Discovering VRRP
Even if you are familiar with how VRRP works, feel free to read on to refresh your knowledge or to gather new information, because this section focuses on specific points linked to the security aspects of VRRP.
In VRRP, each physical router has its own MAC and IP addresses, but it also shares one MAC address and one IP address for the virtual router. Figure 10-1 depicts such a topology when the VRRP group consists of two routers. There is a change in the terminology compared to HSRP:
• Master router: The router that is currently forwarding packets.
• Backup routers: The routers that are in standby and are not currently forwarding packets. They listen to VRRP packets from the master router to detect whether it is active.
In Figure 10-1, the different IP addresses are as follows:
• 192.168.0.7: IP address of interface FastEthernet 0/0 of physical router A.
• 192.168.0.9: IP address of interface FastEthernet 0/0 of physical router B.
• 192.168.0.8: IP address of the interface of the virtual router. This is the shared IP address.
Figure 10-1 Typical VRRP Topology
Normal Hosts with a Default Route to 192.168.0.8
Normal Hosts with a Default Route to 192.168.0.8
Router A
MAC: from Hardware
* VRRP Grouppj
Virtual Router IP: 192.168.0.8 MAC: 0000.5E00.0101
Router B
MAC: from Hardware
An IP multicast address is used as the destination of all VRRP messages: 224.0.0.18. This address is within the link local scope, 224.0.0.0/24.
By definition, all addresses in the link local scope are only valid within a link (that is, within the LAN); packets destined to such a link local address are never routed outside the LAN. This also means that no attacker will ever be able to send a forged VRRP packet to a remote LAN because all routers in the path will simply drop this packet.
Figure 10-1 also shows the three different MAC addresses used:
• Actual MAC address of the physical router A.
• Actual MAC address of the physical router B.
• MAC address of the virtual router. (In this specific configuration, it is 0000.5E00.0101.)
NOTE The virtual MAC address is always in the form 0000.5E00.01xx, where xx is the VRRP group number (that is, an identification of the VRRP group of master and backup routers). The group number is required to avoid MAC address conflict when multiple VRRP virtual routers exist on the same LAN. This is the same concept as in HSRP. No specific semantic is associated to a group number; it just needs to be unique on the LAN.
The use of the MAC and IP addresses is similar to HSRP. All end hosts always use the virtual MAC address to send to the master router. The master router sends its periodic VRRP packets with the virtual MAC address as its source so that switches can learn this address in their content-addressable memory (CAM) table.
Discovering VRRP 159
The master periodic VRRP packets are also a health signal for the backup routers. The absence of this periodic VRRP packet triggers the backup routers to change roles and become active.
A difference of VRRP compared to HSRP is that the VRRP virtual IP address can be the interface IP address of the master router. With HSRP, the virtual IP address was always different than the HSRP primary router.
Continue reading here: Diving Deep into VRRP
Was this article helpful?