Migration from Cisco GLBP to industry standard VRRPE

Transcription

1 Migration from Cisco GLBP to industry standard VRRPE Technical white paper Table of contents Overview... 2 Gateway load balancing protocols... 2 Introduction to Cisco GLBP... 2 Introduction to VRRPE... 2 Comparison of GLBP and VRRPE... 5 Gateway load balancing configuration example... 5 Network diagram... 5 GLBP configuration... 6 Verifying the configuration... 7 Migration from Cisco GLBP to VRRPE... 8 Migration guidelines... 8 Configuring VRRP... 9 Verifying the configuration Summary For more information... 14

2 Overview Gateway load balancing protocols Most gateway redundant backup technologies, such as Virtual Router Redundancy Protocol (VRRP) (RFC 3768), and Cisco proprietary Hot Standby Router Protocol (HSRP), if mature, are inefficient. With any of these protocols, only one router (the master or the active router) in a backup group forwards traffic for a LAN. The other routers in the group function as backups, and do not forward traffic when the master or the active router is operating normally. To better use network resources, Cisco developed Gateway Load Balancing Protocol (GLBP) and developed VRRP Extended (VRRPE) to balance traffic among gateways in a backup group. Introduction to Cisco GLBP GLBP is a proprietary protocol of Cisco. It can bind one virtual IP address to up to four MAC addresses. The clients in a network use the same virtual IP address as their gateway address. The client sends ARP requests to the gateway. After receiving the request, the active router in the GLBP group replies to the clients with different MAC addresses. This enables corresponding routers in the GLBP group to forward packets from individual clients; thus implementing load balancing. With HSRP and VRRP, an active router or master router must be selected to forward packets, while the other backup routers are only for backup purposes. With GLBP, no active or master router is necessarily selected, because all routers in a GLBP group can participate in packet forwarding while providing redundant router backup. GLBP elects an active virtual gateway (AVG) according to the priority. The router with the higher priority wins the election. In the case of routers with equal priority, the router with the higher IP address wins. If the AVG fails, a new AVG election process will begin. The AVG in a GLBP group is responsible for assigning virtual MAC addresses to the routers (including the AVG itself) in the group in order. A router whose virtual MAC address is assigned by the AVG is called the primary virtual forwarder (PVF) of the virtual MAC address, while a router whose virtual MAC address is learned by the hello message is called the secondary virtual forwarder (SVF) of the virtual MAC address. The router that is responsible for forwarding the packets destined for the virtual MAC address is called active virtual forwarder (AVF). When the PVF works normally, the PVF is the AVF. If the PVF fails, the SVF with the highest weight becomes the AVF. Compared with HSRP and VRRP, GLBP features the following: With HSRP and VRRP, multiple backup groups must be created and different gateway addresses must be configured for different hosts in a LAN, if you want multiple routers to share packet-forwarding load. Using GLBP, packet forwarding load sharing can be implemented by creating only one backup group and specifying only one gateway for different hosts in the LAN. GLBP implements redundant backup of virtual forwarders (VFs). When a router in the GLBP group fails, the other routers in the group can take over the virtual MAC address of the failed router to enable uninterrupted communications among the hosts in a LAN. Introduction to VRRPE VRRP addresses the single-point of failure of gateway. In a VRRP group, only the master router can forward packets, and the backup routers do not participate in packet forwarding and only act as backups for the master when the master works normally, resulting in low usage of network resources. VRRP Extended (VRRPE) adds the load balancing feature on the basis of VRRP. VRRPE binds one virtual IP address to multiple virtual MAC addresses. Each router in a VRRPE group corresponds to a virtual MAC address. The virtual gateway router replies to the ARP requests (in an IPv4 network) or Neighbor Discovery (ND) requests (in an IPv6 network) with different virtual MAC addresses, so that different hosts send their packets to different routers, and each involved router in the VRRP group can forward the received packets. VRRPE inherits the master/backup election mechanism of VRRP. The master router is responsible for assigning virtual MAC addresses to the routers (including the master router itself) in the VRRPE group, replying the ARP/ND requests from the hosts to the gateway, and forwarding packets from the hosts; the backup routers, on one hand, act as the backups for the master router, and, on the other hand, forward packets as gateways. A router in a VRRPE group can be in any of the three states: initialize, master, and backup. 2

