Definitions of Managed Objects for the Virtual Router Redundancy Protocol
obsoleted by
- rfc-6527 — Definitions of Managed Objects for Virtual Router Redundancy Protocol Version 3 (VRRPv3)
Extracted elements (28)
The MIB uses ifIndex as a table index because a router can participate in VRRP on one or more physical interfaces. This leverages the existing IF-MIB (RFC 2233) structure rather than introducing a separate interface identification scheme.
The MIB uses IPv4-specific SYNTAX for IP addresses because VRRP (RFC 2338) is intended for use with IPv4 routers only. The document explicitly notes that changes will be required for IPv6 interoperability.
The VRRP MIB table structure is designed assuming that management applications will display information on a per-virtual-router basis. Conceptual rows are grouped to present individual virtual router views with a minimal number of SNMP operations.
The MIB module is compliant with SMIv2 and semantically identical to SMIv1 definitions. Translation to SMIv1 is possible except where Counter64 objects are used (which have no SMIv1 equivalent) and some machine-readable SMIv2 information becomes textual descriptions.
A newly created vrrpOperTable row cannot be made active until at minimum vrrpOperVrId has been set and at least one active row exists in vrrpAssoIpAddrTable defining an associated IP address for the virtual router.
Rows in vrrpOperTable and vrrpAssoIpAddrTable cannot be modified unless vrrpOperAdminState is 'disabled' and vrrpOperState has transitioned to 'initialize'. This ensures configuration changes only occur when the virtual router is inactive.
The compliance statement restricts write access to vrrpOperPriority to values 1..255 (WRITE-SYNTAX Integer32 (1..255)), preventing management applications from setting the reserved priority-0 value via SNMP SET.
vrrpOperAdminState must be set to 'down' prior to modifying other read-create objects in the vrrpOperEntry conceptual row. The vrrpOperRowStatus must be 'active' before vrrpOperAdminState can be set to 'up'.
The VrId TEXTUAL-CONVENTION is an Integer32 (1..255) that, combined with ifIndex, uniquely identifies a virtual router instance on a VRRP router. A set of one or more associated IP addresses is assigned to each VRID.
The VRRP MIB (OID mib-2 68) is organized into three conformance groups: vrrpOperations (configuration and control), vrrpStatistics (monitoring counters), and vrrpConformance (compliance statements). Tables include vrrpOperTable, vrrpAssoIpAddrTable, and vrrpRouterStatsTable.
The vrrpOperTable contains operational characteristics of virtual routers, indexed by { ifIndex, vrrpOperVrId }. Each row represents one virtual router instance and includes state, priority, authentication, advertisement interval, and preemption configuration.
Three router-wide error counters track global VRRP packet reception errors: vrrpRouterChecksumErrors (invalid checksum), vrrpRouterVersionErrors (unknown/unsupported version), and vrrpRouterVrIdErrors (invalid VRID). These are Counter32 objects not scoped to a particular virtual router.
vrrpAssoIpAddrTable is indexed by { ifIndex, vrrpOperVrId, vrrpAssoIpAddr } and holds the set of IP addresses that a virtual router is responsible for backing up. Row count equals vrrpOperIpAddrCount. Rows cannot be modified when the virtual router is active.
vrrpNotificationCntl (read-write, default enabled) globally enables or disables SNMP trap generation for all VRRP events defined in the MIB. Setting it to disabled prevents any VRRP traps from being sent.
vrrpOperAdvertisementInterval specifies the interval in seconds (1..255) between VRRP advertisement messages; only the master router sends advertisements. Default is 1 second.
vrrpOperAuthKey is an OCTET STRING (SIZE 0..16) holding the authentication key for simpleTextPassword or ipAuthenticationHeader modes. If the value is shorter than 16 octets, the agent left-adjusts and zero-fills. When read, this object always returns an Octet String of length zero (key is write-only for security).
vrrpOperAuthType specifies the authentication method for VRRP protocol exchanges: noAuthentication(1), simpleTextPassword(2), or ipAuthenticationHeader(3). The value must be the same for all virtual routers sharing a given ifIndex. New enumerations require a standards-track RFC.
vrrpOperPreemptMode (TruthValue, default true) controls whether a higher-priority virtual router will preempt a lower-priority master. vrrpOperVirtualRouterUpTime records the sysUpTime value when the virtual router last transitioned out of the initialize state.
vrrpOperPrimaryIpAddr specifies which of a multi-address interface's IP addresses becomes vrrpOperMasterIpAddr upon backup-to-master transition. If set to 0.0.0.0 (default), the numerically lowest IP address is selected.
vrrpOperPriority is an Integer32 (0..255) used in the master election process; higher values mean higher priority. Priority 255 denotes the IP address owner; priority 0 (not settable via SNMP, sent by master) signals cessation of VRRP participation and triggers backup-to-master transition. Default is 100.
vrrpOperProtocol identifies the protocol being controlled by the virtual router: ip(1), bridge(2), decnet(3), or other(4). Default is ip(1). New enumerations require a standards-track RFC.
vrrpOperVirtualMacAddr (read-only MacAddress) exposes the virtual router's virtual MAC address, which is derivable from the VRID per the VRRP specification. It is included as a MIB object for easy retrieval by management applications and for inclusion in SNMP traps.
vrrpRouterStatsTable (augmenting vrrpOperEntry) provides per-virtual-router counters including: vrrpStatsBecomeMaster, vrrpStatsAdvertiseRcvd, vrrpStatsAdvertiseIntervalErrors, vrrpStatsAuthFailures, vrrpStatsIpTtlErrors, vrrpStatsPriorityZeroPktsRcvd/Sent, vrrpStatsInvalidTypePktsRcvd, vrrpStatsAddressListErrors, vrrpStatsInvalidAuthType, vrrpStatsAuthTypeMismatch, and vrrpStatsPacketLengthErrors.
vrrpTrapNewMaster NOTIFICATION-TYPE carries vrrpOperMasterIpAddr and is sent when the agent transitions to Master state. vrrpTrapAuthFailure carries vrrpTrapPacketSrc and vrrpTrapAuthErrorType (invalidAuthType, authTypeMismatch, or authFailure); implementation of this trap is optional.
The VRRP MIB is assigned OID { mib-2 68 }, registering the vrrpMIB MODULE-IDENTITY under the standard MIB-2 subtree as published in RFC 2787.
Several read-create objects in vrrpOperTable can critically affect VRRP operation if manipulated without authorization: vrrpOperAdminState can disable a virtual router; vrrpOperPrimaryIpAddr can assign an invalid IP to a master; authentication type/key objects can render VRRP security mechanisms ineffective. Disabling vrrpNotificationCntl nullifies auth-failure trap reporting.
SNMPv1 alone is not a secure environment. Even on an IPsec-protected network, SNMPv1 provides no access control over who may GET or SET MIB objects. Implementers are recommended to use SNMPv3 with the User-based Security Model (RFC 2574) and View-based Access Control Model (RFC 2575).
vrrpOperState has three values: initialize (waiting for startup event), backup (monitoring master availability), and master (forwarding packets for associated IP addresses). Transitions are triggered by setting vrrpOperAdminState to 'up' (initialize→backup or master) or 'down' (master or backup→initialize).