Virtual Router Redundancy Protocol
obsoleted by
- rfc-3768 — Virtual Router Redundancy Protocol (VRRP)
Extracted elements (30)
Authentication types are encoded in the packet header in a way that allows new authentication types to be defined without altering the fixed portion of the protocol packet, preserving backward-compatible operation for future extensibility.
Only the Master sends periodic ADVERTISEMENT messages to minimize steady-state bandwidth overhead. A Backup will not preempt unless it has strictly higher priority, eliminating service disruption unless a more preferred path becomes available. Preemption can also be administratively disabled entirely, except that the IP address owner always preempts.
The virtual router MAC address is used as the source address in all Master-originated VRRP packets so that learning bridges in extended LANs can correctly locate the virtual router on its LAN segment and avoid flooding. The Master sends gratuitous ARPs on state transition for the same reason.
Token ring VRID-to-functional-address allocation begins with the largest functional address (03-00-02-00-00-00 for VRID 1) because most non-IP protocols use the first user-defined functional addresses, reducing the likelihood of conflicts with protocols such as Novell IPX which uses 03-00-00-10-00-00.
VRRP is optimized for the typical case of two redundant routers and/or distinct path preferences. When more than two equal-priority routers exist, duplicate packets may be forwarded briefly during Master election, a known and accepted side effect. The expected convergence time is much less than 1 second, making this tradeoff acceptable.
On FDDI, an implementation SHOULD configure the virtual router MAC address by adding a unicast MAC filter rather than changing the hardware MAC address, because FDDI interfaces remove frames with a source MAC matching the device's own hardware address, which would cause Masters to strip each other's ADVERTISEMENTs and prevent convergence.
On token ring in unicast mode, hosts that keep source-route information in the ARP cache and do not listen to gratuitous ARPs will fail to update routing information after a Master switchover if VRID routers are on different source-route bridge segments. The only solution is to co-locate all same-VRID routers on one bridge segment.
A packet with an unknown authentication type or one that does not match the locally configured authentication method MUST be discarded. Authentication type is unique on a per-interface basis.
A VRRP packet with an unknown Type field MUST be discarded. This document defines only Type 1 (ADVERTISEMENT).
If Proxy ARP is used on a VRRP router, the virtual router MAC address MUST be advertised in the Proxy ARP message, not the real MAC address, to prevent hosts from learning the physical router's address.
On receiving a VRRP packet, the router MUST verify: IP TTL=255, VRRP version, packet length ≥ VRRP header, VRRP checksum, authentication, valid VRID, and that Adver Interval matches local configuration. Failure of any check MUST result in discarding the packet.
On token ring, the functional address mode of operation MUST be implemented by routers supporting VRRP. VRID 1 maps to 03-00-02-00-00-00, with subsequent VRIDs mapping via (0x4000 >> (VRID-1)) in non-canonical format.
The IP TTL MUST be set to 255 on transmission. A VRRP router receiving a packet with TTL not equal to 255 MUST discard the packet. This mechanism protects against VRRP packets injected from remote networks.
The Master MUST respond to ARP requests for virtual router IP addresses with the virtual MAC address, and MUST NOT respond with its physical MAC address. This ensures clients always cache the same MAC regardless of which physical router is currently Master.
The priority value for the VRRP router that owns the IP address(es) associated with the virtual router MUST be 255. VRRP routers backing up a virtual router MUST use priority values between 1–254.
When transmitting, the source MAC address MUST be set to the Virtual Router MAC Address to ensure learning bridges correctly locate the virtual router's LAN segment. VRRP packets are sent to the VRRP IP multicast group 224.0.0.18.
While in the Backup state, a VRRP router MUST NOT respond to ARP requests for virtual router IP addresses, MUST discard packets destined to the virtual router MAC address, and MUST NOT accept packets addressed to virtual router IPs.
While in the Master state, a VRRP router MUST respond to ARP requests for virtual router IPs with the virtual MAC address, MUST forward packets to the virtual router MAC address, and MUST NOT accept packets to virtual router IPs unless it is the IP address owner.
Master_Down_Interval is calculated as (3 × Advertisement_Interval) + Skew_Time, where Skew_Time = (256 − Priority) / 256 seconds. This skew staggers Backup transitions based on priority to ensure the highest-priority Backup wins.
The Authentication Data field occupies two 32-bit words (8 bytes). For simple text password it carries the password zero-padded to 8 bytes; for No Authentication and IP AH modes it is set to zero on transmission and ignored on reception.
The Priority field is an 8-bit unsigned integer where higher values indicate higher priority. Priority 255 is reserved for the IP address owner, priority 0 signals the Master is releasing responsibility, and values 1–254 are used by backup routers (default 100).
The virtual router MAC address format is 00-00-5E-00-01-{VRID} in IEEE 802 48-bit format (internet standard bit-order), derived from the IANA OUI. This allows up to 255 virtual routers per network.
Three authentication types are defined: 0 (No Authentication), 1 (Simple Text Password — up to 8 bytes cleartext in Authentication Data fields), and 2 (IP Authentication Header using HMAC-MD5-96).
VRRP is assigned IP protocol number 112 (decimal) by IANA. All VRRP packets are encapsulated directly in IP using this protocol number.
VRRP packets are sent to the IANA-assigned IPv4 multicast address 224.0.0.18, a link-local scope address. Routers MUST NOT forward datagrams with this destination regardless of TTL.
Even with VRRP IP Authentication Header protection, other shared-media attacks (e.g., bogus ARP replies) are independent of VRRP and are not protected by any VRRP authentication mechanism.
No Authentication (type 0) SHOULD only be used in environments with minimal security risk. Simple Text Password (type 1) protects only against accidental misconfiguration; since the password is sent in cleartext frequently, it MUST NOT be reused as a security-significant credential. IP Authentication Header (type 2) with HMAC-MD5-96 is RECOMMENDED when there is limited control over LAN node administration.
The TTL=255 mechanism (set on send, checked on receive) provides protection against VRRP packets injected from remote networks, limiting most vulnerabilities to local attacks, regardless of which authentication type is chosen.
VRRP defines three states: Initialize (wait for Startup event), Backup (monitor Master availability via Master_Down_Timer), and Master (forward packets and send periodic ADVERTISEMENTs). Startup from Initialize leads to Master if Priority=255, else to Backup; Master_Down_Timer expiry in Backup triggers transition to Master; higher-priority ADVERTISEMENT received in Master triggers transition to Backup.
VRRP packet layout: 4-bit Version, 4-bit Type, 8-bit Virtual Rtr ID, 8-bit Priority, 8-bit Count IP Addrs, 8-bit Auth Type, 8-bit Adver Int, 16-bit Checksum, followed by n×32-bit IP Address fields and two 32-bit Authentication Data words. Total fixed header is 8 octets plus variable IP address list plus 8 octets of authentication data.