3 After the master router in a VRRPE group assigns a virtual MAC address to a router in the group, each router in the group creates a VF corresponding to the virtual MAC address; and the router assigned with the virtual MAC address is called the owner of the VF. A VF can be in any of the three states: initialize, active, and listening. The priority of a VF determines its state. The VF with the highest priority is in active state, and it is called the AVF, responsible for forwarding the packets destined for the virtual MAC address. The VFs corresponding to the virtual MAC address on other routers are in listening state, which are called LVFs, responsible for listening to the state of the AVF. In a VRRPE group, only the AVFs can forward packets from the hosts in a LAN. VRRPE uses four types of packets for exchanging information between master and backup routers: Advertisement: Advertises the states of the VRRPE group and the states of the AVFs on the local router. The master router and backup routers send advertisement packets periodically. Request: A backup router that is not the VF owner sends request packets to the master to request a virtual MAC address. Reply: After receiving a request packet, the master router sends a reply to the backup router to assign a virtual MAC address. After receiving the reply, the backup router creates a VF that corresponds to the virtual MAC address. The router is the owner of the VF. Release: If the VF owner times out, the router that takes over sends a release packet to notify the other routers in the VRRPE group to remove the VFs corresponding to the VF owner. Let s examine IPv4-based VRRPE as an example; the operation procedure is as follows: 1. The master in the VRRPE group assigns virtual MAC addresses to the routers (including the master router itself) in the group. As shown in Figure 1, in the VRRPE group with virtual IP address /24, Router A is the master router, and Router B is the backup router. Router A assigns virtual MAC address 000f-e2ff-0011 to itself, and 000f-e2ff-0012 to Router B. Figure 1: addresses assignment by the master Network Router A Master Router B Backup Virtual IP /24 : 000f-e2ff Allocates : 000f-e2ff-0012 to Router B Host A Host B 3

4 2. After receiving the ARP requests destined for the virtual IP address from the hosts, the master router, according to the load balancing algorithm, replies to the requests from different hosts with different virtual MAC addresses. As shown in Figure 2, Host A sends a request to obtain the MAC address corresponding to the gateway , and the master router uses the virtual MAC address of Router A to reply the request; Host B sends a request to obtain the MAC address corresponding to the gateway , and the master router uses the virtual MAC address of Router B to reply to the request. Figure 2: Reply of ARP requests by the master Network Router A Master Router B Backup Virtual IP /24 : 000f-e2ff : 000f-e2ff-0012 Gateway MAC: 000f-e2ff Gateway MAC: 000f-e2ff-0012 Host A Host B 3. Different virtual MAC addresses can lead the packets from different hosts to different routers. As shown in Figure 3, Host A regards the virtual MAC address of Router A the gateway address, and Host B regards the virtual MAC address of Router B the gateway address, so that the packets from Host A are forwarded by Router A, and those from Host B are forwarded by Router B. 4

5 Figure 3: Packet forwarding by different routers Network Router A Master Router B Backup Virtual IP /24 : 000f-e2ff : 000f-e2ff-0012 Gateway MAC: 000f-e2ff Gateway MAC: 000f-e2ff-0012 Host A Host B Comparison of GLBP and VRRPE Protocol GLBP VRRPE Standard Cisco proprietary protocol Proprietary protocol Hello time 1 to 60 seconds, 3 seconds by default 1 to 255 seconds, 1 second by default Hold time In the range (Hello time +1) to 180 seconds, 10 seconds by default 3 * Hello time + skew-time VF redirect interval VF timeout interval In the range 0 to 3600 seconds, 600 seconds by default In the range (Redirect interval +600) to seconds, seconds by default 600 seconds, which cannot be configured at CLI 1800 seconds, which cannot be configured at CLI VF preemption Configurable, enabled by default Enabled by default. This feature cannot be configured at CLI Interoperability Supported by some vendors, like Cisco Supported by many vendors Load balancing algorithm Cyclic algorithm, host-based algorithm, weight-based algorithm Host-based algorithm CPU load Medium Medium Maximum number of backup groups supported Gateway load balancing configuration example Network diagram As shown in Figure 4, Router A, Router B, and Router C are in backup group 1, which acts as the gateway of Host A, Host B, and Host C in the LAN. Router A, Router B, and Router C back up one another. When a router fails, another router can take over so as to enable uninterrupted traffic forwarding. Router A, Router B, and Router C belong to backup group 1 with the virtual IP address /24. 5

