1 Feb 2010 01:48
VRRP groups and complying with RFC 3768
Martin Visser <martinvisser99 <at> gmail.com>
2010-02-01 00:48:54 GMT
2010-02-01 00:48:54 GMT
Hi,
I have a question related to a problem that took a lot of time to solve. My customer has a set of firewalls and a set of load-balancers that use VRRP to provide redundancy for the gateway addresses and the virtual IPs they serve up. The vendor (the same for both, but each have a different OS platform) has a concept of a VRRP group. All of the virtual routers are advertised thus in the one VRRP advertisement (at least on this one VLAN 22) - the firewall is configured to use VRID 255 and the load-balancer uses VRID 79.
What I found is curious is that the the source MAC address for the VRRP advertisements does not match that of the configured group VRID. Instead they use the VRID 122 as the basis of the MAC address. This is derived from two of the individual virtual routers - 111.111.234.129 on the firewall, and 172.26.22.122 on the load-balancer. (Note that 111.111.xxx.xxx is my obfuscation of the real address). Using the same VRID 122 on the two heterogeneous platforms on the one VLAN is of course a misconfiguration, which we now recognise. However the question remains is that the actual VRID 122 is never mentioned on the wire in any of the VRRP advertisements so why is the derived MAC address, 00:00:5e:00:01:7a, used instead of 00:00:5e:00:01:ff and 00:00:5e:00:01:45 (for VRIDs 255 and 79 ) not used? Is the vendor actually complying with RFC 3768 or not. I am sort of guessing that the vendor has done this to prevent using the same VLAN accross multiple VLANs, as it appears they do use the same VRRP group VRID accross multiple VLANs. Thus if they used the configured group VRID for deriving MAC addresses it might cause confusion on some switches (if they don't maintain a per VLAN forwarding table). However because we weren't seeing conflicting VRRP VRIDs in the actual advertisements, we hadn't found the problem. It was only chancing upon the fact that the firewalls were using the same source MAC as the load-balancer that we found a problem. (We found it when we were trying to install a switch between the firewall and load-balancer pairs and were experiencing high packet loss. Having the same source MAC swapping between interfaces, tied to different virtual router IPs, of course was the cause).
So again, my question is
1. Is the vendor in violation of the RFC by choosing a source MAC based on a VRID not actually in the advertisement
2. Do other vendors using a similar arrangement when send VRRP group advertisements. (The exact algorithm in this case isn't clear to me).
The two packets below (using the Wireshark summary) are from the firewall first and the load-balancer second. It is clear they use the same source MAC but different VRIDs. I have annotating the virtual router IP address from which the used source MAC address is derived.
No. Time Len Source Destination Protocol Info
4723 2.375135 122 111.111.234.130 224.0.0.18 VRRP Announcement (v2)
Frame 4723 (122 bytes on wire, 122 bytes captured)
Ethernet II, Src: IETF-VRRP-virtual-router-VRID_7a (00:00:5e:00:01:7a), Dst: IPv4mcast_00:00:12 (01:00:5e:00:00:12)
Internet Protocol, Src: 111.111.234.130 (111.111.234.130), Dst: 224.0.0.18 (224.0.0.18)
Virtual Router Redundancy Protocol
Version 2, Packet type 1 (Advertisement)
Virtual Rtr ID: 255
Priority: 118 (Non-default backup priority)
Count IP Addrs: 18
