Course contents

Chapter 9: First-Hop RedundancyLesson 2 of 5

VRRP: Virtual Router Redundancy Protocol

The open-standard alternative: master and backup, VRID and virtual MAC, the master-down timer with skew, VRRPv2 and v3, configuration and show vrrp.

Intermediate · 14 min read

Technical definition

VRRP (Virtual Router Redundancy Protocol) is an open-standard first-hop redundancy protocol (RFC 3768 for version 2, RFC 5798 for version 3). Routers in a group share a virtual IP and a virtual MAC address. The master router forwards, and a backup router takes over when the master's advertisements stop.

What VRRP is for

VRRP solves the same problem as HSRP: hosts have one default gateway address, and that address must survive a router failure. The difference is who owns the protocol. HSRP belongs to Cisco. VRRP is defined in an RFC, so routers from different vendors can share one virtual gateway. A campus that mixes Cisco switches with a Juniper or FortiGate firewall pair, or a data centre running Linux routers with keepalived, uses VRRP for exactly that reason.

Master, backup and the virtual router ID

VRRP: one master, backups, and a virtual router ID
VRRP: one master, backups, and a virtual router IDTwo routers share virtual router ID 10 with virtual IP 192.168.10.1 and virtual MAC 0000.5e00.010a. R1 with priority 110 is master and forwards. R2 with priority 100 is backup. The master sends advertisements to 224.0.0.18 using IP protocol 112.PC1gateway .1SW1R1pri 110R2pri 100MASTERBACKUPadvertisementsVirtual routerVRID 10VIP 192.168.10.1MAC 0000.5e00.010aAdvertisementsto 224.0.0.18IP protocol 112every 1 s (default)Preempt is on by default in VRRP. Priority 255 is reserved for the router that owns the VIP.
VRRP calls the group a VRID and the role master or backup. The virtual MAC is 0000.5e00.01 followed by the VRID in hex: VRID 10 is 0a.
  • The group is a virtual router identified by a VRID (1 to 255 on a segment). It has one virtual IP and one virtual MAC address.
  • The master answers ARP for the virtual IP with the virtual MAC and forwards the traffic sent to it. The backup routers stay silent for ARP and only listen.
  • The virtual MAC for IPv4 is 0000.5e00.01XX, where XX is the VRID in hex. VRID 10 gives 0000.5e00.010a. For IPv6 it is 0000.5e00.02XX.
  • The master sends advertisements to the multicast address 224.0.0.18 (IPv6: ff02::12) as IP protocol 112, not UDP, every second by default. The TTL is 255, so a router can drop an advertisement that arrives from off the segment.

How the master is elected

Each router has a priority from 1 to 254, default 100. The highest priority becomes master. If priorities tie, the router with the higher interface IP address wins. Two special values:

  • 255 is reserved for the address owner: the router whose own interface IP is the virtual IP. It is always master while it is up.
  • 0 is sent by a master that is shutting down. It tells the backups to take over at once without waiting for a timer.

Unlike HSRP, preempt is on by default. A router with a higher priority that comes back takes the master role from a router with a lower one. The address owner always preempts.

How long a failover takes

A backup does not use a fixed hold time. It waits for the master-down interval:

Master_Down_Interval = (3 × Advertisement_Interval) + Skew_Time where Skew_Time = (256 − Priority) / 256 seconds.

How long a VRRP backup waits before taking over
How long a VRRP backup waits before taking overThe master sends an advertisement every second. After the master fails, the backup waits three advertisement intervals plus a skew time of (256 minus its priority) divided by 256 seconds. With priority 100 that is 3.61 seconds from the last advertisement.0 s1 s2 s3 s4 s5 s6 sadvertadvertadvert✕master failsMaster_Down_Interval 3.61 sR2 becomes master3 × advertisement interval3 × 1 s = 3.00 s+ skew time (256 − priority) ÷ 256(256 − 100) ÷ 256 = 0.61 s
The skew time makes a higher-priority backup wait slightly less, so the best backup usually wins without a fight. Priority 100 gives a skew of 0.61 s; priority 200 would give 0.22 s.