6 The hosts in network segment /24 use /24 as the default gateway. VRRP is used to make sure that when a router in the VRRP group fails, the hosts can still access the external network through the gateway address. Backup group 1 works in the load balancing mode to fully utilize gateway resources. On Router A, Router B, and Router C respectively, configure VFs to track the status of interface Ethernet 1/2. When an interface fails, the weight of the corresponding router decreases by a certain value, so that another router can take over. Figure 4: A simplified network diagram Network Router A Eth1/2 Router B Eth1/2 Eth1/2 Router C Master AVF 1 Backup AVF 2 Backup AVF 3 Eth1/1 IP: /24 VP: /24 Eth1/1 IP: /24 VP: /24 Eth1/1 IP: /24 VP: /24 IP: /24 IP: /24 IP: /24 Host A Host B Host C GLBP configuration 1. Configure Router A hostname RouterA track 1 interface Ethernet1/2 line-protocol interface Ethernet1/1 ip address glbp 1 ip glbp 1 ip glbp 1 priority 120 glbp 1 preempt delay minimum 5 glbp 1 load-balancing host-dependent glbp 1 weighting track 1 decrement 250 6

7 2. Configure Router B hostname RouterB track 1 interface Ethernet1/2 line-protocol interface Ethernet1/1 ip address glbp 1 ip glbp 1 priority 110 glbp 1 preempt delay minimum 5 glbp 1 load-balancing host-dependent glbp 1 weighting track 1 decrement Configure Router C hostname RouterC track 1 interface Ethernet1/2 line-protocol interface Ethernet1/1 ip address glbp 1 ip glbp 1 preempt delay minimum 5 glbp 1 load-balancing host-dependent glbp 1 weighting track 1 decrement 250 Verifying the configuration Check the GLBP status and configuration on Router A. The output shows that the configuration is effective, and that the backup group has been created. RouterA#show glbp Ethernet1/1 - Group 1 is Active 1 state change, last state change 00:12:00 Virtual IP address is Hello time 3 sec, hold time 10 sec Next hello sent in sec Redirect time 600 sec, forwarder time-out sec Preemption enabled, minimum delay 5 sec Active is local 7

8 Standby is , priority 110 (expires in sec) Priority 120 (configured) Weighting 100 (default 100), thresholds: lower 1, upper 100 Track object 1 state Up decrement 250 Load balancing: host-dependent Group members: ca00.06e ( ) local ca00.0c3c.0000 ( ) ca ( ) There are 3 forwarders (1 active) Forwarder 1 is Active 2 state changes, last state change 00:11:17 MAC address is 0007.b (default) is ca00.06e Redirection enabled Preemption enabled, minimum delay 30 sec Active is local, weighting 100 Forwarder 2 is Listen MAC address is 0007.b (learnt) is ca00.0c3c.0000 Redirection enabled, sec remaining (maximum 600 sec) Time to live: sec (maximum sec) Preemption enabled, minimum delay 30 sec Active is (primary), weighting 100 (expires in sec) Forwarder 3 is Listen MAC address is 0007.b (learnt) is ca Redirection enabled, sec remaining (maximum 600 sec) Time to live: sec (maximum sec) Preemption enabled, minimum delay 30 sec Active is (primary), weighting 100 (expires in sec) Migration from Cisco GLBP to VRRPE Migration guidelines Except traffic-based and weight-based load balancing algorithms, VRRPE supports all other configuration items as does GLBP. To migrate from a GLBP network to a VRRPE network, the key configuration items include virtual IP address, VF, priorities of the master router and backup routers, tracking, and holdtime in case of a failure. 8

