VARP

Virtual-ARP (VARP) allows multiple switches to simultaneously route packets from a common IP address in an active-active router configuration. Each switch is configured with the same set of virtual IP addresses on corresponding VLAN interfaces and a common virtual MAC address. In MLAG configurations, VARP is preferred over VRRP because VARP does not require traffic to traverse the peer-link to the master router as VRRP would.

A maximum of 500 virtual IP addresses can be assigned to a VLAN interface. All virtual addresses on all VLAN interfaces resolve to the same virtual MAC address.

VARP functions by having each switch respond to ARP and GARP requests for the configured router IP address with the virtual MAC address. The virtual MAC address is only for inbound packets and never used in the source field of outbound packets.

When ip routing is enabled, packets to the virtual MAC address are routed to the next hop destination.

Figure 1. VARP Configuration
The following sections are included in this chapter:

VRRP and VARP Conceptual Overview

This section review the following topics:

VRRPv2

A virtual router, also known as a virtual router group, is defined by a virtual router identifier (VRID) and a virtual IP address. A virtual routers mapping of VRID and IP address must be consistent among all switches implementing the virtual router group. A virtual routers scope is restricted to a single LAN.

A LAN may contain multiple virtual routers for distributing traffic. Each virtual router on a LAN is assigned a unique VRID. A switch may be configured with virtual routers among multiple LANs.

VRRP uses priority ratings to assign Master or Backup roles for each VRRP router configured for a virtual router group. The Master router sends periodic VRRP Advertisement messages along the LAN and forwards packets received by the virtual router to their destination. Backup routers are inactive but are available to assume Master router duties when the current Master fails.

A VRRP can be configured to allow VRRP routers with higher priority to take over Master router duties. Alternatively, the group can be configured to prevent a router from preemptively assuming the Master role. A VRRP router is always assigned the Master of any virtual router configured with the address owned by the VRRP router, regardless of the preemption prevention setting.

VRRPv3

RFC 5798 defines version 3 of the Virtual Router Redundancy Protocol (VRRP) for both IPv4 and IPv6. It is based on version 2 of VRRP, as defined in RFC 3768.

VARP

Virtual-ARP (VARP) allows multiple switches to simultaneously route packets from a common IP address in an active-active router configuration. Each switch is configured with the same set of virtual IP addresses on corresponding VLAN interfaces and a common virtual MAC address. In MLAG configurations, VARP is preferred over VRRP because VARP does not require traffic to traverse the peer-link to the master router as VRRP would.

A maximum of 500 virtual IP addresses can be assigned to a VLAN interface. All virtual addresses on all VLAN interfaces resolve to the same virtual MAC address.

VARP functions by having each switch respond to ARP and GARP requests for the configured router IP address with the virtual MAC address. The virtual MAC address is only for inbound packets and never used in the source field of outbound packets.

When ip routing is enabled, packets to the virtual MAC address are routed to the next hop destination.

Figure 2. VARP Configuration
The following sections are included in this chapter:

VRRP and VARP Implementation Procedures

This section contains the following configuration instructions:

VRRP Configuration for IPv4

To implement a virtual router, it must be configured and enabled. A virtual router is typically configured before it is enabled; this ensures that the VRRP router operates as required before its priority settings immediately make it the master virtual router. Because assigning a primary address to a virtual router enables it, address assignment is normally performed after all other configuration tasks.

The no vrrp command removes all VRRP commands for the specified virtual router from running-config.

Virtual Router Configuration

Most configuration tasks are optional because all mandatory parameters have a default value. The following virtual router parameters are configurable:

  • VRRP version (default = version 2)
  • Router priority (default = 100)
  • Preemption option (default is enabled)
  • Advertisement timer (default = one second)
  • Description (optional parameter)
  • Peer authentication (optional parameter)
  • Secondary IP addresses (optional parameter)
VRRP Version

The vrrp ipv4 version command sets the version of VRRP for the corresponding IPv4 virtual router. IPv6 version is not configurable as it only supports version 3. The version selected in a VRRP group can either be same for all group members or independent of each other. By default, Arista switches use VRRP version 2, which supports only IPv4 environments. VRRP version 3 supports both IPv4 and IPv6 environments.

Example

  • This command causes VLAN 20 to use VRRP version 3.
    switch(config)#interface vlan 20
switch(config-if-vl20)#vrrp 1 ipv4 version 3
switch(config-if-vl20)#
Master and Backup Router

The VRRP routers within a virtual router group determine the Master router through priority settings. Priority values range from 254 (highest priority) to 1 (lowest priority). Priority is either set by a CLI command or is assigned the default value of 100. A switch specifies priority settings for each of its virtual routers. Once set, VRRP priority level can also be changed by a tracked object. The vrrp tracked-object command configures the VRRP client process to track an object created by the track command and react if its status changes to down.

Preemption mode determines when a VRRP router with a higher priority rating becomes the Master router. If preemption is enabled, the VRRP router with the highest priority immediately becomes the Master router. If preemption is disabled, a VRRP router with a higher priority value does not become the Master router unless the current Master becomes unavailable; this is applicable when a new VRRP router becomes available on the LAN or VRRP routers priority value changes for the virtual router.

The vrrp priority-level command configures the switchs priority setting for the specified virtual router.

Example

  • This command sets the priority value of 250 for the virtual router with VRID 15 on VLAN 20.
    switch(config-if-vl20)#vrrp 15 priority-level 250
switch(config-if-vl20)#

The vrrp preempt command controls the preempt mode setting of the specified virtual router. By default, preempt mode is enabled.

Examples

  • This command disables preempt mode for the virtual router 15 on VLAN 20.
    switch(config-if-vl20)#no vrrp 15 preempt
switch(config-if-vl20)#
  • This command enables preempt mode for the virtual router 30 on VLAN 20.
    switch(config-if-vl20)#vrrp 30 preempt
switch(config-if-vl20)#

The vrrp preempt delay command configures a period between an event that elevates a switch to master VRRP router status and the switchs assumption of master VRRP router role. Command options configure delays during normal operation and after a switch reboot.

Advertisement Interval

The Master router sends periodic VRRP Advertisement messages to other VRRP routers. The vrrp advertisement interval command specifies the interval between successive advertisement message transmissions.

The advertisement interval also defines the timeout that determines when the switch assumes the Master router role. This timeout interval is three times the advertisement interval.