With the default 1-second advertisement, a backup with priority 100 waits 3 + 0.61 = 3.61 seconds. A backup with priority 200 would wait only 3.22 seconds. The skew is the standard's way of letting the best backup speak first, so two backups do not both claim the role. That is why VRRP usually fails over faster than HSRP's default 10-second hold time, with no tuning at all.

When the new master takes over it sends a gratuitous ARP for the virtual IP with the virtual MAC, so switches relearn the MAC on its port, exactly as in HSRP.

VRRPv2 and VRRPv3

VRRPv2 and VRRPv3
VRRPv2 and VRRPv3; VRRPv2 (RFC 3768); VRRPv3 (RFC 5798). Address families: IPv4 only IPv4 and IPv6 Advertisement interval: Whole seconds Centiseconds, so sub-second is possible Authentication: Removed from the RFC; some vendors keep their own None in the protocol Cisco IOS XE syntax: vrrp 10 ip 192.168.10.1 vrrp 10 address-family ipv4, after fhrp version vrrp v3VRRPv2 (RFC 3768)VRRPv3 (RFC 5798)Address familiesIPv4 onlyIPv4 and IPv6Advertisement intervalWhole secondsCentiseconds, so sub-second ispossibleAuthenticationRemoved from the RFC; some vendorskeep their ownNone in the protocolCisco IOS XE syntaxvrrp 10 ip 192.168.10.1vrrp 10 address-family ipv4, afterfhrp version vrrp v3

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Both versions share the election, the virtual MAC and the multicast address 224.0.0.18. Routers in one group must run the same version.

How to configure VRRP on Cisco IOS

Commands are based on Cisco IOS / IOS XE documentation and haven't been run on a lab device here. VRRP support and syntax differ between platforms and releases, so check the configuration guide for your software.

! R1: master interface GigabitEthernet0/0 ip address 192.168.10.2 255.255.255.0 vrrp 10 ip 192.168.10.1 vrrp 10 priority 110 vrrp 10 preempt

Classic VRRPv2 syntax. Priority 110 beats R2's default 100. preempt is the default, but writing it makes the design obvious.

! R2: backup interface GigabitEthernet0/0 ip address 192.168.10.3 255.255.255.0 vrrp 10 ip 192.168.10.1

Same VRID and virtual IP, default priority 100.

fhrp version vrrp v3 interface GigabitEthernet0/0 vrrp 10 address-family ipv4 address 192.168.10.1 primary priority 110 exit-vrrp

The VRRPv3 form on IOS XE, with an address family under the group. It is also how you add an IPv6 virtual address, in a second address family.

Tracking works as it does in HSRP: lower the priority when an uplink fails so the backup wins. In classic syntax that is vrrp 10 track 1 decrement 20, with track 1 interface GigabitEthernet0/1 line-protocol defined globally.

Reading show vrrp

Example output · based on Cisco documentation; exact format varies by platform and software version
R1#show vrrp brief
Interface          Grp Pri Time  Own Pre State   Master addr     Group addr
Gi0/0              10  110 3570       Y  Master  192.168.10.2    192.168.10.1
Example output. State Master means R1 forwards. The Pre column shows preempt is on, Own is blank because R1 is not the address owner, and Master addr shows which router is master. The Time column is the master-down interval in milliseconds; 3570 is the skew-adjusted value for priority 110. On R2 the State is Backup and Master addr still shows 192.168.10.2.
Example output · based on Cisco documentation; exact format varies by platform and software version
R1#show vrrp GigabitEthernet0/0
GigabitEthernet0/0 - Group 10
  State is Master
  Virtual IP address is 192.168.10.1
  Virtual MAC address is 0000.5e00.010a
  Advertisement interval is 1.000 sec
  Preemption enabled
  Priority is 110
  Master Router is 192.168.10.2 (local), priority is 110
  Master Advertisement interval is 1.000 sec
  Master Down interval is 3.570 sec
Example output. Check the VRID, the virtual MAC (0000.5e00.010a for group 10), the priority and the master's address.

