WEBVTT 1 00:00.000 --> 00:04.360 Well, it's a tail as old as time the network industry has a need and 2 00:04.360 --> 00:10.960 In our case that need would be gateway redundancy and so the industry standards 3 00:10.960 --> 00:13.640 world can take a while to come up with a solution 4 00:13.640 --> 00:16.620 And so what we have is we have vendor solutions and especially 5 00:16.620 --> 00:22.880 Cisco very oftentimes steps in and says hey, we have a solution in this case 6 00:22.880 --> 00:26.760 It was HSRP and this was the original HSRP version one 7 00:27.280 --> 00:32.580 Well eventually the industry did catch up and said hey, we also have a solution WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 7 00:27.280 --> 00:32.580 Well eventually the industry did catch up and said hey, we also have a solution 8 00:32.580 --> 00:36.160 because Cisco proprietary protocols can only go on 9 00:36.160 --> 00:42.640 Cisco devices and so if I have two non-SISCO routers, I can't use HSRP here 10 00:42.640 --> 00:44.640 I would need something that is 11 00:44.640 --> 00:51.540 Allowed to be deployed because Cisco owns the rights to HSRP so instead the 12 00:51.540 --> 00:56.960 industry created the virtual router redundancy protocol or VRRP 13 00:57.520 --> 01:02.360 Now by all rights VRRP and HSRP they are very similar WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 13 00:57.520 --> 01:02.360 Now by all rights VRRP and HSRP they are very similar 14 01:02.360 --> 01:06.730 They're going to operate very similarly and even the configuration can be 15 01:06.730 --> 01:07.720 pretty similar 16 01:07.720 --> 01:12.590 But the industry does like to differentiate themselves a little bit from what 17 01:12.590 --> 01:13.000 Cisco 18 01:13.000 --> 01:17.760 Creates and so we do have a few differences and there's actually one pretty 19 01:17.760 --> 01:19.400 compelling difference 20 01:19.400 --> 01:25.850 with a VRRP that might even entice us to use VRRP instead of HSRP and to be 21 01:25.850 --> 01:26.420 clear 22 01:26.640 --> 01:28.320 Cisco devices 23 01:28.320 --> 01:33.480 So if we get a Cisco router or Cisco layer three switch we can choose HSRP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 23 01:28.320 --> 01:33.480 So if we get a Cisco router or Cisco layer three switch we can choose HSRP 24 01:33.480 --> 01:35.120 version one and version two 25 01:35.120 --> 01:39.140 We should always choose version two or we can choose VRRP 26 01:39.140 --> 01:43.110 Cisco does allow us to deploy that which is important because we might have a 27 01:43.110 --> 01:45.640 Cisco device and a non-SISCO device 28 01:45.640 --> 01:50.530 That are on the same network and we want to be able to run a protocol between 29 01:50.530 --> 01:51.800 them for gateway redundancy 30 01:51.800 --> 01:55.400 At that point it would require us to run VRRP 31 01:55.560 --> 01:58.440 So Cisco does play nice and deploys their own 32 01:58.440 --> 02:03.090 Protocols alongside the industry standard ones and I will say this in many WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 32 01:58.440 --> 02:03.090 Protocols alongside the industry standard ones and I will say this in many 33 02:03.090 --> 02:04.720 cases when this happens 34 02:04.720 --> 02:07.520 The Cisco version of a protocol goes away 35 02:07.520 --> 02:12.680 We think back all the way to when trunking was performed the Cisco's 36 02:12.680 --> 02:15.240 Inter switch link or ISL protocol 37 02:15.240 --> 02:20.420 They were the first ones to create the means for trunking between switches the 38 02:20.420 --> 02:22.880 industry eventually created 802.1 Q 39 02:22.880 --> 02:26.280 Or what we sometimes refer to as dot 1 Q trunking and 40 02:26.280 --> 02:31.540 That's great and also Cisco supported both for a long time well eventually ISL WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 40 02:26.280 --> 02:31.540 That's great and also Cisco supported both for a long time well eventually ISL 41 02:31.540 --> 02:34.320 disappeared even on Cisco devices these days 42 02:34.320 --> 02:36.320 We can't run ISL and 43 02:36.320 --> 02:41.730 So we might have expected HSRP to eventually disappear as well. I'd say the 44 02:41.730 --> 02:45.320 opposite is happened with Cisco networks when we're deploying all Cisco 45 02:45.320 --> 02:49.750 We typically see HSRP. It's just the protocol that a lot of Cisco engineers are 46 02:49.750 --> 02:50.520 comfortable with 47 02:50.920 --> 02:56.170 I say Cisco engineers. I mean you and I people who don't work for Cisco, but we 48 02:56.170 --> 02:58.600 're deploying Cisco technologies a lot of times 49 02:58.600 --> 03:02.000 We say okay, well HSRP is pretty simple. I understand it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 49 02:58.600 --> 03:02.000 We say okay, well HSRP is pretty simple. I understand it 50 03:02.000 --> 03:05.680 I can configure it and therefore I'm good and I don't need VRRP 51 03:05.680 --> 03:09.600 And if I'm running a fully Cisco network, there's no problem with that and in 52 03:09.600 --> 03:09.880 fact 53 03:09.880 --> 03:11.400 That's what we see a lot of today 54 03:11.400 --> 03:15.990 But naturally we also need to know and understand VRRP in order to be complete 55 03:15.990 --> 03:17.000 network engineers 56 03:17.200 --> 03:21.080 Because guess what there's going to be a day where we have to support either 57 03:21.080 --> 03:22.920 this topology or just flat out a 58 03:22.920 --> 03:27.560 Non-Sysco network that is running VRRP instead of HSRP 59 03:27.560 --> 03:32.200 Now again, we do have a lot of similarities WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 59 03:27.560 --> 03:32.200 Now again, we do have a lot of similarities 60 03:32.200 --> 03:36.040 between HSRP and VRRP and so for the most part 61 03:36.040 --> 03:40.870 We want to focus on the differences because we understand that there's going to 62 03:40.870 --> 03:41.840 be a node that is 63 03:42.880 --> 03:46.760 Operating the virtual IP address and then that node can fail and the other one 64 03:46.760 --> 03:49.880 takes over a lot of that initial FHRP conversation 65 03:49.880 --> 03:56.280 Is going to hold true for both protocols. So let's focus on the differences 66 03:56.280 --> 03:58.760 from HSRP 67 03:58.760 --> 04:04.450 So first of all we do have new terminology instead of active and standby we are WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 67 03:58.760 --> 04:04.450 So first of all we do have new terminology instead of active and standby we are 68 04:04.450 --> 04:06.440 going to have master and 69 04:06.440 --> 04:09.720 Backup 70 04:09.720 --> 04:12.440 These are the roles that we use for VRRP 71 04:12.440 --> 04:18.300 Furthermore if we have lots of routers in this network before we had the listen 72 04:18.300 --> 04:19.240 role for HSRP 73 04:19.240 --> 04:22.640 But here we're just going to have many backup roles 74 04:22.640 --> 04:26.350 So if I have four routers that are all part of this domain one will be the 75 04:26.350 --> 04:29.880 master the other three will all be backup routers 76 04:29.880 --> 04:36.400 Next we have to elect a master and we're still going to use the priority WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 76 04:29.880 --> 04:36.400 Next we have to elect a master and we're still going to use the priority 77 04:36.400 --> 04:37.280 concept although 78 04:37.520 --> 04:40.940 Interestingly at least on Cisco devices our priority is going to range from one 79 04:40.940 --> 04:41.280 to two 80 04:41.280 --> 04:47.000 54 so remember we had the full eight bit range zero to two fifty five with HSRP 81 04:47.000 --> 04:47.480 with 82 04:47.480 --> 04:50.640 VRP it's going to be between one and two fifty four 83 04:50.640 --> 04:56.320 We do have a one reason for that and we'll see that here coming up where the 84 04:56.320 --> 04:58.880 priority of two fifty five is reserved and 85 04:58.880 --> 05:03.520 Actually utilized whereas zero is also reserved. It's just not actually WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 85 04:58.880 --> 05:03.520 Actually utilized whereas zero is also reserved. It's just not actually 86 05:04.160 --> 05:09.280 Part of the framework at this time. So next we have timers same concept 87 05:09.280 --> 05:13.960 We're going to send our packets at a particular hello rate and we're going to 88 05:13.960 --> 05:20.830 Recognize that there's an outage after the hold timer expires except in our 89 05:20.830 --> 05:21.640 case here 90 05:21.640 --> 05:25.240 The default timers are different. It's going to be one second 91 05:25.240 --> 05:30.640 Hello timers and three second hold timers meaning that will detect a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 91 05:25.240 --> 05:30.640 Hello timers and three second hold timers meaning that will