Example

  • This command sets the advertisement interval of 10 seconds for virtual router 35 on VLAN 100.
    switch(config-if-vl100)#vrrp 35 advertisement interval 10
switch(config-if-vl100)#
Description

The vrrp session description command associates a text string to the specified virtual router. The maximum string length is 80 characters. The string has no functional impact on the virtual router.

Example

  • This command associates the text string Laboratory Router to virtual router 15 on VLAN 20.
    switch(config-if-vl20)#vrrp 15 session description Laboratory Router
switch(config-if-vl20)#
Peer Authentication

VRRP peer authentication validates VRRP advertisement packets that the switch receives from other VRRP routers in a specified virtual router group. When a virtual router uses authentication, all VRRP routers in the group must use the same authentication parameters.

The vrrp peer authentication command configures virtual router authentication parameters for the specified virtual router.

Example

  • This command implements plain-text authentication, using 12345 as the key, for virtual router 40 on VLAN 100.
    switch(config-if-vl100)#vrrp 40 peer authentication text 12345
switch(config-if-vl100)#
Secondary Addresses

The vrrp ipv4 secondary command assigns a secondary IP address to a virtual router. Secondary addresses are optional; a virtual routers configuration may include more than one secondary address command. The primary and secondary address list must be identical for all switches in a virtual router group.

A primary IP address is assigned to a virtual router with the vrrp ipv4 command (Virtual Router Enabling and the Primary IP address).

Example

  • This command assigns the IP address of 10.2.4.5 as the secondary IP address for the virtual router 15 on VLAN 20
    switch(config-if-vl20)#vrrp 15 ipv4 10.2.4.5 secondary
switch(config-if-vl20)#

Virtual Router Enabling and the Primary IP address

The vrrp ipv4 command configures the primary IP address of the specified virtual router and enables the virtual router if the primary address is contained within the configuration mode interfaces IP address subnet. A virtual routers configuration may contain only one primary IP address assignment command; subsequent vrrp ipv4 commands reassign the virtual routers primary IP address.

Example
  • This command enables virtual router group 15 (VRID) on VLAN 20 and assigns 10.1.1.5 as the virtual routers primary address.
    switch(config-if-vl20)#vrrp 15 ipv4 10.1.1.5
switch(config-if-vl20)#

Disabling VRRP

The vrrp disabled command places the switch in stopped state for the specified virtual router. While in stopped state, the switch cannot act as a Master or backup router for the virtual router group. The no vrrp disabled command changes the switchs virtual router state to backup or master if the virtual router is properly configured.

VRRP can also be shut down when the status of a tracked object configured by the vrrp tracked-object command changes to down.

Examples

  • This command places the switch in stopped mode for virtual router 24 on VLAN 20.
    switch(config-if-vl20)#vrrp 24 disabled
switch(config-if-vl20)#
  • This command moves the switch out of stopped mode for virtual router 24 on VLAN 20.
    switch(config-if-vl20)#no vrrp 24 disabled
switch(config-if-vl20)#
  • This command configures the switch to enter stopped mode for virtual router 24 on VLAN 20 if the status of tracked object interfaceE6/48 changes to down.
    switch(config-if-vl20)#vrrp 24 tracked-object interfaceE6/48 shutdown
switch(config-if-vl20)#

The no vrrp and no vrrp ipv4 commands delete the specified virtual IP address from the interface. Additionally, the no vrrp command removes all residual VRRP commands for the virtual router.

Examples
  • This command removes all VRRP configuration commands for virtual router 10 on VLAN 15.
    switch(config-if-vl15)#no vrrp 10
switch(config-if-vl15)#
  • This command disables virtual router 25 on VLAN 20 and removes the primary IP address from its configuration.
    switch(config-if-vl20)#no vrrp 25 ipv4 10.1.1.5
switch(config-if-vl20)#

VRRP Configuration for IPv6

To implement a virtual router, it must be configured and enabled. A virtual router is typically configured before it is enabled; this ensures that the VRRP router operates as required before its priority settings immediately make it the master virtual router. Because assigning a primary address to a virtual router enables it, address assignment is normally performed after all other configuration tasks.

The no vrrp command removes all VRRP commands for the specified virtual router from running-config.

Configuring VRRP for IPv6

Specify the VRRP Version

The vrrp ipv4 version command sets the version of VRRP used on an interface. The version selected in a VRRP group must be the same for all group members. By default, Arista switches use VRRP version 2, which is not compatible with IPv6.

Example

  • This command causes VLAN 20 to use VRRP version 3.
    switch(config)#interface vlan 20
switch(config-if-vl20)#vrrp 1 ipv4 version 3
switch(config-if-vl20)#
Create a VRRP Group and Configure a Virtual IPv6 Address

The vrrp ipv6 command assigns an IPv6 address to the interface being configured and creates a VRRP group.

Example

  • These commands create VRRP group 3 and configure a virtual IPv6 address for the VRRP group on the VLAN 20 interface.
    switch(config)#interface vlan 20
switch(config-if-vl20)#vrrp 3 ipv6 2001:db8:0:1::1
switch(config-if-vl20)#
Configure Tracking

The vrrp tracked-object command configures the VRRP client process to track an object created by the track command and react if its status changes to down.

Example

  • This command causes interface VLAN 20 to disable VRRP when tracked object ETH8 changes state.
    switch(config-if-vl20)#vrrp 1 tracked-object ETH8 shutdown
switch(config-if-vl20)#
Configure the Priority Level

The vrrp priority-level command configures the switchs priority setting for the specified virtual router.

Example

  • This command sets the priority value of 250 for the virtual router with VRID 15 on VLAN 20.
    switch(config-if-vl20)#vrrp 15 priority-level 250
switch(config-if-vl20)#
Configure the Preemption Mode

Preemption mode determines when a VRRP router with a higher priority rating becomes the Master router. If preemption is enabled, the VRRP router with the highest priority immediately becomes the Master router. If preemption is disabled, a VRRP router with a higher priority value does not become the Master router unless the current Master becomes unavailable; this is applicable when a new VRRP router becomes available on the LAN or VRRP routers priority value changes for the virtual router.

The vrrp preempt command controls the preempt mode setting of the specified virtual router. By default, preempt mode is enabled.

Example

  • This command enables preempt mode for the virtual router 30 on VLAN 20.
    switch(config-if-vl20)#vrrp 30 preempt
Configure the VRRP Advertisement Interval

The ip virtual-router mac-address advertisement-interval command specifies the interval between advertisement packets sent by the master router to the VRRP group members.

