Virtual Router Redundancy Protocol (VRRP)
obsoleted by
- rfc-5798 — Virtual Router Redundancy Protocol (VRRP) Version 3 for IPv4 and IPv6
obsoletes
- rfc-2338 — Virtual Router Redundancy Protocol
Extracted elements (26)
Authentication was removed from RFC 3768 (present in RFC 2338) because operational experience showed the defined methods (plain-text and IPSEC-based) did not prevent the most disruptive attack: a hostile router behaving as Master. The VRRP fields for authentication are retained as reserved to preserve wire-level backwards compatibility with RFC 2338.
The protocol is optimized for two-router topologies with distinct path preferences (the common case), resulting in minimal runtime state, a single message type, and a single sender. When more than two equal-priority routers exist, brief duplicate forwarding during Master election is an accepted trade-off for protocol simplicity.
The virtual router MAC address is used as the source MAC in all periodic Master advertisements so that learning bridges in extended LANs correctly learn the LAN segment the virtual router is on, preventing flooding of all packets sent to the virtual router.
On FDDI, implementations SHOULD configure the virtual router MAC by adding a unicast MAC filter rather than changing the hardware MAC address. Changing the hardware address would cause a Master to strip other Masters' ADVERTISEMENT frames from the ring during convergence, causing convergence failure.
VRRP over token ring MUST use token ring functional addresses as the virtual MAC (mapped from VRID: VRID 1 → 03-00-02-00-00-00, with octets 3–4 = 0x4000 >> (VRID−1) in non-canonical format). Functional addresses cannot be used as MAC source addresses, so the real MAC is used as the source in advertisements.
A VRRP router SHOULD NOT forward packets addressed to the virtual IP addresses it has adopted as Master if it is not the owner, to avoid unnecessary traffic and potential forwarding loops on LANs (e.g., token ring) that receive their own transmitted packets.
On receipt, a VRRP router MUST verify IP TTL=255, VRRP version=2, packet completeness, checksum, VRID configuration, and that Auth Type matches local configuration; any failure MUST cause the packet to be discarded.
On Shutdown from Master state, the router MUST cancel the Adver_Timer and send an ADVERTISEMENT with Priority=0 to trigger rapid Backup promotion before transitioning to Initialize.
The Advertisement Interval in a received packet MUST match the locally configured value for the virtual router; a mismatch MUST cause the packet to be discarded, and the event SHOULD be logged.
The IP TTL MUST be set to 255 on transmission. A VRRP router receiving a packet with TTL not equal to 255 MUST discard the packet.
The priority value for the VRRP router that owns the IP address(es) associated with the virtual router MUST be 255 (decimal). This router always preempts regardless of the Preempt_Mode setting.
VRRP packets MUST be sent to the IANA-assigned IPv4 multicast address 224.0.0.18 (link-local scope). Routers MUST NOT forward datagrams with this destination address regardless of TTL.
When responding to ARP requests for virtual router IP addresses, the Master MUST reply with the virtual MAC address and MUST NOT reply with its physical MAC address, so clients always use a consistent MAC regardless of which router is currently Master.
When transmitting VRRP packets, the source MAC address MUST be set to the virtual router MAC address so that learning bridges correctly determine the LAN segment the virtual router is attached to.
While in Backup state, a VRRP router MUST NOT respond to ARP requests for the virtual router IP addresses, MUST discard packets destined to the virtual router MAC address, and MUST NOT accept packets addressed to the virtual router IP addresses.
While in Master state, the router MUST respond to ARP requests for the virtual router IP addresses, MUST forward packets with the virtual router MAC as destination, MUST NOT accept packets addressed to the virtual router IPs if it is not the IP address owner, and MUST accept them if it is the owner.
Skew_Time is calculated as (256 − Priority) / 256 seconds; Master_Down_Interval is (3 × Advertisement_Interval) + Skew_Time. These derived timers ensure higher-priority backups assume Master faster than lower-priority ones.
The Authentication Type field is an 8-bit integer scoped per virtual router. Values 1 and 2 are reserved for backwards compatibility with RFC 2338; only value 0 (No Authentication) is currently active. The Authentication Data fields SHOULD be set to zero and ignored on reception.
The only defined VRRP packet type is ADVERTISEMENT (type=1). The version field for this specification is 2. Packets with unknown type or unknown authentication type MUST be discarded.
The Priority field is an 8-bit unsigned integer. Priority 255 is reserved for the IP address owner; values 1–254 are used by backup routers (default 100); priority 0 signals the current Master is releasing responsibility, triggering rapid Backup-to-Master transition.
The virtual router MAC address format is 00-00-5E-00-01-{VRID} in IEEE 802 48-bit format (internet standard bit-order), where the first three octets are the IANA OUI, 00-01 designates the VRRP block, and VRID (1–255) identifies the virtual router.
IANA maintains the VRRP IP protocol number (112 decimal) and the VRRP multicast address (224.0.0.18). The virtual router MAC OUI block 00-00-5E-00-01-xx (256 addresses) is allocated by IANA for VRRP virtual router MAC addresses.
The TTL=255 mechanism (set on send, verified on receive) protects against VRRP packets injected from remote networks, limiting most vulnerabilities to local LAN attacks. Attacks by local nodes (ARP spoofing, MAC spoofing, redirects) are possible independently of VRRP and are not made worse by it.
VRRP includes no authentication in this version. Prior authentication types were removed because operational experience showed they did not provide real security: even with cryptographic protection of VRRP messages, a hostile router can still behave as a Master, creating multiple masters and causing the same disruption as having no routers.
VRRP defines three states per virtual router instance: Initialize (awaits Startup event), Backup (monitors Master availability via Master_Down_Timer), and Master (forwards packets and sends periodic ADVERTISEMENTs). Transitions: Initialize→Master or Initialize→Backup on Startup; Backup→Master when Master_Down_Timer fires; Master→Backup when higher-priority ADVERTISEMENT received; either active state→Initialize on Shutdown.
The VRRP packet consists of a fixed header followed by variable IP addresses and authentication data: 4-bit Version, 4-bit Type, 8-bit VRID, 8-bit Priority, 8-bit Count IP Addrs, 8-bit Auth Type, 8-bit Adver Int, 16-bit Checksum, then n×32-bit IP addresses, and two 32-bit Authentication Data words.