VRRP faults and what to check

VRRP faults and what to check
VRRP faults and what to checkSymptom; Likely cause; Check / fix. Both routers show Master: Advertisements are not arriving: wrong VLAN, blocked trunk, or an ACL that drops IP protocol 112 Permit protocol 112 to 224.0.0.18; ping between the real addresses. Master changes back and forth: Preempt with a tracked object that flaps, or mismatched advertisement intervals Match timers on both routers; add preempt delay; stabilise the track. Backup never takes over: Mismatched VRID or VRRP version between the routers Compare show vrrp on both; use the same version and VRID. Hosts lose access during failover: Hosts use a real address (.2) as gateway Point DHCP and static hosts at the virtual IP. Cross-vendor group will not form: Different version, or a vendor-specific timer unit Match the VRRP version and the advertisement interval in the same unit.SymptomLikely causeCheck / fixBoth routers showMasterAdvertisements are not arriving:wrong VLAN, blocked trunk, or an ACLthat drops IP protocol 112Permit protocol 112 to 224.0.0.18;ping between the real addresses.Master changes back andforthPreempt with a tracked object thatflaps, or mismatched advertisementintervalsMatch timers on both routers; addpreempt delay; stabilise the track.Backup never takes overMismatched VRID or VRRP versionbetween the routersCompare show vrrp on both; use thesame version and VRID.Hosts lose accessduring failoverHosts use a real address (.2) asgatewayPoint DHCP and static hosts at thevirtual IP.Cross-vendor group willnot formDifferent version, or avendor-specific timer unitMatch the VRRP version and theadvertisement interval in the sameunit.

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left column names the symptom, the others give the cause and the fix.

Where VRRP setups usually break

  • Blocking IP protocol 112 or multicast 224.0.0.18 with an ACL or a firewall policy.
  • Assuming preempt behaves like HSRP: in VRRP it is on by default, so a flapping higher-priority router keeps taking the role back.
  • Mixing VRRPv2 and VRRPv3 in one group.
  • Using a virtual IP that another host already uses.

Exam tip: know that VRRP is an open standard, that roles are master and backup, that the virtual MAC is 0000.5e00.01XX, that it uses multicast 224.0.0.18 and IP protocol 112, that preempt is on by default, and that priority 255 belongs to the address owner.

VRRP facts for the exam

  • Open standard; master forwards, backups listen.
  • Priority 1–254, default 100, highest wins; 255 is the address owner.
  • Master-down interval = 3 × advertisement interval + (256 − priority) / 256 s.
  • Multicast 224.0.0.18, IP protocol 112; virtual MAC 0000.5e00.01XX.
  • Preempt is on by default; verify with show vrrp brief.

Test yourself on VRRP

Predict · scenario 1

Which virtual MAC address does VRRP group 10 use for IPv4?

Predict · scenario 2

A backup router has priority 100 and the advertisement interval is 1 second. After the master fails, how long does the backup wait?

Predict · scenario 3

Which statement about VRRP preempt is correct?

Predict · scenario 4

VRRP routers on a VLAN both show Master. Which traffic should you check is permitted?

Predict · scenario 5

A router's own interface IP is the VRRP virtual IP. What priority does it use?

FAQ

When should I choose VRRP instead of HSRP?
When the gateway routers come from different vendors, or when a standard is a requirement. VRRP is the open standard, so Cisco, Juniper, Fortinet, Linux hosts and most other platforms can share a group. On an all-Cisco network HSRP works just as well.
Why does VRRP preempt by default when HSRP does not?
The standard says a higher-priority router should take the master role back when it returns. HSRP's default is the opposite, so a configuration that works on one can behave differently on the other. Always state preempt explicitly in your design.
Can the virtual IP be the same as a router's real interface address?
Yes, and that router is then the owner of the address. It gets priority 255 automatically, always becomes master while it is up, and the other routers use a separate address on the interface.
Does VRRP load balance?
Not inside one group: only the master forwards. As with HSRP, you can run two groups on the same VLAN with a different master in each and split the hosts between the two virtual IPs.