Example

  • This command configures a MAC address advertisement interval of one minute (60 seconds).
    switch(config)#interface vlan 20
switch(config-if-vl20)#ip virtual-router mac-address advertisement-interval 60
switch(config-if-vl20)#

Verify VRRP IPv6 Configurations

Use the following commands to display the VRRP configurations and status.

Show VRRP Group

The show vrrp command displays information about the Virtual Router Redundancy Protocol (VRRP) groups configured on a specified interface.

Examples

  • This command displays a table of information for VRRP groups on the switch.
    switch#show vrrp interface vlan 3060 brief
Interface IdVer Pri TimeState VrIps
Vlan30601 3 100 3609Master2001::2
2001::3
Vlan30602 3 100 3609Master2002::2
2002::3
switch#

VARP Configuration

Implementing VARP consists of assigning virtual IP addresses to VLAN interfaces and configuring a virtual MAC address.

Virtual IP Addresses

The ip virtual-router address command assigns a virtual IP address to the VLAN interface being configured. Unlike VRRP, the virtual IP address does not have to be in the same subnet as the physical interface.

A virtual IPv4 address may optionally be configured with a subnet, but doing so will modify the behavior of ARP requests sent from the router. When the router sends an ARP request for an IPv4 address in a virtual subnet, the ARP request will use the virtual IPv4 address as the source IP address and the virtual MAC address as the source MAC address inside the ARP header. For virtual IP addresses configured without the subnet option, no modifications are made to outgoing ARP requests.

Examples

  • These commands configure a Switch Virtual Interface (SVI) and a virtual IP address for VLAN 10.
    switch(config)#interface vlan 10
switch(config-if-Vl10)#ip address 10.0.0.2/24
switch(config-if-Vl10)#ip virtual-router address 10.0.0.6
switch(config-if-Vl10)#ipv6 address 2001::1/64
switch(config-if-Vl10)#ipv6 virtual-router address 2001::2
switch(config-if-Vl10)#exit
switch(config)#
  • These commands configure a Switch Virtual Interface (SVI) and a virtual IPv4 address with a subnet for VLAN 10. A static route is added to indicate that the virtual subnet is reachable through VLAN 10.
    switch(config)#ip route 192.0.0.0/24 vlan 10
switch(config)#interface vlan 10
switch(config-if-Vl10)#ip address 10.0.0.2/24
switch(config-if-Vl10)#ip virtual-router address 192.0.0.6/24
switch(config-if-Vl10)#exit
switch(config)#

Virtual MAC Address

The ip virtual-router mac-address command assigns a virtual MAC address to the switch. The switch maps all virtual router IP addresses to this MAC address. The address is receive-only; the switch never sends packets with this address as the source.

When the destination MAC of a packet destined to a remote network matches the virtual MAC address, the MLAG peer forwards the traffic to the next hop destination. Each MLAG peer must have the same routes available, either though static configuration or learned through a dynamic routing protocol.

Example

  • This command configures a virtual MAC address.
    switch(config)#ip virtual-router mac-address 001c.7300.0099
switch(config)#

Show Virtual MAC Address

To display the virtual router MAC and IP addresses, enter the show ip virtual-router command.

Example

  • This command displays the virtual router addresses assigned on the switch.
    switch#show ip virtual-router
IP virtual router is configured with MAC address: 24cd.5a29.cc31
InterfaceIP AddressVirtual IP Address StatusProtocol
Vlan15 10.1.1.3/24 10.1.1.15upup
Vlan15 10.1.1.3/24 10.1.1.16upup
Vlan15 10.1.1.3/24 10.1.1.17upup
Vlan20 10.12.1.6/2410.1.1.51upup
Vlan20 10.12.1.6/2410.1.1.53upup
Vlan20 10.12.1.6/2410.1.1.55upup
switch#

Show IPv6 Virtual-Router

The show ipv6 virtual-router command displays the virtual MAC address assigned to the switch and all virtual IPv6 addresses assigned to each VLAN interface.

Examples

  • This command displays a table of information for IPv6 VRRP groups on the switch.
    switch#show ipv6 virtual-router
IP virtual router is configured with MAC address: 001c.7300.0099
MAC address advertisement interval: 30 seconds
Interface Vlan4094
State is up
Protocol is up
IPv6 address
2001:b8:2001::1011/64
Virtual IPv6 address
2001:db8:ac10:fe01::
switch#

VRRP and VARP Implementation Examples

This section contains the following example set:

VRRP Examples

This section provides code that implements three VRRP configurations:

  • Example 1 configures two switches in a single virtual router group. This implementation protects the LAN against the failure of one router.
  • Example 2 configures two switches into two virtual routers within a single LAN. This implementation protects the LAN against the failure of one router and balances traffic between the routers.
  • Example 3 configures three switches to implement virtual routers on two LANs. Each LAN contains two virtual routers. One switch is configured into four virtual routers – two on each LAN.

VRRP Example 1: One Virtual Router on One LAN

VRRP Example 1 Network Diagram displays the Example 1 network. Two switches are configured as VRRP routers to form one virtual router.

Figure 3. VRRP Example 1 Network Diagram

The following code configures the first switch (Router A) as the master router and the second switch (Router B) as a backup router for virtual router 10 on VLAN 50. Router A becomes the Master virtual router by setting its priority at 200; Router B maintains the default priority of 100. The advertisement interval is three seconds on both switches. Priority preemption is enabled by default.

Switch code that implements Router A on the first switch
switch-A(config)#interface vlan 50
switch-A(config-if-vl50)#ip address 10.10.4.1/24
switch-A(config-if-vl50)#no vrrp 10
switch-A(config-if-vl50)#vrrp 10 priority 200
switch-A(config-if-vl50)#vrrp 10 advertisement interval 3
switch-A(config-if-vl50)#vrrp 10 ip 10.10.4.10
switch-A(config-if-vl50)#exit
Switch code that implements Router B on the second switch
switch-B(config)#interface vlan 50
switch-B(config-if-vl50)#ip address 10.10.4.2/24
switch-B(config-if-vl50)#no vrrp 10
switch-B(config-if-vl50)#vrrp 10 advertisement interval 3
switch-B(config-if-vl50)#vrrp 10 ip 10.10.4.10
switch-B(config-if-vl50)#exit

VRRP Example 2: Two Virtual Routers on One LAN

VRRP Example 2 Network Diagram displays Example 2. Two switches are configured as VRRP routers to form two virtual routers on one LAN. Using two virtual routers distributes the LAN traffic between the switches.

Figure 4. VRRP Example 2 Network Diagram

The following code configures two switches as a master and a backup router for two virtual routers on VLAN 50.

