Thanks to Steve and John for the clarifications.
One last note, if the virtual router's link-local address
does not have to be one of VRRP router's interface addresses, using VR Mac to
form the link-local address seems to be fairly convenient. Any
comment?
Biao
Biao,
You raise some
interesting points, including one about the prefix length that I had not
considered.
The ability to
choose a particular address that can be used to generate the link
local address seems to be fairly implementation dependent. It was
fairly easy to do based on RFC 3768 when one had the option of
requiring virtual routers to have a matching list of IP addresses, but this may
no longer be the case for VRRPv3.
Section 7.1 of the
current IPv6 draft does not appear to have been updated when the advertisement
was modified to include multiple IP addresses. The draft states that on
receipt of an advertisement a VRRP router:
- MAY verify that the IPv6 Address matches
the IPv6_Address
configured for
the VRID.
One might think that
with multiple IP addresses the wording might be more like RFC
3768:
-
MAY verify that "Count IP Addrs" and the list of IP
Address
matches the IP_Addresses configured
for the VRID
Or else explicitly
state that only the first IP address MAY be checked. In any case,
explicit configuration should always be possible.
Before today I had
assumed that there was nothing to prevent a user from configuring any IP address
for the virtual router, and I guess that hasn't changed. However, based on
your question I realize that without a prefix length, it is not practically
possible. It seems that the address must belong to one of the interface'
subnets in order to obtain a useful prefix length for the router
advertisement.
To be an IP address
owner all of a virtual router's IP addresses must match it's IP interface
addresses, otherwise we run into exactly the problem you point out - several
virtual routers claiming to be the owner and sending advertisements with
priority 255. Our experience has been that very few users assign the
interface address to the virtual router. There are probably several
reasons: 1) It's easier to keep track of addresses. 2) The owner always preempts
the backup and this can lead to problems particularly after a reboot. 3)
Ping.
Steve
Hi,
I have some
questions regarding VRRP for IPv6:
Since link-local
IPv6 address is mandatory in the VRRP advertisement packet, does this imply
each virtual router has to be configured a link-local IPv6 address? If this
address is automatically generated from an IPv6 address to be backed up, like
Steve mentioned, when there are more than one address associated with the
virtual router, how do the other routers in the same group know which address
to use to generate the link-local address? It seems some explicit
configuration has to be done.
To configure an
IPv6 address for a virtual router, does it have to be in the same subnet of
one of interface's IPv6 addresses? If not, what is the prefix length of the
subnet?
In the draft, the
IP address owner is defined to be "The VRRP router that has the virtual
router's IP address(es) as real interface address(es)". As there can be
multiple IPv6 addresses on an interface and associated with a virtual router,
I assume this refers to the link-local address. Then the owner of the
link-local address also assumes the ownership for the other addresses in the
priority 255 advertisement, and the real owners of these addresses are masked
out. Is this kind of configuration valid or not?
Any insight into
these?
Thanks,
Biao
RSS Feed