Auth Type: Simple Text Authentication [RFC 2338] / Reserved [RFC 3768] (1)
Adver Int: 1
Checksum: 0xd785 [correct]
IP Address: 172.26.18.30 (172.26.18.30)
IP Address: 172.26.30.10 (172.26.30.10)
IP Address: 111.111.234.129 (111.111.234.129) *** VRID 122 ***
IP Address: 172.26.22.1 (172.26.22.1)
IP Address: 111.111.234.65 (111.111.234.65)
IP Address: 172.26.20.1 (172.26.20.1)
IP Address: 111.111.234.225 (111.111.234.225)
IP Address: 172.26.32.1 (172.26.32.1)
IP Address: 111.111.234.25 (111.111.234.25)
IP Address: 172.26.21.1 (172.26.21.1)
IP Address: 111.111.234.209 (111.111.234.209)
IP Address: 172.26.33.1 (172.26.33.1)
IP Address: 111.111.234.193 (111.111.234.193)
IP Address: 172.26.39.1 (172.26.39.1)
IP Address: 172.26.15.1 (172.26.15.1)
IP Address: 172.26.99.1 (172.26.99.1)
IP Address: 172.26.41.1 (172.26.41.1)
IP Address: 111.111.234.241 (111.111.234.241)
Authentication string: `xxxxx'
No. Time Len Source Destination Protocol Info
6020 2.455066 210 172.26.22.12 224.0.0.18 VRRP Announcement (v2)
Frame 6020 (210 bytes on wire, 210 bytes captured)
Ethernet II, Src: IETF-VRRP-virtual-router-VRID_7a (00:00:5e:00:01:7a), Dst: IPv4mcast_00:00:12 (01:00:5e:00:00:12)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 22
Internet Protocol, Src: 172.26.22.12 (172.26.22.12), Dst: 224.0.0.18 (224.0.0.18)
Virtual Router Redundancy Protocol
Version 2, Packet type 1 (Advertisement)
Virtual Rtr ID: 79
Priority: 101 (Non-default backup priority)
Count IP Addrs: 39
Auth Type: No Authentication (0)
Adver Int: 1
Checksum: 0x1e7a [correct]
IP Address: 111.111.234.190 (111.111.234.190)
IP Address: 172.26.22.11 (172.26.22.11)
IP Address: 111.111.234.196 (111.111.234.196)
IP Address: 172.26.39.11 (172.26.39.11)
IP Address: 111.111.234.212 (111.111.234.212)
IP Address: 172.26.33.11 (172.26.33.11)
IP Address: 111.111.234.132 (111.111.234.132)
IP Address: 172.26.22.123 (172.26.22.123)
IP Address: 111.111.234.133 (111.111.234.133)
IP Address: 111.111.234.134 (111.111.234.134)
IP Address: 111.111.234.136 (111.111.234.136)
IP Address: 111.111.234.137 (111.111.234.137)
IP Address: 172.26.22.124 (172.26.22.124)
IP Address: 111.111.234.138 (111.111.234.138)
IP Address: 111.111.234.139 (111.111.234.139)
IP Address: 111.111.234.140 (111.111.234.140)
IP Address: 111.111.234.141 (111.111.234.141)
IP Address: 111.111.234.142 (111.111.234.142)
IP Address: 172.26.22.122 (172.26.22.122) *** VRID 122 ***
IP Address: 172.26.22.125 (172.26.22.125)
IP Address: 172.26.22.126 (172.26.22.126)
IP Address: 111.111.234.143 (111.111.234.143)
IP Address: 111.111.234.146 (111.111.234.146)
IP Address: 111.111.234.150 (111.111.234.150)
IP Address: 111.111.234.152 (111.111.234.152)
IP Address: 111.111.234.153 (111.111.234.153)
IP Address: 172.26.22.154 (172.26.22.154)
IP Address: 172.26.22.155 (172.26.22.155)
IP Address: 111.111.234.144 (111.111.234.144)
IP Address: 111.111.234.161 (111.111.234.161)
IP Address: 111.111.234.162 (111.111.234.162)
IP Address: 111.111.234.163 (111.111.234.163)
IP Address: 111.111.234.164 (111.111.234.164)
IP Address: 111.111.234.165 (111.111.234.165)
IP Address: 111.111.234.166 (111.111.234.166)
IP Address: 111.111.234.167 (111.111.234.167)
IP Address: 111.111.234.168 (111.111.234.168)
IP Address: 172.26.22.181 (172.26.22.181)
IP Address: 111.111.234.155 (111.111.234.155)
Regards, Martin
MartinVisser99 <at> gmail.com
_______________________________________________ vrrp mailing list vrrp <at> ietf.org https://www.ietf.org/mailman/listinfo/vrrp
RSS Feed