  • Router A is the master for virtual router 10 and backup for virtual router 20.
  • Router B is the master for virtual router 20 and backup for virtual router 10.
  • VRRP advertisement interval is 3 seconds on virtual router 10 and 5 seconds on virtual router 20.
  • Priority preemption is enabled by default for both virtual routers.
Switch code that implements Router A on the first switch
switch-A(config)#interface vlan 50
switch-A(config-if-vl50)#ip address 10.10.4.1/24
switch-A(config-if-vl50)#no vrrp 10
switch-A(config-if-vl50)#vrrp 10 priority 200
switch-A(config-if-vl50)#vrrp 10 advertisement interval 3
switch-A(config-if-vl50)#vrrp 10 ip 10.10.4.10
switch-A(config-if-vl50)#no vrrp 20
switch-A(config-if-vl50)#vrrp 20 advertisement interval 5
switch-A(config-if-vl50)#vrrp 20 ip 10.10.4.20
switch-A(config-if-vl50)#exit
Switch code that implements Router B on the second switch
switch-B(config)#interface vlan 50
switch-B(config-if-vl50)#ip address 10.10.4.2/24
switch-B(config-if-vl50)#no vrrp 10
switch-B(config-if-vl50)#vrrp 10 advertisement interval 3
switch-B(config-if-vl50)#vrrp 10 ip 10.10.4.10
switch-B(config-if-vl50)#no vrrp 20
switch-B(config-if-vl50)#vrrp 20 priority 200
switch-B(config-if-vl50)#vrrp 20 advertisement interval 5
switch-B(config-if-vl50)#vrrp 20 ip 10.10.4.20
switch-B(config-if-vl50)#exit

VRRP Example 3: Two Virtual Routers on Two LANs

VRRP Example 3 Network Diagram displays Example 3. Three switches are configured as VRRP routers to form four virtual router groups two groups on each of two LANs.

Figure 5. VRRP Example 3 Network Diagram

The following code configures the three switches as follows:

  • Router A is the master for virtual router 10 and backup for virtual router 20 on VLAN 100.
  • Router A is the master for virtual router 30 and backup for virtual router 40 on VLAN 150.
  • Router B is the master for virtual router 20 and backup for virtual router 10 on VLAN 100.
  • Router C is the master for virtual router 40 and backup for virtual router 30 on VLAN 150.
  • VRRP advertisement interval is set to one second on all virtual routers.
  • Priority preemption is disabled on all virtual routers.
Switch code that implements Router A on the first switch
switch-A(config)#interface vlan 100
switch-A(config-if-vl100)#ip address 10.10.4.1/24
switch-A(config-if-vl100)#no vrrp 10
switch-A(config-if-vl100)#vrrp 10 priority 200
switch-A(config-if-vl100)#no vrrp 10 preempt
switch-A(config-if-vl100)#vrrp 10 ip 10.10.4.10
switch-A(config-if-vl100)#vrrp 10 advertisement interval 1
switch-A(config-if-vl100)#no vrrp 20
switch-A(config-if-vl100)#no vrrp 20 preempt
switch-A(config-if-vl100)#vrrp 20 ip 10.10.4.20
switch-A(config-if-vl100)#interface vlan 150
switch-A(config-if-vl150)#ip address 40.10.5.7/24
switch-A(config-if-vl150)#no vrrp 30
switch-A(config-if-vl150)#vrrp 30 priority 200
switch-A(config-if-vl150)#no vrrp 30 preempt
switch-A(config-if-vl150)#vrrp 30 ip 40.10.5.31
switch-A(config-if-vl100)#vrrp 30 advertisement interval 1
switch-A(config-if-vl150)#no vrrp 40
switch-A(config-if-vl150)#no vrrp 40 preempt
switch-A(config-if-vl150)#vrrp 40 ip 40.10.5.32
switch-A(config-if-vl150)#exit
Switch code that implements Router B on the second switch
switch-B(config)#interface vlan 100
switch-B(config-if-vl100)#ip address 10.10.4.2/24
switch-B(config-if-vl100)#no vrrp 10
switch-B(config-if-vl100)#no vrrp 10 preempt
switch-B(config-if-vl100)#vrrp 10 ip 10.10.4.10
switch-B(config-if-vl100)#no vrrp 20
switch-B(config-if-vl100)#vrrp 20 priority 200
switch-B(config-if-vl100)#no vrrp 20 preempt
switch-B(config-if-vl100)#vrrp 20 ip 10.10.4.20
switch-A(config-if-vl100)#vrrp 20 advertisement interval 1
switch-B(config-if-vl100)#exit
Switch code that implements Router C on the third switch
switch-C(config)#interface vlan 150
switch-C(config-if-vl150)#ip address 40.10.5.8/24
switch-C(config-if-vl150)#no vrrp 30
switch-C(config-if-vl150)#no vrrp 30 preempt
switch-C(config-if-vl150)#vrrp 30 ip 40.10.5.31
switch-C(config-if-vl150)#no vrrp 40
switch-C(config-if-vl150)#vrrp 40 priority 200
switch-C(config-if-vl150)#no vrrp 40 preempt
switch-C(config-if-vl150)#vrrp 40 ip 40.10.5.32
switch-A(config-if-vl100)#vrrp 40 advertisement interval 1
switch-C(config-if-vl150)#exit

VARP Example

This section provides code that implements a VARP configuration. VARP Example Network Diagram displays the Example 1 network. Two switches in an MLAG domain are configured as VARP routers.

The following code configures 10.10.4.10 as the virtual IP address for VLAN 50, 10.24.4.1 as the virtual IP address for VLAN 70, and 001c.7300.0999 as the virtual MAC address on both switches.

Figure 6. VARP Example Network Diagram

Switch code that implements VARP on the first switch

switch-A(config)#ip virtual-router mac-address 001c.7300.0999
switch-A(config)#interface vlan 50
switch-A(config-if-vl50)#ip address 10.10.4.1/24
switch-A(config-if-vl50)#ip virtual-router address 10.10.4.10
switch-A(config-if-vl50)#interface vlan 70
switch-A(config-if-vl70)#ip address 10.24.4.17/24
switch-A(config-if-vl70)#ip virtual-router address 10.24.4.1
switch-A(config-if-vl70)#exit

Switch code that implements VARP on the second switch

switch-B(config)#ip virtual-router mac-address 001c.7300.0999
switch-B(config)#interface vlan 50
switch-B(config-if-vl50)#ip address 10.10.4.2/24
switch-B(config-if-vl50)#ip virtual-router address 10.10.4.10
switch-B(config-if-vl50)#interface vlan 70
switch-B(config-if-vl70)#ip address 10.24.4.18/24
switch-B(config-if-vl70)#ip virtual-router address 10.24.4.1
switch-B(config-if-vl70)#exit

VRRP and VARP Configuration Commands

This section contains descriptions of CLI commands that support VRRP and VARP.

