Virtual Router Redundancy Protocol (VRRP) Version 3 for IPv4 and IPv6
obsoletes
- rfc-5798 — Virtual Router Redundancy Protocol (VRRP) Version 3 for IPv4 and IPv6
Extracted elements (27)
Authentication was removed from VRRP because operational experience showed that misconfigured shared secrets caused multiple Active Routers to be elected simultaneously — a failure mode as disruptive as having no Active Router. Since hostile LAN nodes can disrupt ARP/ND independently of VRRP regardless of authentication, the security benefit did not justify the complexity.
The Skew_Time formula ((256 - Priority) × Active_Adver_Interval / 256) was chosen so that higher-priority Backup Routers have a shorter wait before promoting to Active, ensuring priority-ordered convergence without requiring explicit coordination between Backup Routers during failover.
VRRP uses a single message type (ADVERTISEMENT) sent only by the Active Router, minimizing runtime state and protocol complexity. The design optimizes for the common case of two redundant routers with distinct path preferences, accepting that more than two equal-preference paths may cause brief duplicate forwarding during election — a tradeoff justified by the rarity of such topologies.
A VRRPv2 Active Router interacting with a sub-second VRRPv3 Backup Router is problematic: the VRRPv2 implementation SHOULD NOT be given higher priority than a VRRPv3 router operating at sub-second rates. VRRPv3 Active Routers sending at centisecond rates could overwhelm VRRPv2 Backup Routers; initial deployments should use 100 centisecond intervals until VRRPv2 routers are upgraded.
VRRPv3 and VRRPv2 interoperation is optional and NOT RECOMMENDED for permanent deployments; it is intended only for transitional upgrade scenarios. An implementation MAY support a configuration flag to send and receive both VRRPv2 and VRRPv3 advertisements simultaneously.
A receiver SHOULD verify that the Max Advertise Interval in received VRRP packets matches the locally configured Advertisement_Interval for the VRID. Mismatched intervals can cause instability; failures SHOULD be logged with rate-limiting.
Backup Routers MUST be configured to send the same Router Advertisement options as the address owner when they become Active. Special-service options (e.g., Home Agent Information) SHOULD NOT be sent unless Backup Routers are fully prepared to assume those services with a complete synchronized database.
For IPv4, the TTL MUST be set to 255, and a VRRP Router receiving a packet with TTL not equal to 255 MUST discard the packet. This implements the Generalized TTL Security Mechanism (GTSM) per RFC 5082.
For IPv6, the first IPvX address in the VRRP advertisement MUST be the IPv6 link-local address associated with the Virtual Router. The address family of all addresses MUST match the packet's IP header address family.
For IPv6, the Hop Limit MUST be set to 255, and a VRRP Router receiving a packet with Hop Limit not equal to 255 MUST discard the packet. This implements the Generalized TTL Security Mechanism (GTSM) per RFC 5082.
If Proxy ARP is used on a VRRP Router, the router MUST advertise the Virtual Router MAC address in the Proxy ARP message. Using the real MAC address could cause hosts to learn the physical MAC address of the VRRP Router, breaking failover.
On receiving a VRRP packet, a router MUST verify: TTL/Hop Limit is 255, VRRP version is 3, packet type is 1 (ADVERTISEMENT), packet is complete, checksum is valid, and VRID is configured locally with the local router not being the IPvX address owner. Any failed check MUST result in discarding the packet.
The Virtual Router MAC address MUST NOT be used for the Net_Iface parameter in IPv6 Interface Identifier derivation algorithms (RFC 7217, RFC 8981), as it would generate non-unique interface identifiers across multiple routers sharing the same Virtual Router MAC.
VRRP packets MUST be transmitted with the Virtual Router MAC address as the source MAC address to ensure learning bridges correctly determine the LAN segment to which the Virtual Router is attached.
When responding to ARP requests for Virtual Router IPv4 addresses, the Active Router MUST respond with the Virtual Router MAC address, not its physical MAC address. This ensures hosts always use the same MAC address regardless of which router is currently Active.
