Lab 8.2: VRRP Configuration & Master/Backup Failover

📋 Lab Overview & Objectives

Lab Objective: Master VRRP (Virtual Router Redundancy Protocol) configuration, master/backup router election, priority-based failover, and multi-vendor gateway redundancy for enterprise networks. VRRP is an open-standard protocol (RFC 5798) enabling multi-vendor support .

🎯 Learning Outcomes

Configure VRRP on two routers with master/backup roles
Understand VRRP as an open-standard protocol (RFC 5798)
Configure VRRP timers (advertisement interval and hold time)
Implement object tracking with VRRP for dynamic failover
Verify VRRP status and master router election
Test failover and recovery scenarios
Configure MD5 and SHA authentication
Compare VRRP with HSRP and GLBP protocols

Key VRRP Components

Component	Description	Lab Value
Virtual IP (VIP)	Shared IP address from local subnet used as default gateway	192.168.1.1
Virtual MAC	VRRP MAC format: 00:00:5E:00:01:xx	0000.5E00.0101
Priority	Master election (0-255, default 100) - Higher wins	110 (Master), 100 (Backup)
Advertisement Interval	Master sends keepalives every 1 second (VRRPv2) or 100ms (VRRPv3)	1 second
Master Dead Timer	Failover detection timer (default 3 seconds VRRPv2)	3 seconds

🌐 Network Topology

VRRP Lab Network Diagram

Network topology showing Router A (Master) and Router B (Backup) with VRRP configuration for multi-vendor redundancy

✅ Two routers configured with VRRP Group 1. Router A (Master, priority 110) forwards traffic. Router B (Backup, priority 100) monitors and takes over if Router A fails. Both share VIP 192.168.1.1 and VMAC 0000.5E00.0101 .

📚 VRRP - Open Standard Protocol

VRRP Key Advantages :

✅ Open Standard (RFC 5798) - Multi-vendor support
✅ Fast convergence (~300ms with VRRPv3)
✅ IPv4 and IPv6 support (VRRPv3)
✅ Better timer precision than HSRPv1
✅ Industry-standard for enterprise deployments

VRRP Version Comparison

Feature	VRRPv2	VRRPv3
IP Version Support	IPv4 only	IPv4 and IPv6
Group Range	0-255	0-4095
Advertisement Interval	1 second default	100ms default
Convergence Time	~3 seconds	~300 milliseconds
Authentication	MD5 only	MD5, SHA-1, SHA-256

⚙️ Step-by-Step Configuration Guide

STEP 1: Prerequisites & Lab Setup

Equipment Required:

2 x Cisco Routers (or multi-vendor if VRRP-compatible)
2 x Network Interfaces (Gi0/1)
1 x Layer 2 Switch
3+ PCs/VMs for client testing

STEP 2: Router A Configuration (Master)

enable configure terminal ! hostname Router-A ! interface GigabitEthernet0/1 description VRRP Master Interface ip address 192.168.1.2 255.255.255.0 ! ! Configure VRRP Group 1 (VRRPv2) vrrp 1 ip 192.168.1.1 vrrp 1 priority 110 vrrp 1 timers advertise 1 vrrp 1 preempt vrrp 1 authentication md5 key-string VRRPKey123 ! no shutdown ! end write memory

STEP 3: Router B Configuration (Backup)

enable configure terminal ! hostname Router-B ! interface GigabitEthernet0/1 description VRRP Backup Interface ip address 192.168.1.3 255.255.255.0 ! ! Configure VRRP Group 1 (VRRPv2) vrrp 1 ip 192.168.1.1 vrrp 1 priority 100 vrrp 1 timers advertise 1 vrrp 1 preempt vrrp 1 authentication md5 key-string VRRPKey123 ! no shutdown ! end write memory

STEP 4: VRRPv3 Configuration (Advanced)

! Router A (IPv4) enable configure terminal interface GigabitEthernet0/1 ip address 192.168.1.2 255.255.255.0 ! vrrp 1 address-family ipv4 address 192.168.1.1 primary priority 110 timers advertise msec 100 preempt delay minimum 0 authentication md5 key-string VRRPv3Key123 ! no shutdown ! end write memory

STEP 5: VRRPv3 - IPv6 Configuration

! Router A (IPv6) enable configure terminal interface GigabitEthernet0/1 ipv6 address 2001:DB8::2/64 ! vrrp 1 address-family ipv6 address 2001:DB8::1 primary priority 110 timers advertise msec 100 authentication md5 key-string VRRPv3Key123 ! no shutdown ! end write memory