detect a 92 05:30.960 --> 05:35.600 Outage a whole lot faster with VRP if we use the default timers 93 05:35.600 --> 05:40.320 Furthermore, and this is an interesting thing preemption 94 05:40.320 --> 05:45.920 That's that same concept applies here, but it's actually enabled by default 95 05:45.920 --> 05:54.640 Just kind of an interesting configuration change from HSRP if we don't want the 96 05:54.640 --> 05:55.680 failover to 97 05:56.320 --> 06:01.540 Fall back to the original active then we don't do anything to the HSRP config, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 97 05:56.320 --> 06:01.540 Fall back to the original active then we don't do anything to the HSRP config, 98 06:01.540 --> 06:03.640 but for VRP we actually have to disable it 99 06:03.640 --> 06:06.480 Since it's enabled by default 100 06:06.480 --> 06:09.120 lastly authentication does still exist 101 06:09.120 --> 06:15.170 Although on Cisco devices we actually only support open authentication, which 102 06:15.170 --> 06:16.000 is kind of interesting 103 06:16.000 --> 06:19.200 So that means that we have plain text 104 06:19.200 --> 06:23.940 Passwords that are sent back and forth which doesn't help prevent the bad guys 105 06:23.940 --> 06:25.280 from breaking into our network 106 06:25.520 --> 06:29.340 But it does make it so we don't have accidental misconfigurations meaning that 107 06:29.340 --> 06:31.040 I've got a multiple WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 107 06:29.340 --> 06:31.040 I've got a multiple 108 06:31.040 --> 06:36.260 Maybe VRP groups on here and so I can authenticate with one password on these 109 06:36.260 --> 06:36.400 two 110 06:36.400 --> 06:40.320 authenticate with a different password on these two and that way 111 06:40.320 --> 06:46.240 Words less likely to accidentally cross our VRP streams so to speak 112 06:46.240 --> 06:52.210 Next we do need to talk about the addresses that are used from a multicast 113 06:52.210 --> 06:53.280 perspective 114 06:54.560 --> 07:00.000 VRP is going to have its own reserved address of 224.0.0.18 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 115 07:00.000 --> 07:04.480 So unlike HSRP version 1 which started with the all routers address 116 07:04.480 --> 07:08.320 VRP does have its own IP or MAC address 117 07:08.320 --> 07:13.400 multicast address from the beginning and also does have its own virtual MAC 118 07:13.400 --> 07:16.240 address range just like with HSRP 119 07:16.240 --> 07:21.280 And this one is going to be 00000.5e 120 07:22.080 --> 07:25.600 And then from here we have 0001xx 121 07:25.600 --> 07:29.760 Meaning that these last two are going to be based on the group ID 122 07:29.760 --> 07:33.760 Now just like we talked about before the fact that we have two hex characters WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 122 07:29.760 --> 07:33.760 Now just like we talked about before the fact that we have two hex characters 123 07:33.760 --> 07:36.320 means that we're going to have a total of 124 07:36.320 --> 07:39.280 256 groups 125 07:39.280 --> 07:45.520 And this doesn't change with different versions of VRRP we're going to be 126 07:45.520 --> 07:47.280 locked to 256 groups 127 07:47.440 --> 07:52.580 Meaning that if we do have that conversation we said if we have VLAN 500 for 128 07:52.580 --> 07:53.200 example 129 07:53.200 --> 07:55.600 We're going to have to match that up with group ID of 130 07:55.600 --> 08:01.040 17 something probably pretty random and we can do our best to associate it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 130 07:55.600 --> 08:01.040 17 something probably pretty random and we can do our best to associate it 131 08:01.040 --> 08:01.280 again 132 08:01.280 --> 08:03.280 Maybe 50s available, but 133 08:03.280 --> 08:09.440 Ultimately we're not able to lock in our group ID to match our VLAN ID using VR 134 08:09.440 --> 08:09.840 RP 135 08:09.840 --> 08:16.870 Now lastly we have one other really nifty feature that VRRP has that HSRP doesn 136 08:16.870 --> 08:16.960 't 137 08:17.360 --> 08:22.160 And that is that we can use a physical address as 138 08:22.160 --> 08:25.840 Our virtual address 139 08:25.840 --> 08:31.100 This is very interesting and first of all let's describe exactly what we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 139 08:25.840 --> 08:31.100 This is very interesting and first of all let's describe exactly