Using Secondary Addresses with VRRP

VRRP on the MDS in it’s basic form looks something like this:

Switch 1

In the above configuration, is the actual physical interface address and is also the VIP address.  This is common.  The other side may looking something like this:

Switch 2

On this side of the link is the physical interface address and is the VIP address.  These two MDS switches Switch 1 and Switch 2 are both members of VR10.  As per the VRRP specification, VRRP VIP addresses are for passing traffic onto real server IP addresses that they front end, they are not for the origination or destination of traffic.  If you try to send traffic to a VRRP VIP, these packets are by default dropped.  Some application’s on the  MDS may need to use the VRRP IP as an actual IP address to terminate traffic on.  For example iSNS (removed from current versions of SAN-OS / NX-OS) and IPSec.  With IPSec you may wish to use the VRRP as a destination of a IPSec tunnel for high availability.  To do this you have to add the “secondary” option like so:

Switch 2

Realize on Switch 1, the primary IP address of G2/1.10 is configured the same as the VIP.  So in this case when Switch 1 is master it will be able to accept traffic terminated to the VIP address.  Switch 2 will not be able to receive traffic destined to the VIP address even with the secondary option configured unless it is the master!  So the key is, the secondary option allows a switch to be able to terminate traffic destined to the VIP, when it’s the master.  If we were terminated an IPSec session on the VIP of Switch 1 and Switch 2, and wanted it to failover, we would need to configure the secondary address for Switch 2.

Also realize this has an effect on the switch VRRP priorities.  A switch that uses the same VRRP address as its interface address automatically has a VRRP priority of 255.  A switch using a different address for its VRRP than it has on its interface has a priority of 100.  This applies to the use of the secondary command as well.  With or without the secondary command the interface will have a default priority of 100 if its interface address does not match the VRRP address.

Also realize, you cannot configure a secondary address to be the same as the interface address, if you try to do so you will get an error:

You can test the functionality of the secondary address option by telnetting to the VIP.  Obviously on Switch 1 you can telnet to the VIP regardless since a) it is the master because of it’s higher configured priority and b) It’s interface IP address matches the VRRP VIP address.  But on Switch 2, configure the secondary address, bring down Switch 1’s VRRP interface peer, and you will see master switch to Switch 2.  Then you should be able to telnet to the VIP of Switch 2.  You will not be able to telnet to the VIP of switch 2 unless it’s the master and it has secondary address configured.
This entry was posted in CCIE Storage, VRRP and tagged , , . Bookmark the permalink.

13 Responses to Using Secondary Addresses with VRRP

Leave a Reply