mastership을획득하게된다.
.Destination IP가Virtual IP인패킷에대해서(ex. Ping, Telnet, SNMP) VRRP router는응답을하지않는데, Owner인경우만예외적으로응답을하도록되어있다.
Server#1
Server#2
Server#3
Server#4server_video
server_apps
server_da
server-web

13
VRRP Terminology
VRRP Parameter 정리
.Default Router
.Owner
.Priority
.VRRP router
.Master/Backup
.Virtual Router
.Virtual Router ID (VRID)
.Preempt Mode
.Primary IP Address
.Default Router:내부에서외부network로향하는모든Server
traffic이통과하는관문(Gateway)
.Owner: Virtual IP를실제IP로소유하고있는Router, 항상Master로동작함(무조건Priority=255, Preempt=true가됨)
.Priority: Master 선정과정에사용될parameter값으로큰값이우선(0~255)
만약, Priority가동일핚경우highest primary IP우선
.100: default
.255: Owner Router를의미함(Reserved 값으로사용핛수없음)
.0: Master 선정과정에참여하지않겠다(Reserved 값으로사용핛수없음)
.Virtual Router: LAN Fail-Over 기능을수행핛VRRP Router들의모임
.Master: 현재Server들에대해default router로동작중인“Active
Router”
.Backup: 현재의Master가fail시Master 기능을수행“Standby
Router”
.Virtual Router ID(VRID): 인터페이스별로설정가능핚Virtual
Router들의인식번호(1~255)
.Preemption mode: “true” or “false” 값부여. 현재망에서동작중인Master에게서Master 권핚을뺏기위해서는Preempt가true로설정되어야함.
Priority가Master보다큰값을가져도Preempt가false라면현재의Master로부터Master 권핚을뺏지못함
.Primary IP Address: VRRP가설정된interface에여러개의Secondary IP가설정되어있을경우VRRP 동작에사용핛대표IP(벤더별구현에따라다름)
Network
Master
Priority=200
Backup
Priority=100
3
Bridge Table(SW1)
Bridge Table(SW2)
IP = 80.1.1.1 IP = 80.1.1.2
net
ARP Table(#1~4)
R1
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.3
MAC: 0000.5e00.0101
2
GW#2
SW2
4
MAC
Port
0000.5E00.0101
1
IP
MAC
80.1.1.3
0000.5E00.0101
MAC
Port
0000.5E00.0101
3
Data Packet
Server#1
Server#2
Server#3
Server#4server_video
server_apps
server_da
server-web

14
No Load-Sharing
Load-Sharing
.R1이정상동작하는핚R2는사용되지않는상태로있음
.Resource 낭비초래
.Backup Router를활용해Load를분산시킴
1) 두개의Virtual Router를설정(VRID=1, VRID=2)
2) VRID=1에대해서는R1을Master로VRID=2에대해서는R2를
Master로설정
.Server#1/2는Default Router로R1을사용, Server#3/4는R2사용
.이때, R1(or R2) fail시Backup Router가해당Virtual Router에
대해Master로동작함
VRRP 운용방식
Network
Master
Priority=200
Backup
Priority=100
3
Bridge Table(SW1)
Bridge Table(SW2)
IP = 80.1.1.1
IP = 80.1.1.2
net
ARP Table(#1~4)
R1
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.3
MAC: 0000.5e00.0101
2
GW#2
SW2
4
MAC
Port
0000.5E00.0101
1
IP
MAC
80.1.1.3
0000.5E00.0101
MAC
Port
0000.5E00.0101
3
Data Packet
Network
Master for VRID=1Backup for VRID=2
3
Bridge Table(SW1)
Bridge Table(SW2)
IP = 80.1.1.1
IP = 80.1.1.2
net
R1
R2
1
SW1
VRRP VRID=1
IP: 80.1.1.3
MAC: 0000.5e00.0101
2
GW#2
SW2
4
Data Packet
ARP Table(#1/#2)ARP Table(#3/#4)
IP
MAC
80.1.1.3
0000.5E00.0101
IP
MAC
80.1.1.4
0000.5E00.0102
MAC
Port
0000.5E00.0101
1
0000.5E00.0102
2
MAC
Port
0000.5E00.0102
4
0000.5E00.0101
3
VRRP VRID=2
IP: 80.1.1.4
MAC: 0000.5e00.0102
Master for VRID=2
Backup for VRID=1
Server#1
Server#2
Server#3
Server#4server_video
server_apps
server_da
server-web
Server#1
Server#2
Server#3
Server#4server_video
server_apps
server_da
server-web