9 Configure VRRPE as follows, to replace Cisco GLBP on Router A: Item GLBP value VRRPE value Interface IP address / /24 Backup group ID 1 1 Virtual IP address Backup group priority Preemption mode preempt preempt Hello time 3s 3s Tracked object Track 1 Track 1 Load balancing mode Host-based Host-based by default, which does not need to be configured Configure VRRPE as follows, to replace GLBP on Router B: Item GLBP value VRRPE value Interface IP address / /24 Backup group ID 1 1 Virtual IP address Backup group priority Preemption mode preempt preempt Hello time 3s 3s Tracked object Track 1 Track 1 Load balancing mode Host-based Host-based by default, which does not need to be configured Configure VRRPE as follows, to replace GLBP on Router C: Item GLBP value VRRPE value Interface IP address / /24 Backup group ID 1 1 Virtual IP address Backup group priority Preemption mode preempt preempt Hello time 3s 3s Tracked object Track 1 Track 1 Load balancing mode Host-based Host-based by default, which does not need to be configured Configuring VRRP 1. Configure Router A # Configure the router to work in VRRP load balancing mode. <RouterA> system-view [RouterA] vrrp mode load-balance # Create VRRP group 1, and assign virtual IP address to the group. [RouterA] interface ethernet 1/1 9

10 [RouterA-Ethernet1/1] ip address [RouterA-Ethernet1/1] vrrp vrid 1 virtual-ip # Configure the priority of Router A in VRRP group 1 as 120, which is higher than that of Router B (110), and that of Router C (100), so that Router A can become the master. [RouterA-Ethernet1/1] vrrp vrid 1 priority 120 # Configure Router A to work in preemptive mode so that it can become the master whenever it works normally. Configure the preemption delay as five seconds to avoid frequent status switchover. [RouterA-Ethernet1/1] vrrp vrid 1 preempt-mode timer delay 5 [RouterA-Ethernet1/1] quit # Create track entry 1 to associate with the physical status of Ethernet 1/2 on Router A. When the track entry becomes negative, it means that the interface has failed. [RouterA] track 1 interface ethernet 1/2 # Configure the VFs to monitor track entry 1, making the weight of Router A decrease by more than 245 (250 in this example) when track entry 1 turns to negative. In such a case, another router with a higher weight can take over. [RouterA] interface ethernet 1/1 [RouterA-Ethernet1/1] vrrp vrid 1 weight track 1 reduced Configure Router B # Configure the router to work in VRRP load balancing mode. <RouterB> system-view [RouterB] vrrp mode load-balance # Create VRRP group 1, and assign virtual IP address to the group. [RouterB] interface ethernet 1/1 [RouterB-Ethernet1/1] ip address [RouterB-Ethernet1/1] vrrp vrid 1 virtual-ip # Set the priority of Router B in VRRP group 1 to 110, which is higher than that of Router C (100), so that Router B can become the master when Router A fails. [RouterB-Ethernet1/1] vrrp vrid 1 priority 110 # Set Router B to work in preemptive mode and set the preemption delay to five seconds. [RouterB-Ethernet1/1] vrrp vrid 1 preempt-mode timer delay 5 [RouterB-Ethernet1/1] quit # Create track entry 1 to associate with the physical status of Ethernet 1/2 on Router B. When the track entry becomes negative, it means that the interface fails. [RouterB] track 1 interface ethernet 1/2 # Configure the VFs to monitor track entry 1, making the weight of Router B decrease by more than 245 (250 in this example) when track entry 1 turns to negative. In such a case, another router with a higher weight can take over. [RouterB] interface ethernet 1/1 [RouterB-Ethernet1/1] vrrp vrid 1 weight track 1 reduced Configure Router C # Configure the router to work in VRRP load balancing mode. <RouterC> system-view [RouterC] vrrp mode load-balance # Create VRRP group 1, and assign virtual IP address to the group. 10

