Virtual Router Redundancy Protocol (VRRP) Version 3 for IPv4 and IPv6
obsoleted by
- rfc-9568 — Virtual Router Redundancy Protocol (VRRP) Version 3 for IPv4 and IPv6
obsoletes
- rfc-3768 — Virtual Router Redundancy Protocol (VRRP)
Extracted elements (29)
Authentication was deliberately removed from VRRPv3. Even cryptographically authenticated VRRP could not prevent a hostile node from behaving as a Master; multiple Masters are as disruptive as no routers. Additionally, misconfigured shared secrets in VRRPv2 caused spurious multiple-Master elections.
IPv4 and IPv6 virtual router instances are independent domains within a VRRP router; the same VRID number may be reused for both address families on the same LAN because they are treated as two separate virtual routers. This avoids cross-family interference.
The virtual router MAC address is used as the source MAC in all VRRP messages and ARP/ND responses so that learning bridges correctly track which segment the virtual router is on. Using the physical MAC would result in bridge flooding for all traffic destined to the virtual router.
VRRPv3 was extended to support IPv6 because standard IPv6 Neighbor Discovery unreachability detection takes approximately 38 seconds with default parameters before switching to an alternate router. VRRP provides failover in approximately 3 seconds without host involvement.
VRRPv3 and VRRPv2 interoperation is optional and intended only for upgrade transition scenarios. Mixing versions should not be a permanent deployment. VRRPv2 Masters advertise intervals in seconds while VRRPv3 uses centiseconds, requiring conversion. Sub-second VRRPv3 rates may overwhelm VRRPv2 Backup routers.
A Backup router receiving an ADVERTISEMENT with Priority=0 from the Master MUST set its Master_Down_Timer to Skew_Time only (instead of Master_Down_Interval) to accelerate its transition to Master.
A VRRP packet with an unknown Type field MUST be discarded.
For IPv4, the TTL MUST be set to 255. A VRRP router receiving a packet with the TTL not equal to 255 MUST discard the packet.
For IPv6, the Hop Limit MUST be set to 255. A VRRP router receiving a packet with the Hop Limit not equal to 255 MUST discard the packet.
IPv4 addresses and IPv6 addresses MUST NOT both be carried in one IPvX Address field; a single VRRP message carries either IPv4 or IPv6 addresses, not both.
IPv6 routers running VRRP MUST create their Interface Identifiers in the normal manner and MUST NOT use the virtual router MAC address to create EUI-64 identifiers.
On packet reception, the receiver MUST verify: TTL/Hop Limit = 255, VRRP version = 3, packet completeness, VRRP checksum, and that the VRID is configured on the interface. Any check failure MUST cause the packet to be discarded.
Routers MUST NOT forward a datagram destined to the VRRP IPv4 multicast address 224.0.0.18 regardless of its TTL, and likewise MUST NOT forward datagrams to the IPv6 VRRP multicast address FF02:0:0:0:0:0:0:12.
The Virtual Router Master MUST respond to ARP requests (IPv4) or ND Neighbor Solicitation messages (IPv6) with the virtual MAC address, and MUST NOT use its physical MAC address in these responses.
The VRRP checksum is the 16-bit one's complement of the one's complement sum of the entire VRRP message plus the IPv6-style pseudo-header (RFC 2460 Section 8.1) with Next Header set to 112.
Upon shutdown, the Master MUST send an ADVERTISEMENT with Priority=0 before transitioning to Initialize, allowing Backup routers to quickly assume Master role without waiting for the Master_Down_Timer to expire.
When configured for VRRPv2 compatibility and acting as Master, a VRRPv3 router MUST send both VRRPv2 and VRRPv3 advertisements at the configured rate, even if sub-second.
While in the Backup state, a router MUST NOT respond to ARP requests (IPv4) or ND Neighbor Solicitations (IPv6) for virtual router addresses, MUST NOT send ND Router Advertisements, and MUST discard packets with a destination link-layer MAC equal to the virtual router MAC address.
Accept_Mode controls whether a Master router (that is not the address owner) accepts packets addressed to the address owner's IPvX address. Default is False. When False, IPv6 Neighbor Solicitations and Neighbor Advertisements MUST NOT be dropped.
Max Adver Int is a 12-bit field indicating the time interval between ADVERTISEMENTS in centiseconds; default is 100 centiseconds (1 second). Sub-second intervals are supported and enable rapid failover.
Skew_Time is computed as ((256 − priority) × Master_Adver_Interval) / 256 centiseconds. Master_Down_Interval is (3 × Master_Adver_Interval) + Skew_Time, ensuring higher-priority Backups time out sooner and win elections.
The Priority field (8-bit unsigned integer) specifies the VRRP router's election priority. Value 255 is reserved for the IPvX address owner; values 1–254 are for Backup routers (default 100); value 0 signals that the current Master is releasing responsibility, triggering rapid Backup-to-Master transition.
The virtual router MAC address for IPv4 is 00-00-5E-00-01-{VRID} and for IPv6 is 00-00-5E-00-02-{VRID} in Internet-standard bit-order. This mapping provides for up to 255 VRRP routers per address family on a network.
IANA assigned IPv6 link-local scope multicast address FF02:0:0:0:0:0:0:12 for VRRP, and reserved the IEEE 802 MAC address block 00-00-5E-00-02-00 through 00-00-5E-00-02-FF for VRRP for IPv6. The IPv4 MAC block 00-00-5E-00-01-00 through 00-00-5E-00-01-FF and IPv4 multicast address 224.0.0.18 were previously assigned.
The TTL/Hop Limit = 255 mechanism protects against VRRP packets being injected from remote networks, restricting most attack vectors to locally attached nodes. VRRP itself does not add new attack vectors beyond what any LAN-attached node can do via ARP/ND spoofing.
VRRP provides no confidentiality, which is acceptable since VRRP messages contain no information requiring secrecy. For IPv6 deployments, VRRP is compatible with SEND 'trust anchor' and 'trust anchor or cga' modes, requiring Master and Backup to share the same prefix delegation in certificates.
VRRPv3 includes no authentication. Authentication was present in earlier versions but removed because it could not prevent hostile nodes from acting as a VRRP Master and creating multiple Masters, which is as disruptive as having no Master. The TTL=255 check limits attacks to local network nodes.
VRRP defines three states per virtual router: Initialize (awaiting Startup event), Backup (monitoring Master availability via Master_Down_Timer), and Master (forwarding packets and sending periodic ADVERTISEMENTs). The IP address owner transitions Initialize→Master immediately; others go Initialize→Backup. Master_Down_Timer expiry triggers Backup→Master.
The VRRP packet header contains: Version (4 bits), Type (4 bits), Virtual Rtr ID (8 bits), Priority (8 bits), Count IPvX Addr (8 bits), Rsvd (4 bits), Max Adver Int (12 bits), Checksum (16 bits), followed by one or more IPvX addresses. The packet is encapsulated in IPv4 or IPv6 with protocol/Next Header 112.