15
Weak-Point of VRRP
Object Tracking
.그림과같이, VRRP는Local LAN 상에서동작핚다. 즉, WAN 연결지점인A에서의Link fail 시Fail-Over 기능에대핚언급은표준에없다
.Cisco/Juniper의Object Tracking 기능은Link Up/Down 외에도Routing 경로의변화도추적하여VRRP 설정에반영핛수있다
.Object Tracking: A 구간의link fail과같은Not-VRRP interface
구간의link down시priority를감소시켜서Backup Router가Master 권핚을가지도록하는개념
.반대로down된Link가Up이될때는감소된분만큼priority를증가시킴(이때, 감소분을“decrement”(Cisco)라고함)
VRRP Object Tracking
VRRP
Network
GW#2
1
2
3
net
R1
R2
SW1
4
SW2
Non-VRRP Interface가down됨
IGP (OSPF, IS-IS)
convergence 후우회경로인R2를통해패킷전달
A
Master
Priority=200
Backup
Priority=100
VRRP
Network
GW#2
1
2
3
net
R1
R2
SW1
4
SW2
A
Backup
Priority=99
Master
Priority=100
delta=101일경우,
핚번의link down시
R1의priority는99로(200-101)
R2의100보다작아짐으로R2에게
Master 권핚을넘겨준다.
Server#1
Server#2Server#3
Server#4
server_video
server_apps
server_da
server-web
Server#1
Server#2
Server#3
Server#4
server_video
server_apps
server_da
server-web

16
VRRP Delay
.R1이Down 된후R2가Master 역핛을하고있었다.
.잠시후R1이되살아났을때, R1 Interface 상태를바로UP 시키지않고일정시간Delay를주는것이바람직하다(우측그림의Delay=70초).
.즉, IGP Protocol이Convergence가완료되어서패킷을보낼준비가될때까지Interface Up event를지연시킨다.
VRRP Delay 설정
VRRP
Network
GW#2
1
2
3net
R1
R2
SW1
4
SW2
A
Backup
Priority=200
Master
Priority=100
VRRP
Network
GW#2
1
2
3
net
R1
R2
SW1
4
SW2
A
Backup
Priority=200
Master
Priority=100
Delay = 70s
Server#1
Server#2
Server#3
Server#4server_video
server_apps
server_da
server-web
Server#1
Server#2
Server#3
Server#4
server_video
server_apps
server_da
server-web

17
References
.AyikudySrikanth, AdnmaAdomOnart. VRRP(Increasing Reliability and Failover with the Virtual
Router Redundancy Protocol). Addison Wesley, 2002
.S. Knight, D. Weaver, D. Whipple, R. Hinden, D. Mitzel, P. Hunt, P. Higginson, M. Shand, A.
Lindem. Virtual Router Redundancy Protocol. RFC 2338(Proposed status), 1998
.R. Hinden, Ed. Virtual Router Redundancy Protocol (VRRP). RFC 3768 (Obsoletes RFC 2338, DRAFT
status), 2004
.Li, B. Cole, P. Morton, D. Li. Cisco Hot Standby Router Protocol (HSRP). RFC 2281(Informal
status), 1998
.IPinfusionTM. ZebOSVRRPCmdRef, ZebOSVRRPDevGdeVer7.1, 2004
.Samsung Electronics Co. VRRP 설정방안PPT, 2006
.윤종호, 라우터와라우팅프로토콜. 교학사, 2002
.http://www.cisco.com
.http://www.juniper.net

18
End of Document