11 [RouterC] interface ethernet 1/1 [RouterC-Ethernet1/1] ip address [RouterC-Ethernet1/1] vrrp vrid 1 virtual-ip # Set Router C to work in preemptive mode and set the preemption delay to five seconds. [RouterC-Ethernet1/1] vrrp vrid 1 preempt-mode timer delay 5 [RouterC-Ethernet1/1] quit # Create track entry 1 to associate with the physical status of Ethernet 1/2 on Router C. When the track entry becomes negative, it means that the interface fails. [RouterC] track 1 interface ethernet 1/2 # Configure the VFs to monitor track entry 1, making the weight of Router C decrease by more than 245 (250 in this example) when track entry 1 turns to negative. In such a case, another router with a higher weight can take over. [RouterC] interface ethernet 1/1 [RouterC-Ethernet1/1] vrrp vrid 1 weight track 1 reduced 250 Verifying the configuration Check that Host A can ping the external network. Use the display vrrp verbose command to verify the configuration. # Display detailed information about VRRP group 1 on Router A. [RouterA-Ethernet1/1] display vrrp verbose IPv4 Standby Information: Run Mode Run Method : Load Balance : Total number of virtual routers : 1 Interface Ethernet1/1 VRID : 1 Adver Timer : 1 Admin Status : Up : Master Config Pri : 120 Running Pri : 120 Preempt Mode : Yes Delay Time : 5 Auth Type : None Virtual IP : Member IP List : (Local, Master) (Backup) (Backup) Forwarder Information: 3 Forwarders 1 Active Config Weight : 255 Running Weight : 255 Forwarder 01 : Active : 000f-e2ff-0011 (Owner) : e Priority : 255 Active : local 11

12 Forwarder 02 : Listening : 000f-e2ff-0012 (Learnt) : e Forwarder 03 Priority : 127 Active : : Listening : 000f-e2ff-0013 (Learnt) : e Priority : 127 Active : Forwarder Weight Track Information: Track Object : 1 : Positive Weight Reduced : 250 # Display detailed information about VRRP group 1 on Router B. [RouterB-Ethernet1/1] display vrrp verbose IPv4 Standby Information: Run Mode Run Method : Load Balance : Total number of virtual routers : 1 Interface Ethernet1/1 VRID : 1 Adver Timer : 1 Admin Status : Up : Backup Config Pri : 110 Running Pri : 110 Preempt Mode : Yes Delay Time : 5 Auth Type : None Virtual IP : Member IP List : (Local, Backup) (Master) (Backup) Forwarder Information : 3 Forwarders 1 Active Config Weight : 255 Forwarder 01 Running Weight : 255 : Listening : 000f-e2ff-0011 (Learnt) : e Priority : 127 Active :

13 Forwarder 02 : Active : 000f-e2ff-0012 (Owner) : e Priority : 255 Active : local Forwarder 03 : Listening : 000f-e2ff-0013 (Learnt) : e Priority : 127 Active : Forwarder Weight Track Information: Track Object : 1 : Positive Weight Reduced : 250 # Display detailed information about VRRP group 1 on Router C. [RouterC-Ethernet1/1] display vrrp verbose IPv4 Standby Information: Run Mode Run Method : Load Balance : Total number of virtual routers : 1 Interface Ethernet1/1 VRID : 1 Adver Timer : 1 Admin Status : Up : Backup Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time : 5 Auth Type : None Virtual IP : Member IP List : (Local, Backup) (Master) (Backup) Forwarder Information : 3 Forwarders 1 Active Config Weight : 255 Running Weight : 255 Forwarder 01 : Listening : 000f-e2ff-0011 (Learnt) : e Priority : 127 Active :

14 Forwarder 02 : Listening : 000f-e2ff-0012 (Learnt) : e Forwarder 03 Priority : 127 Active : : Active : 000f-e2ff-0013 (Owner) : e Priority : 255 Active : local Forwarder Weight Track Information: Track Object : 1 : Positive Weight Reduced : 250 The output shows that in VRRP group 1, Router A is the master, and Router B and Router C are the backups. On each of the three routers, there is one AVF and two LVFs that act as backups. Summary As noted in this document, the Cisco GLBP protocol is proprietary. On the other hand, the VRRPE protocol is an open industry standard with wide industry support. We recommend that enterprises carry our network wide migration from GLBP to VRRPE. Cisco GLBP and VRRPE are not interoperable Recommend network-wide migration from GLBP to VRRPE For more information Please visit, Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. 4AA3-9289ENW, Created February 2012