what we're 140 08:31.100 --> 08:33.520 talking about and then we can explain why it matters 141 08:33.520 --> 08:39.110 So let's say that we have a pair of routers and we have these layer three 142 08:39.110 --> 08:39.920 interfaces 143 08:39.920 --> 08:43.840 That are connected to a broadcast domain 144 08:44.640 --> 08:47.600 A VLAN so we'll just say this is VLAN 100 145 08:47.600 --> 08:55.040 And if we wanted to configure this via HSRP or with VRRP the traditional way 146 08:55.040 --> 08:59.010 We would have a virtual IP address shared and therefore we'd have something 147 08:59.010 --> 09:01.280 like that dot 253 on the left WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 147 08:59.010 --> 09:01.280 like that dot 253 on the left 148 09:01.280 --> 09:03.600 dot 254 on the right and 149 09:03.600 --> 09:09.480 Dot 252 I guess up here I meant to start with 252, but we have three IP 150 09:09.480 --> 09:11.040 addresses in use here 151 09:11.600 --> 09:14.560 But we do have an option that we could use that 152 09:14.560 --> 09:20.080 Changes this up a little bit we could point to one of these physical addresses 153 09:20.080 --> 09:22.800 and say this is our virtual IP address 154 09:22.800 --> 09:25.920 Now it's no longer virtual. It's a physical address 155 09:25.920 --> 09:29.920 But here's what's interesting about this. I'm going to set my default gateway 156 09:29.920 --> 09:32.640 to whatever that IP address is so let's say it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 156 09:29.920 --> 09:32.640 to whatever that IP address is so let's say it's 157 09:32.640 --> 09:37.840 Dot 253 we've said before so my default gateway points to 253 158 09:38.560 --> 09:42.880 I'm still going to configure this router with its own IP address of dot 254 159 09:42.880 --> 09:46.000 And so if we 160 09:46.000 --> 09:51.230 Think about this is interesting because now I'm going to be pointing to this IP 161 09:51.230 --> 09:51.920 address 162 09:51.920 --> 09:57.460 And if this device were to go down I just lost access to my gateway. I lost 163 09:57.460 --> 09:58.720 access to 253 164 09:58.720 --> 10:01.760 Except if I'm running WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 164 09:58.720 --> 10:01.760 Except if I'm running 165 10:01.760 --> 10:04.320 VRRP here 166 10:05.760 --> 10:10.320 And I specify that this virtual address is dot 253 167 10:10.320 --> 10:13.760 Then that still allows me to have my master 168 10:13.760 --> 10:19.040 It allows me to have my backup and in the event that this interface goes down 169 10:19.040 --> 10:23.040 This device can take over for 253 170 10:23.040 --> 10:25.440 Pretty interesting 171 10:25.440 --> 10:28.880 We're not specifying a third IP address here. We're just taking 172 10:28.880 --> 10:34.080 Advantage or making use of the IP address that's already WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 172 10:28.880 --> 10:34.080 Advantage or making use of the IP address that's already 173 10:35.200 --> 10:39.040 Configured on the router on the left. So that's kind of cool 174 10:39.040 --> 10:43.980 Now there's a couple of things to note about this first and foremost is pre 175 10:43.980 --> 10:44.800 emption 176 10:44.800 --> 10:51.760 Preemption is not only must be enabled it also requires that we 177 10:51.760 --> 10:57.120 Keep one of the device that owns the IP address that has to be the master 178 10:57.120 --> 11:01.130 Which makes sense because if this device comes back online I could try to have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 178 10:57.120 --> 11:01.130 Which makes sense because if this device comes back online I could try to have 179 11:01.130 --> 11:02.400 preemption disabled 180 11:02.880 --> 11:09.520 But I own dot 253 I must fail back to the original master node because it needs 181 11:09.520 --> 11:11.680 to be online with the physical IP address 182 11:11.680 --> 11:17.630 So I would shut down my operations of dot 253 here on the right and defer to 183 11:17.630 --> 11:19.280 the original master 184 11:19.280 --> 11:23.850 So we have no choice about that second of all that priority value that we 185 11:23.850 --> 11:24.400 mentioned 186 11:24.400 --> 11:27.520 It's going to be locked to 255 187 11:28.320 --> 11:32.960 For this node again ensuring that it is the master WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 187 11:28.320 --> 11:32.960 For this node again