Global Configuration Commands

Interface Configuration CommandsEthernet, Port Channel, and VLAN Interfaces

Privileged EXEC Commands

ip fhrp accept-mode

The ip fhrp accept-mode command configures the switch to permit SSH access to the VRRP Master and VARP Master router. All routers within a VRRP or VARP group should be configured consistently. By default, SSH access to the VRRP and VARP Master routers is not permitted.

The no ip fhrp accept-mode and default ip fhrp accept-mode commands restores the default SSH access availability by removing the ip fhrp accept-mode command from running-config.

Command Mode

Global Configuration

Command Syntax

ip fhrp accept-mode

no ip fhrp accept-mode

default ip fhrp accept-mode

Example

  • This command configures the switch to permit SSH access to the VRRP and VARP Master routers.
    switch(config)#ip fhrp accept-mode
switch(config)#show running-config

!
ip fhrp accept-mode
!

switch(config)#

ip virtual-router address

The ip virtual-router address command assigns a virtual IPv4 address to the VLAN interface being configured. (To assign a virtual IPv6 address to a VLAN interface, use the ipv6 virtual-router address command.) Unlike VRRP, the virtual IP address does not have to be in the same subnet as the physical interface.

A virtual IP address may optionally be configured with a subnet, but doing so will modify the behavior of ARP requests sent from the router. When the router sends an ARP request for an IP address in a virtual subnet, the ARP request will use the virtual IP address as the source IP address and the virtual MAC address as the source MAC address inside the ARP header. For virtual IP addresses configured without the subnet option, no modifications are made to outgoing ARP requests.

A maximum of 500 virtual IP addresses can be assigned to a VLAN interface. All virtual addresses on all VLAN interfaces resolve to the same virtual MAC address configured through the ip virtual-router mac-address command.

This command is typically used in MLAG configurations to create identical virtual routers on switches connected to the MLAG domain through an MLAG.

The no ip virtual-router address and default ip virtual-router address commands remove the specified virtual IP address from the configuration mode interface by deleting the corresponding ip virtual-router address command from running-config. If the command does not specify an address, all virtual IPv4 addresses are removed from the interface.

Command Mode

Interface-VLAN Configuration

Command Syntax

ip virtual-router address ipv4_addr

no ip virtual-router address [ipv4_addr]

default ip virtual-router address [ipv4_addr]

Parameters

  • ipv4_addr IP address of router. Dotted decimal notation.

Examples

  • These commands configure a Switch Virtual Interface (SVI) and a virtual IP address for VLAN 10.
    switch(config)#interface vlan 10
switch(config-if-Vl10)#ip address 10.0.0.2/24
switch(config-if-Vl10)#ip virtual-router address 10.0.0.6
switch(config-if-Vl10)#exit
switch(config)#
  • These commands configure a Switch Virtual Interface (SVI) and a virtual IP address with a subnet for VLAN 10. A static route is added to indicate that the virtual subnet is reachable through VLAN 10.
    switch(config)#ip route 192.0.0.0/24 vlan 10
switch(config)#interface vlan 10
switch(config-if-Vl10)#ip address 10.0.0.2/24
switch(config-if-Vl10)#ip virtual-router address 192.0.0.6/24
switch(config-if-Vl10)#exit
switch(config)#

ip virtual-router mac-address advertisement-interval

The ip virtual-router mac-address advertisement interval command specifies the period between the transmission of consecutive gratuitous ARP requests that contain the virtual router mac address for each virtual-router IP address configured on the switch. The default period is 30 seconds.

The no ip virtual-router mac-address advertisement-interval command restores the default period of 30 seconds by removing the ip virtual-router mac-address advertisement-interval command from running-config.

Command Mode

Global Configuration

Command Syntax

ip virtual-router mac-address advertisement-interval period

no ip virtual-router mac-address advertisement-interval

default ip virtual-router mac-address advertisement-interval

Parameters

  • period advertisement interval (seconds). Values range from 0 to 86400. Default is 30.

Examples

  • This command configures a MAC address advertisement interval of one minute (60 seconds).
    switch(config)#ip virtual-router mac-address advertisement-interval 60
switch(config)#

ip virtual-router mac-address

The ip virtual-router mac-address command assigns a virtual MAC address to the switch. The switch maps all virtual router IP addresses to this MAC address. The address is receive-only; the switch never sends packets with this address as the source. The virtual router is not configured on the switch until this virtual mac-address is assigned.

This command is typically used in MLAG configurations to create identical virtual routers on switches connected to the MLAG domain through an MLAG. When the destination MAC of a packet destined to a remote network matches the virtual MAC address, the MLAG peer forwards the traffic to the next hop destination. Each MLAG peer must have the same routes available, either though static configuration or learned through a dynamic routing protocol.

The no ip virtual-router mac-address command removes a virtual MAC address from the interface by deleting the corresponding ip virtual-router mac-address command from running-config.

Command Mode

Global Configuration

Command Syntax

ip virtual-router mac-address mac_addr

no ip virtual-router mac address [mac_addr]

Parameters

  • mac_addrMAC IP address (dotted hex notation). Select an address that will not otherwise appear on the switch.

Examples

  • This command configures a virtual MAC address.
    switch(config)#ip virtual-router mac-address 001c.7300.0099
switch(config)#

ipv6 virtual-router address

The ipv6 virtual-router address command assigns a virtual IPv6 address to the VLAN interface being configured. (To assign a virtual IPv4 address to a VLAN interface, use the ip virtual-router address command.) Unlike VRRP, the virtual IP address does not have to be in the same subnet as the physical interface.

A maximum of 500 virtual IP addresses can be assigned to a VLAN interface. All virtual addresses on all VLAN interfaces resolve to the same virtual MAC address configured through the ip virtual-router mac-address command.

This command is typically used in MLAG configurations to create identical virtual routers on switches connected to the MLAG domain through an MLAG.

The no ipv6 virtual-router address and default ipv6 virtual-router address commands remove the specified virtual IPv6 address from the configuration mode interface by deleting the corresponding ipv6 virtual-router address command from running-config. If the command does not specify an address, all virtual IPv6 addresses are removed from the interface.