STEP 6: Configure Object Tracking

! Router A - Track WAN interface configure terminal ! track 1 interface Serial0/0 line-protocol ! interface GigabitEthernet0/1 vrrp 1 track 1 decrement 20 ! If Serial0/0 down: 110 - 20 = 90 (Router B becomes master) ! end write memory

STEP 7: Configure IP SLA with VRRP

! Router A - Monitor remote gateway configure terminal ! ip sla 1 icmp-echo 10.0.0.1 frequency 10 timeout 1000 ! ip sla schedule 1 life forever start-time now ! track 2 ip sla 1 reachability ! interface GigabitEthernet0/1 vrrp 1 track 2 decrement 25 ! end write memory

✅ Verification Procedures

Check 1: VRRP Master Status on Router A

Router-A# show vrrp Interface Group Version Priority Time Own State Master Gi0/1 1 v2 110 1 Yes Master 192.168.1.2 Router-A# show vrrp detail Gi0/1 - Group 1 State is Master Virtual IP address is 192.168.1.1 Virtual MAC address is 0000.5e00.0101 Advertisement interval is 1 sec Preemption enabled Priority is 110 Master Router is 192.168.1.2 (local) Master Advertisement interval is 1 sec Master Down interval is 3.609 sec Authentication MD5, key chain "not set"

✅ EXPECTED: State is Master | Priority: 110 | Role: Master

Check 2: VRRP Backup Status on Router B

Router-B# show vrrp Interface Group Version Priority Time Own State Master Gi0/1 1 v2 100 1 No Backup 192.168.1.2 Router-B# show vrrp detail Gi0/1 - Group 1 State is Backup Virtual IP address is 192.168.1.1 Virtual MAC address is 0000.5e00.0101 Advertisement interval is 1 sec Preemption enabled Priority is 100 Master Router is 192.168.1.2, priority 110 Master Advertisement interval is 1 sec Master Down interval is 3.609 sec Authentication MD5, key chain "not set"

✅ EXPECTED: State is Backup | Master: 192.168.1.2 (Router A)

Check 3: Client Connectivity Test

C:\> ping 192.168.1.1 Pinging 192.168.1.1 with 32 bytes of data: Reply from 192.168.1.1: bytes=32 time=1ms TTL=255 Reply from 192.168.1.1: bytes=32 time=1ms TTL=255 Ping statistics: Sent=4, Received=4, Lost=0 (0% loss)

✅ EXPECTED: Successful ping to VIP with 0% packet loss

Check 4: Monitor Tracked Objects

Router-A# show track Track 1 interface GigabitEthernet0/1 line-protocol Reachability is Up Track 2 ip sla 1 reachability Reachability is Up

🔄 Failover Testing Scenarios

Scenario 1: Master Router Failure

Test: Simulate master router failure by disabling Gi0/1 on Router A

Router-A# configure terminal Router-A(config)# interface GigabitEthernet0/1 Router-A(config-if)# shutdown

Expected Result (Wait 3-4 seconds):

✅ Router B transitions to Master automatically
✅ Client ping continues without interruption
✅ Failover time: ~3 seconds (VRRPv2) or ~300ms (VRRPv3)

Scenario 2: Recovery with Preemption

Test: Re-enable Gi0/1 on Router A to test preemption

Router-A# configure terminal Router-A(config)# interface GigabitEthernet0/1 Router-A(config-if)# no shutdown

Expected Result (Wait 30 seconds):

✅ Router A reclaims Master role (priority 110 > 100)
✅ Preemption enabled by default in VRRP
✅ Router B returns to Backup state

Scenario 3: Tracked Object Failure

Test: Simulate WAN link failure to test tracking

Router-A# configure terminal Router-A(config)# interface Serial0/0 Router-A(config-if)# shutdown ! Router-A# show track 1 Track 1 Reachability is Down ! Router-A# show vrrp State is Backup Priority 90 (110 - 20 decrement)

Expected Result:

✅ Track object detects failure
✅ Router A priority decrements (110 - 20 = 90)
✅ Router B (100) becomes Master automatically
✅ Dynamic failover without manual intervention

🐛 Troubleshooting Guide

Issue 1: Both Routers Show Backup State

Symptoms: Neither router becomes Master

Solutions :

Verify interfaces are UP/UP on both routers
Check VRRP group numbers match on both routers
Verify authentication keys match exactly
Check IPv4 address configuration

Issue 2: Master Election Fails

Symptoms: Master changes rapidly (flapping)

Solutions:

Check for interface instability
Verify priorities are different
Increase advertisement interval if necessary

Issue 3: Authentication Failures

Symptoms: "Authentication failed" messages