While in the Active state, the router MUST respond to ARP requests (IPv4) or ND Neighbor Solicitation messages with Router Flag set (IPv6), MUST forward packets with the Virtual Router MAC address as destination, and MUST accept packets addressed to Virtual Router IPvX addresses if it is the address owner or Accept_Mode is True.
While in the Backup state, a VRRP Router MUST NOT respond to ARP requests (IPv4) or ND Neighbor Solicitation messages (IPv6) for the Virtual Router's addresses, MUST NOT send ND Router Advertisements, MUST discard packets with the Virtual Router MAC address as destination, and MUST NOT accept packets addressed to the Virtual Router's IPvX addresses.
Active_Down_Interval = (3 × Active_Adver_Interval) + Skew_Time, where Skew_Time = ((256 - Priority) × Active_Adver_Interval) / 256 (in centiseconds). This formula ensures higher-priority Backup Routers wait less time before promoting themselves to Active, enabling priority-based ordered failover.
The Max Advertise Interval is a 12-bit field indicating the time interval in centiseconds between advertisements, with a default of 100 centiseconds (1 second). Backup Routers use this value from received advertisements to compute Skew_Time and Active_Down_Interval.
The Priority field (8-bit unsigned integer) determines Active Router election. The IP address owner MUST use priority 255; Backup Routers use values 1-254 (default 100); priority 0 signals the Active Router is relinquishing responsibility, triggering immediate Backup promotion without waiting for Active_Down_Interval.
The Virtual Router MAC address format is: 00-00-5E-00-01-{VRID} for IPv4 and 00-00-5E-00-02-{VRID} for IPv6 (in hex, network byte order). The first three octets are the IANA OUI; bytes 4-5 identify the VRRP address block per IP version; the final byte is the VRID, allowing up to 255 VRRP instances per address family per LAN.
IANA registries updated by RFC 9568: IP protocol number 112 assigned to VRRP; IPv4 multicast address 224.0.0.18 assigned for VRRP; IPv6 link-local multicast address ff02::12 assigned for VRRP; Ethernet MAC blocks 00-00-5E-00-01-00 through 00-00-5E-00-01-FF (VRRP IPv4) and 00-00-5E-00-02-00 through 00-00-5E-00-02-FF (VRRP IPv6) assigned in the IANA MAC ADDRESS BLOCK registry.
For IPv6 with SEND deployed, VRRP is compatible with SEND 'trust anchor' and 'trust anchor or CGA' modes. Active and Backup Routers must share the same prefix delegation in certificates but SHOULD maintain separate key pairs to avoid private key sharing. RFC 9099 Section 2.3 link-level security guidelines are RECOMMENDED.
VRRP includes no authentication mechanism. Earlier authentication schemes were removed because misconfigured secrets caused multiple Active Routers to be elected, and even with cryptographic protection, hostile nodes can behave as Active Routers. VRRP's TTL/Hop Limit=255 check (GTSM) limits attacks to the local network, but cannot prevent LAN-local attacks such as ARP/ND spoofing, which can be performed independently of VRRP.
VRRP defines three states: Initialize (waiting for Startup event), Backup (monitoring Active Router availability), and Active (forwarding packets for the Virtual Router). Transitions: Initialize→Active on Startup if priority=255; Initialize→Backup on Startup if priority<255; Backup→Active on Active_Down_Timer expiry; Active→Backup on receiving higher-priority advertisement; any state→Initialize on Shutdown.
The Checksum field is a 16-bit one's complement of the one's complement sum of the VRRP message. For IPv4, the checksum covers only the VRRP message (Version field through last IPv4 address) without a pseudo-header. For IPv6, the checksum includes a prepended pseudo-header as defined in RFC 8200 Section 8.1, with Next Header set to 112.
The VRRP Advertisement packet contains: 4-bit Version, 4-bit Type, 8-bit Virtual Rtr ID, 8-bit Priority, 8-bit IPvX Addr Count, 4-bit Reserve, 12-bit Max Advertise Interval, 16-bit Checksum, followed by one or more IPvX addresses. The packet is encapsulated in IPv4 or IPv6 depending on the address family being protected.