Command Mode

Interface-VLAN Configuration

Command Syntax

ipv6 virtual-router address net_addr

no ipv6 virtual-router address [net_addr]

default ipv6 virtual-router address [net_addr]

Parameters

  • net_addr network IPv6 address.

Examples

  • These commands configure a Switch Virtual Interface (SVI) and a virtual IPv6 address for VLAN 10.
    switch(config)#interface vlan 10
switch(config-if-Vl10)#ipv6 address 2001:0DB8:0:1::1/64
switch(config-if-Vl10)#ipv6 virtual-router address 2001:0DB8:0:1::2
switch(config-if-Vl10)#exit
switch(config)#

no vrrp

The no vrrp command removes all VRRP configuration commands for the specified virtual router on the configuration mode interface. The default vrrp command also reverts VRRP configuration parameters to default settings by removing the corresponding vrrp commands.

Commands removed by the no vrrp command include:

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

no vrrp group

default vrrpgroup

Parameters

  • groupvirtual router identifier (VRID). Values range from 1 to 255.

Examples

  • This command removes all VRRP configuration commands for virtual router group 10 on VLAN 15.
    switch(config)#interface vlan 15
switch(config-if-vl15)#no vrrp 10
switch(config-if-vl15)#

show ip virtual-router

The show ip virtual-router command displays the virtual MAC address assigned to the switch and all virtual IP addresses assigned to each VLAN interface.

Command Mode

EXEC

Command Syntax

show ip virtual-router

Messages

  • IP virtual router is not configured a virtual MAC address is not assigned to the switch.
  • No interface with virtual IP address no virtual IP addresses are assigned to any VLAN interfaces.

Examples

  • This command displays a table of information for VRRP groups on the switch.
    switch#show ip virtual-router
IP virtual router is configured with MAC address: 24cd.5a29.cc31
InterfaceIP AddressVirtual IP Address StatusProtocol
Vlan15 10.1.1.3/24 10.1.1.15upup
Vlan15 10.1.1.3/24 10.1.1.16upup
Vlan15 10.1.1.3/24 10.1.1.17upup
Vlan20 10.12.1.6/2410.1.1.51upup
Vlan20 10.12.1.6/2410.1.1.53upup
Vlan20 10.12.1.6/2410.1.1.55upup
switch#
  • This command generates a response that indicates a virtual MAC address is not assigned to the switch.
    switch#show ip virtual-router
IP virtual router is not configured
switch#

show ipv6 virtual-router

The show ipv6 virtual-router command displays the virtual MAC address assigned to the switch and all virtual IPv6 addresses assigned to each VLAN interface.

Command Mode

EXEC

Command Syntax

show ipv6 virtual-router

Messages

  • IPv6 virtual router is not configured a virtual MAC address is not assigned to the switch.
  • No interface with virtual IPv6 address no virtual IPv6 addresses are assigned to any VLAN interfaces.

Examples

  • This command displays a table of information for IPv6 VRRP groups on the switch.
    switch#show ipv6 virtual-router
IP virtual router is configured with MAC address: 001c.7300.0099
MAC address advertisement interval: 30 seconds
Interface Vlan4094
State is up
Protocol is up
IPv6 address
2001:b8:2001::1011/64
Virtual IPv6 address
2001:db8:ac10:fe01::
switch#

show vrrp

The show vrrp command displays information about the Virtual Router Redundancy Protocol (VRRP) groups configured on a specified interface. Parameter options control the amount and formatting of the displayed information.

Command Mode

Privileged EXEC

Command Syntax

show vrrp [INFO_LEVEL] [STATES]

show vrrp INTF GROUP_NUM [INFO_LEVEL] [STATES]

show vrrp GROUP_NUM INTF_GROUP [INFO_LEVEL] [STATES]

Parameters

  • INTF specifies the VRRP groups for which the command displays status. When the parameter is omitted or specifies only an interface, the group list is filtered by the STATES parameter.
    • <no parameter> specified groups on all interfaces.
    • interface ethernet e_num specified groups on Ethernet interface.
    • interface loopback l_num specified groups on loopback interface.
    • interface management m_num specified groups on management interface.
    • interface port-channel p_num specified groups on port channel interface.
    • interface vlan v_num specified groups on VLAN interface.
    • interface vxlan vx_num specified groups on VXLAN interface.
  • GROUP_NUM the VRRP ID number of the group for which the command displays status.
    • <no parameter> all groups on specified interface.
    • vrid_num virtual router identifier (VRID). Value ranges from 1 to 255.
  • INFO_LEVEL Specifies format and amount of displayed information. Options include:
    • <no parameter> displays a block of data for each VRRP group.
    • brief displays a single table that lists information for all VRRP groups.
  • STATES Specifies the groups, by VRRP router state, that are displayed. Options include:
    • <no parameter> displays data for groups in the master or backup states.
    • all displays all groups, including groups in the stopped and interface down states.

Examples

  • This command displays a table of information for VRRP groups on the switch.
    switch#show vrrp brief
Interface IdVer Pri TimeState VrIps
Vlan10063 2 100 3609Master127.38.10.2
Vlan10064 3 100 3609Master127.38.10.10
Vlan10101 2 100 3609Master128.44.5.3
Vlan10142 2 100 3609Master127.16.14.2
switch>
  • This command displays data blocks for all VRRP groups on VLAN 46, regardless of the VRRP state.
    switch#show vrrp interface vlan 1006 all
Vlan1010 - Group 1
VRRP Version 2
State is Stopped
Virtual IPv4 address is 128.44.5.3
Virtual MAC address is 0000.5e00.0101
Mac Address Advertisement interval is 30s
VRRP Advertisement interval is 1s
Preemption is enabled
Preemption delay is 0s
Preemption reload delay is 0s
Priority is 100
Master Router is 0.0.0.0
Master Advertisement interval is 1s
Skew time is 0.609s
Master Down interval is 3.609s
switch#
  • This command displays data for all VRRP group 2 on VLAN 1014.
    switch#show vrrp interface vlan 1014 group 2
Vlan1006 - Group 2
VRRP Version 2
State is Master
Virtual IPv4 address is 127.38.10.2
Virtual MAC address is 0000.5e00.0103
Mac Address Advertisement interval is 30s
VRRP Advertisement interval is 1s
Preemption is enabled
Preemption delay is 0s
Preemption reload delay is 0s
Priority is 100
Master Router is 127.38.10.1 (local), priority is 100
Master Advertisement interval is 1s
Skew time is 0.609s
Master Down interval is 3.609s
switch#

vrrp advertisement interval

The vrrp advertisement interval command configures the interval between successive advertisement messages that the switch sends to VRRP routers in the specified virtual router group. The switch must be the groups Master virtual router to send advertisement messages. The advertisement interval must be configured identically on all physical routers in the virtual router group.

