A YANG Data Model for the Virtual Router Redundancy Protocol (VRRP)
Extracted elements (27)
The model conforms to the Network Management Datastore Architecture (NMDA, RFC 8342), combining operational state with configuration in the same hierarchy rather than separating them into distinct trees, per YANG-Guidelines recommendations.
The YANG module augments ietf-interfaces (RFC 8343) and ietf-ip (RFC 8344) rather than defining a standalone model, so VRRP configuration is co-located with interface and IP address data, reflecting the natural per-interface, per-address-family instantiation of VRRP.
VRRPv2 (RFC 3768) supports only IPv4, while VRRPv3 (RFC 5798) supports both IPv4 and IPv6. The YANG model enforces this by constraining the IPv6 vrrp-instance list to version vrrp-v3 and providing a version-specific advertise-interval choice for IPv4.
IPv6 Neighbor Solicitations and Neighbor Advertisements MUST NOT be dropped when accept-mode is 'false', ensuring IPv6 neighbor discovery continues regardless of accept-mode configuration.
IPv6 VRRP instances must use version 3. The YANG module enforces this with a 'must derived-from-or-self(version, vrrp-v3)' constraint on the IPv6 vrrp-instance list.
Each vrrp-instance includes a mandatory 'version' leaf (identityref base vrrp-version) selecting either vrrp-v2 or vrrp-v3. IPv6 instances MUST use vrrp-v3; a YANG 'must' constraint enforces this.
For VRRPv2 IPv4, the advertisement interval is configured as 'advertise-interval-sec' (uint8, range 1..254, units seconds, default 1). For VRRPv3, it is 'advertise-interval-centi-sec' (uint16, range 1..4095, units centiseconds, default 100).
Global error identities (base vrrp-error-global) cover: checksum-error, ip-ttl-error, version-error, and vrid-error — errors occurring before a packet reaches a VRRP instance. Per-router error identities (base vrrp-error-virtual-router) cover: address-list-error, interval-error, and packet-length-error.
Global-level VRRP state (config false container 'vrrp') exposes virtual-routers count, interfaces count, and global statistics: checksum-errors, version-errors, vrid-errors, and ip-ttl-errors (all counter64).
Per-instance operational state includes: 'is-owner' (boolean), 'last-adv-source' (inet:ip-address), 'up-datetime' (date-and-time since leaving init), 'master-down-interval' (uint32, centiseconds), 'skew-time' (uint32, microseconds), 'last-event' (identityref), and 'new-master-reason'.
Per-instance statistics include master-transitions (counter32), advertisement-rcvd/sent (counter64), interval-errors (conditional on feature validate-interval-errors), priority-zero-pkts-rcvd/sent, invalid-type-pkts-rcvd, address-list-errors (conditional on feature validate-address-list-errors), and packet-length-errors.
The 'accept-mode' leaf (boolean, default false, VRRPv3 only) controls whether a master virtual router accepts packets addressed to the address owner's IP address when it is not the owner. IPv6 Neighbor Solicitations and Advertisements MUST NOT be dropped even when accept-mode is false.
The 'new-master-reason-type' typedef enumerates four values: 'not-master' (never transitioned), 'priority' (higher priority), 'preempted' (master was preempted), and 'no-response' (previous master timed out).
The 'preempt' container includes an 'enabled' boolean (default true) and a 'hold-time' in seconds (uint16, default 0), allowing a higher-priority backup to wait before preempting a lower-priority master.
The 'priority' leaf (uint8, range 1..254, default 100) configures the VRRP election priority for the backup virtual router. Priority 0 is reserved for signaling master resignation.
The 'track' container allows a VRRP instance to monitor interfaces and network prefixes. When a tracked interface goes down, the VRRP router's priority decrements by 'priority-decrement' (uint8, range 1..254, default 10); it increments by the same amount when the interface recovers.
The YANG module 'ietf-vrrp' augments the ietf-interfaces and ietf-ip models to add VRRP configuration and state under each interface, keyed by VRID (uint8, range 1..255), for both IPv4 and IPv6 address families.
Three notifications are defined: 'vrrp-new-master-event' (master-ip-address, new-master-reason), 'vrrp-protocol-error-event' (protocol-error-reason as vrrp-error-global identityref), and 'vrrp-virtual-router-error-event' (interface, ip-version choice, virtual-router-error-reason).
Two optional YANG features are defined: 'validate-interval-errors' (system validates advertisement interval matches local config) and 'validate-address-list-errors' (system validates received address list matches local config); these gate corresponding statistics counters.
Virtual IPv4 addresses are configured as a list under 'virtual-ipv4-addresses' with a maximum of 16 entries (max-elements 16). For an owner router, the virtual address must match one of the real IPv4 addresses on the interface.
Virtual IPv6 addresses allow a maximum of 2 entries (max-elements 2). The first address must be a link-local address; the second may be link-local or global.
VRRP event identities (base vrrp-event-type) include: startup, shutdown, higher-priority-backup, master-timeout, interface-up, interface-down, no-primary-ip-address, primary-ip-address, no-virtual-ip-addresses, virtual-ip-addresses, preempt-hold-timeout, lower-priority-master, and owner-preempt.
This document registers the XML namespace URI 'urn:ietf:params:xml:ns:yang:ietf-vrrp' in the IETF XML Registry (RFC 3688) and registers the YANG module name 'ietf-vrrp' with prefix 'vrrp' in the YANG Module Names registry (RFC 7950).
Read access to the global '/ietf-vrrp:vrrp' container and per-interface vrrp-instance subtrees must be controlled, as unauthorized access can disclose VRRP operational state information about the device.
The YANG module must be accessed via NETCONF over SSH or RESTCONF over HTTPS (mandatory-to-implement transports), with access control enforced by the NETCONF access control model (RFC 8341) to restrict unauthorized read or write access.
Write access to the vrrp-instance subtrees under IPv4 and IPv6 interfaces without proper protection can adversely affect the routing subsystem, potentially causing network malfunctions or packet delivery to inappropriate destinations.
The VRRP state machine defines three states — 'initialize' (waiting for startup event), 'backup' (monitoring master availability), and 'master' (forwarding packets for virtual IP addresses) — exposed as read-only 'state' leafref in the YANG model.