Configuration of VRRPv3

LCOS supports VRRPv2 and VRRPv3 (RFC 5798 and also RFC 9568) for IPv4 and IPv6.

The settings for VRRP can be found in LANconfig under IP router > VRRP.

Command line: Setup > VRRP

In order to configure failover (router redundancy) or load balancing with VRRP, the following parameters can be set:

VRRP activate

This switches the VRRP module on or off (default: Off).

Virtual routers

In the Virtual Routers table, the virtual routers can be defined for each interface.

Interface

Logical IPv4 or IPv6 interface or network on which VRRP should be enabled. In principle, only LAN interfaces are meaningful. Other interfaces can be selected but may lead to undefined behavior.

Router ID

Unique ID for the virtual router. Values between 1 and 255 are possible. The router ID is used to consolidate several physical routers into a single virtual router or a standby group. The router ID is sometimes called VRRP ID or VRID for short.

Enabled

Enables or disables VRRP for this configuration entry.

Version

Defines which VRRP version should be used. Supported are VRRPv2, VRRPv3, or VRRPv2 and VRRPv3. IPv6 is only supported with VRRPv3. IPv4 is supported in both VRRPv2 and VRRPv3. The v2+v3 mode is intended as a transitional solution for the move from VRRPv2 to VRRPv3 operation under IPv4. It doubles the packet volume, since a virtual router configured in this way sends advertisements in both protocol versions. A virtual router configured to use one protocol version will discard advertisements from other routers if they have the wrong protocol version, it will be output to the VRRP packet trace and add an entry to the event log table.

Priority

Specifies the priority with which the virtual router operates. This is transmitted in the advertisements and largely determines which device is the master for a VRRP network. The specified priority must be greater than 0. The value 255 has a special meaning:

• The value 255 is automatically set if the virtual router's address is the same as the address of the interface to which the router is bound. In all other cases, the priority is automatically lowered.

Backup priority

The backup priority of the virtual router refers to the interface for which a backup connection is configured, i.e. with routers with DSL and cellular support to the cellular interface. Values between 0 and the configured priority are permitted. The value 0 has a special meaning:

• 0 disables the virtual router in the backup event. Checks are conducted regularly in order to determine whether or not the standard connection can be reestablished. The inspection interval is defined in the reconnect delay.

When the backup connection cannot be established in backup mode, then the virtual router logs off completely and attempts to reestablish the standard or backup connection in intervals defined by the reconnect delay.

Advert. interval

The advertisement interval specifies the time until a virtual router is propagated again. The default value is 100 centiseconds (1 second). Additionally, version v2 or v2+v3 require the interval to be an integer of 100, since for VRRPv2 the interval must be an integer number of seconds. If the version is subsequently changed, the advert interval is automatically adjusted to a valid value and should be checked.

Note: With a propagation time of 1 second, the routers in the VRRP group can change quickly when a device or interface fails. An interruption of this type will usually remain undetected due to the fact that the TCP connection is not interrupted. Other routing protocols require up to 5 minutes or longer in order to conduct the transfer to a backup router.

Virtual IPv4 address

Defines the virtual IPv4 address of the virtual router. The address must be identical on all routers in the VRRP network. To avoid conflicts, virtual IP addresses should only be IP addresses that are not dynamically assigned to end devices that do not speak VRRP. If the assigned virtual IPv4 corresponds to the physical address of the device on the LAN interface, the configured priorities and backup priorities are ignored and priority 255 is always used instead, in compliance with RFC.

Note: An unspecified IPv4 address (0.0.0.0) disables IPv4 for this configuration entry.

Virtual link-local IPv6 address

Defines the virtual link-local IPv6 address of the virtual router, for example fe80::1. The address must be identical on all routers in the VRRP network. This address is used as the sender address for sending router advertisements. The parameter is only supported in VRRPv3 mode.

Note: Assigning a virtual link-local address is mandatory to define a virtual router for IPv6.

If the assigned link-local virtual IPv6 corresponds to the physical address of the device on the LAN interface, the configured priorities and backup priorities are ignored and priority 255 is always used instead, in compliance with RFC.

Note: An unspecified IPv6 address (::) disables IPv6 for this configuration entry.

Virtual global IPv6 address

Defines the optional global IPv6 address of the virtual router, for example 2001:db8::1. The address must be identical on all routers in the VRRP network. The parameter is only supported in VRRPv3 mode.

Note: This address is required for the VPN load balancer if it is to operate with IPv6.

Monitored interface

Name of the remote site that controls the virtual router behavior. The remote site can still also be assigned to other virtual routers. Entering the remote site is optional. Linking the backup requirement to a remote site allows the use of the LANCOM-specific enhancement to VRRP not only to secure against device failure (VRRP standard) but also against interface failure or disruption at a remote site.

Comment

Enter a comment for this entry.

Reconnect delay

This specifies the number of minutes before a virtual router that has logged off attempts to reestablish its main connection. The router remains logged off during this connection attempt. It is only broadcasted with its main or backup priority after the connection has been established successfully. The default value is 30 minutes. Input is entered as <minutes>:<seconds>.

Master holddown time

If a time is configured here, the virtual router changes to the "Hold-Down" state as soon as the monitored WAN connection is terminated with an error and the backup delay expires (i.e. switches to backup state). In the "Hold-Down" state, the monitored WAN connection can no longer be established. Also, no further VRRP advertisements will be sent. As soon as the "Master-Holddown-Time" expires, the virtual router transitions to the "Standby" state, in which the monitored WAN connection can be reestablished. The "Master-Holddown-Time" is a string with a maximum of 6 characters, which may include the digits 0-9 and a colon. This allows the entry of times of up to 999 minutes 59 seconds (999:59). If there is no colon (e.g. "30") then the specification is interpreted as minutes. In this case the maximum is "999". If a colon is present, the colon must be followed by two characters that are interpreted as seconds. The maximum possible value here is "59". Correct time specifications are, for example "5" (5 minutes), "5:30" (5 minutes, 30 seconds) or "0:30" (30 seconds). A value of "0" or "0:00" disables the Master-Holddown.

WAN connection control

Defines whether VRRP should suppress the connection establishment of the monitored WAN counterpart in the standby role. Possible values:

Enabled

In the standby role, the connection establishment of the monitored WAN counterpart is not suppressed, and the WAN connection is established. Additionally, in this case, the routes to the monitored WAN are not switched when the virtual router goes into standby.

Important: Packets sent to the physical MAC address of the router are not forwarded to the master in the standby state.

Disabled

In the standby role, the connection establishment of the monitored WAN counterpart is suppressed.

LAN link detection

Specifies whether the WAN connection should be established if no LAN connection is available. The feature is relevant for a scenario where the router is still in operation without a LAN connection, but management of the router should be possible via the WAN connection. In this scenario, the LAN-link detection has to be deactivated.

Propose internal services on the virtual IPs

This item controls whether the virtual router is assigned as a DNS server in DHCPv4, DHCPv6 and Router Advertisement.