The advertisement interval also influences the timeout interval that defines when the virtual router becomes the master virtual router. When preemption is enabled, the virtual router becomes the master when three times the advertisement interval elapses after the switch detects master router priority conditions.

The no vrrp advertisement interval and default vrrp advertisement interval commands restore the default advertisement interval of one second for the specified virtual router by removing the corresponding vrrp advertisement interval command from running-config. The no vrrp command also removes the vrrp advertisement interval command for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group advertisement interval adv_time

no vrrp group advertisement interval

default vrrp group advertisement interval

Parameters

  • group virtual router identifier (VRID). Values range from 1 to 255.
  • adv_time advertisement interval (seconds). Values range from 1 to 255. Default value is 1.

Example

  • This command sets the advertisement interval of five seconds for the virtual router 35 on VLAN 100.
    switch(config)#interface vlan 100
switch(config-if-vl100)#vrrp 35 advertisement interval 5
switch(config-if-vl100)#

vrrp disabled

The vrrp disabled command places the switch in stopped state for the specified virtual router. While in stopped state, the switch cannot act as a Master or backup router for the virtual router group.

The no vrrp disabled and default vrrp disabled commands remove the corresponding vrrp disabled command from running-config. This changes the switchs virtual router state to backup or master if the virtual router is properly configured.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group disabled

no vrrp group disabled

default vrrp group disabled

Parameters

  • group virtual router identifier (VRID). Values range from 1 to 255.

Example

  • These commands place the switch in stopped mode for virtual router 24 on VLAN 20.
    switch(config)#interface vlan 20
switch(config-if-vl20)#vrrp 24 disabled
switch(config-if-vl20)#
  • This command moves the switch out of stopped mode for virtual router 24 on VLAN 20.
    switch(config-if-vl20)#no vrrp 24 disabled
switch(config-if-vl20)#

vrrp ipv4 checksum pseudo-header exclude

This command excludes the pseudo-header in IPv4 VRRPv3 checksum calculation on the VRRP group on the configuration mode interface of the switch and supports IPv4 VRRPv3 interoperability.

The no form of the command deletes the vrrp ipv4 checksum pseudo-header exclude configuration from the Ethernet interface on the switch.

The exit command returns the switch to global configuration mode.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group ipv4 checksum pseudo-header exclude

no vrrp group ipv4 checksum pseudo-header exclude

Parameter

  • group virtual router identifier (VRID). Values range from 1 to 255.

Example

  • This command excludes the pseudo-header in IPv4 VRRPv3 checksum calculation on VRRP group 1 on interface Ethernet 1. 
    switch(config-if-Et1)#vrrp 1 ipv4 checksum pseudo-header exclude

vrrp ipv4 secondary

The vrrp ipv4 secondary command assigns a secondary IP address to the specified virtual router. Secondary IP addresses are an optional virtual router parameter. A virtual router may contain multiple secondary address commands. The IP address list must be identical for all VRRP routers in a virtual router group.

The virtual router is assigned a primary IP address with the vrrp ipv4 command.

The no vrrp ipv4 secondary and default vrrp ipv4 secondary commands remove the secondary IP address for the specified VRRP virtual router by deleting the corresponding vrrp ipv4 secondary statement from running-config. The no vrrp command also removes all vrrp ipv4 secondary commands for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group ipv4 ipv4_addr secondary

no vrrp group ipv4 ipv4_addr secondary

default vrrp group ipv4 ipv4_addr secondary

Parameters

  • group virtual router identifier (VRID). Values range from 1 to 255.
  • ipv4_addr secondary IPv4 address of the virtual router.

Related Commands

Example

  • This command assigns the IP address of 10.2.4.5 as the secondary IP address for the virtual router with VRID of 15 on VLAN 20
    switch(config)#interface vlan 20
switch(config-if-vl20)#vrrp 15 ipv4 10.2.4.5 secondary
switch(config-if-vl20)#

vrrp ipv4 version

The vrrp ipv4 version command enables VRRP on the configuration mode interface and configures the VRRP version for the specified VRRP virtual router.

The no vrrp ipv4 version and default vrrp ipv4 version commands restore the default VRRP version to VRRPv2 by removing the corresponding vrrp ipv4 version statement from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group ipv4 version VERSION_NUMBER

no vrrp group ipv4 version

default vrrp group ipv4 version

Parameters

  • group virtual router identifier (VRID). Values range from 1 to 255.
  • VERSION_NUMBER Specifies VRRP version that the switch uses. Default value is 2 (VRRPv2) Options include:
    • 2 VRRP v2 supports IPv4 environment.
    • 3 VRRP v3 supports IPv4 and IPv6 environment.

Examples

  • This command enables VRRPv3 for IPv6 on interface Ethernet 3.
    switch#(config)#interface ethernet 3
switch#(config-if-Et3)#vrrp 1 ipv4 version 3
switch#
  • This command removes VRRPv3 from interface Ethernet 3 and reverts to the default VRRPv2.
    switch#(config)#interface ethernet 3
switch#(config-if-Et3)#no vrrp 1 ipv4 version
switch#(config-if-Et3)#

vrrp ipv4

The vrrp ipv4 command configures the primary IP address for the specified VRRP virtual router. The command also activates the virtual router if the primary address is contained in the interfaces subnet. A VRRP virtual routers configuration may contain only one primary IP address assignment command; subsequent vrrp ipv4 commands replace the existing primary address assignment.

The vrrp ipv4 secondary command assigns a secondary IP address to the VRRP virtual router.

The no vrrp ipv4and default vrrp ipv4 commands disable the VRRP virtual router and deletes the primary IP address by removing the corresponding vrrp ipv4 statement from running-config. The no vrrp command also removes the vrrp ipv4 command for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group ipv4 ipv4_address

no vrrp group ipv4 ipv4_address

default vrrp group ipv4 ipv4_address

Parameters

  • group virtual router identifier (VRID). Values range from 1 to 255.
  • ipv4_address IPv4 address of the virtual router.