ensuring that it is the master 188 11:32.960 --> 11:38.590 So long story short here that master device the device that owns that physical 189 11:38.590 --> 11:38.960 address 190 11:38.960 --> 11:43.520 Must be the master and it must always be the master if it's online meaning if 191 11:43.520 --> 11:44.240 it goes offline 192 11:44.240 --> 11:48.660 It has to preempt when it comes back online and that's just again the nature of 193 11:48.660 --> 11:50.720 running with the physical IP address 194 11:50.720 --> 11:53.360 If it's online it has to have ownership of it 195 11:53.360 --> 11:56.960 Now then we have to ask the question of why 196 11:57.760 --> 12:00.480 Why would we go to all of this trouble to have this feature WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 196 11:57.760 --> 12:00.480 Why would we go to all of this trouble to have this feature 197 12:00.480 --> 12:04.960 If we have a slash 24 subnet range we've got 198 12:04.960 --> 12:11.980 256 addresses, 254 usable and if I'm going to use three of those for my gate 199 12:11.980 --> 12:14.400 ways then I still have 251 addresses 200 12:14.400 --> 12:16.240 Not a big deal 201 12:16.240 --> 12:20.720 Well, there's probably not a compelling reason for us to do this with a slash 202 12:20.720 --> 12:21.520 24 203 12:21.520 --> 12:24.400 But now think about something much smaller 204 12:24.400 --> 12:26.960 Let's think about a slash 29 205 12:27.680 --> 12:31.600 A slash 29 has eight addresses and only six usable WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 205 12:27.680 --> 12:31.600 A slash 29 has eight addresses and only six usable 206 12:31.600 --> 12:37.440 And now let's imagine that this isn't a laptop connecting in let's imagine 207 12:37.440 --> 12:41.930 This is another layer three device that is pointing up to a gateway maybe some 208 12:41.930 --> 12:43.600 kind of internet edge topology 209 12:43.600 --> 12:48.080 So now we have a scenario where we only have six usable 210 12:48.080 --> 12:54.880 And I'm going to want to maximize my space if I'm using three of those for VRRP 211 12:55.520 --> 12:59.020 That only leaves me with three left one of which by the way needs to go right 212 12:59.020 --> 12:59.280 here 213 12:59.280 --> 13:04.730 So if I'm trying to perform any NAT type of operations my IP address usage is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 213 12:59.280 --> 13:04.730 So if I'm trying to perform any NAT type of operations my IP address usage is 214 13:04.730 --> 13:05.280 limited 215 13:05.280 --> 13:09.440 Meanwhile if I only use two for VRRP 216 13:09.440 --> 13:12.720 Well that increases it by an entire IP address 217 13:12.720 --> 13:16.920 And even though it's only one address percentage wise that's actually pretty 218 13:16.920 --> 13:17.120 good 219 13:17.120 --> 13:21.490 It gives me one more address that I can use for whatever it is that I need to 220 13:21.490 --> 13:21.760 use it 221 13:21.760 --> 13:24.720 Maybe it's other devices maybe it's NAT like I mentioned 222 13:24.720 --> 13:29.510 But either way this concept here where we have a very limited number of IP 223 13:29.510 --> 13:30.160 addresses WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 223 13:29.510 --> 13:30.160 addresses 224 13:30.160 --> 13:33.040 And we're using a first-hop redundancy protocol 225 13:33.040 --> 13:35.840 In order to facilitate gateway operations 226 13:35.840 --> 13:40.950 Well at that point we very well might need to rely on this physical address 227 13:40.950 --> 13:41.760 concept 228 13:41.760 --> 13:46.240 Which would lead us to turn off HSRP that was our plan or that's what we had 229 13:46.240 --> 13:47.040 running 230 13:47.040 --> 13:52.160 And enable VRRP to recover that IP address and be able to leverage it fully 231 13:52.160 --> 13:57.820 But oh at the end of this conversation we see that outside of this specific 232 13:57.820 --> 13:58.480 scenario 233 13:58.480 --> 14:02.800 VRRP operation is very similar to HSRP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 233 13:58.480 --> 14:02.800 VRRP operation is very similar to HSRP 234 14:02.800 --> 14:05.840 We just have to understand the new address format 235 14:05.840 --> 14:09.040 And we have to understand that configuration wise there are going to be 236 14:09.040 --> 14:09.920 differences 237 14:09.920 --> 14:13.920 And a little bit of difference in terminology when compared to HSRP