Related Commands

Example

  • This command enables virtual router 15 on VLAN 20 and designates 10.1.1.5 as the virtual routers primary address.
    switch(config)#interface vlan 20
switch(config-if-vl20)#vrrp 15 ipv4 10.1.1.5
switch(config-if-vl20)#

vrrp ipv6

The vrrp ipv6 command configures the IPv6 address for the specified VRRP virtual router. The command also activates the virtual router if the primary address is contained in the interfaces subnet.

The no vrrp ipv6 and default vrrp ipv6 commands disable the VRRP virtual router and deletes the IPv6 address by removing the corresponding vrrp ipv6 statement from running-config. The no vrrp command also removes the vrrp ipv6 command for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group ip ipv6_address

no vrrp group ip ipv6_address

default vrrp group ip ipv6_address

Parameters

  • group virtual router identifier (VRID). Values range from 1 to 255.
  • ipv6_address IPv6 address of the virtual router.

Example

  • This command enables address 2001:db8:0:1::1 for IPv6 VRRP on VLAN 20.
    switch(config)#interface vlan 20
switch(config-if-vl20)#vrrp 3 ipv6 2001:db8:0:1::1
switch(config-if-vl20)#
  • This command disables VRRPv3 on VLAN 20 from virtual router 3.
    switch(config)#interface vlan 20
switch(config-if-vl20)#no vrrp 3 ipv6 2001:db8:0:1::1
switch(config-if-vl20)#

vrrp mac-address advertisement-interval

The vrrp mac-address advertisement-interval command specifies the interval between advertisement packets sent by the master router to the VRRP group members.

The vrrp mac-address advertisement-interval 0, no vrrp mac-address advertisement-interval and default vrrp mac-address advertisement-interval commands disable the feature by removing the vrrp mac-address advertisement-interval command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group mac-address advertisement-interval period

no vrrp group mac-address

default vrrp group mac-address

Parameters

  • group virtual router identifier (VRID). Values range from 1 to 255.
  • period interval in which the master router sends advertisement packets (seconds). Value ranges from 0 to 3600. Selecting 0 as the interval disables this feature.

Example

  • This command specifies the interval between advertisement packets sent to the members of VRRP group 3 on VLAN 20.
    switch(config)#interface vlan 20
switch(config-if-vl20)#vrrp 3 mac-address advertisement-interval 60
switch(config-if-vl20)#
  • This command disables the feature on VLAN 20.
    switch(config)#interface vlan 20
switch(config-if-vl20)#no vrrp 3 mac-address advertisement-interval
switch(config-if-vl20)#

vrrp peer authentication

The vrrp peer authentication command configures parameters the switch uses to authenticate virtual router packets it receives from other VRRP routers in the group.

The no vrrp peer authentication and default vrrp peer authentication commands disable VRRP peer authentication of packets from the specified virtual router by removing the corresponding vrrp peer authentication command from running-config. The no vrrp command also removes the vrrp peer authentication command for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group peer authentication AUTH_PARAMETER

no vrrp group peer authentication

default vrrp group peer authentication

Parameters

  • group virtual router identifier (VRID). Values range from 1 to 255.
  • AUTH_PARAMETER encryption level and authentication key used by router. Options include:
    • text text_key plain-text authentication, text_key is text.
    • text_key plain-text authentication, text_key is text.
    • ietf-md5 key-string 0 text_key IP authentication of MD5 key hash, text_key is text.
    • ietf-md5 key-string text_key IP authentication of MD5 key hash, text_key is text.
    • ietf-md5 key-string 7 coded_key IP authentication of MD5 key hash, coded_key is MD5 hash.

Guidelines

This command is applicable to VRRPv2 which supports IPv4 addresses only.

Examples

  • This command implements plain-text authentication, using 12345 as the key, for virtual router 40 on VLAN 100.
    switch(config)#interface vlan 100
switch(config-if-vl100)#vrrp 40 peer authentication text 12345
switch(config-if-vl100)#
  • This command implements ietf-md5 authentication, using 12345 as the key. 
    switch(config-if-vl100)#vrrp 40 peer authentication ietf-md5 key-string 0 12345
switch(config-if-vl100)#
  • This command implements ietf-md5 authentication, using 12345 as the key. The key is entered as the MD5 hash equivalent of the text string.
    switch(config-if-vl100)#vrrp 40 peer authentication ietf-md5 key-string 7 
EA3TUPxdddFCLYT8mb+kxw==switch(config-if-vl100)#

vrrp preempt delay

The vrrp preempt delay command specifies the interval between a VRRP preemption event and the point when the switch becomes the master VRRP router. A preemption event is any event that results in the switch having the highest virtual router priority setting while preemption is enabled. The vrrp preempt command enables preemption for a specified virtual router.

The command configures two delay periods:

  • minimum time delays master VRRP takeover when VRRP is fully implemented.
  • reload time delays master VRRP takeover after VRRP is initialized following a switch reload (boot). The switch bypasses the reload time to become the VRRP master immediately if it senses there are no other active switches in the virtual router group.

Running-config maintains separate delay statements for minimum and reload parameters. Commands may list both parameters. Commands that list one parameter do not affect the omitted parameter. Values range from 0 to 3600 seconds (one hour). The default delay is zero seconds for both parameters.

The no vrrp preempt delay and default vrrp preempt delay commands reset the specified delay to the default of zero seconds. Commands that do no list either parameter resets both periods to zero. The no vrrp command also removes all vrrp preempt delay commands for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group preempt delay [MINIMUM_INTERVAL] [RELOAD_INTERVAL]

no vrrp group preempt delay [DELAY_TYPE]

default vrrp group preempt delay [DELAY_TYPE]

Parameters

  • group virtual router identifier (VRID). Values range from 1 to 255.
  • MINIMUM_INTERVAL period between preempt event and takeover of master VRRP router role.
    • <no parameter> minimum delay is not altered by command.
    • minimum min_time delay during normal operation (seconds). Values range from 0 to 3600.
  • RELOAD_INTERVAL period after reboot-VRRP initialization and takeover of master VRRP router role.
    • <no parameter> reload delay is not altered by command.
    • reload reload_time delay after reboot (seconds). Values range from 0 to 3600.
  • DELAY_TYPE delay type that is reset to default value.
    • <no parameter> reload and minimum delays are reset to default.
    • minimum minimum delay is reset to default.
    • reload reload delay is reset to default.

(DELAY_TYPE parameter is only used in no vrrp preempt delay and default vrrp preempt delay commands).

Related Commands

Examples

  • This command sets the minimum preempt time of 90 seconds for virtual router 20 on VLAN 40.
    switch(config)#interface vlan 40
switch(config-if-vl40)#vrrp 20 preempt delay minimum 90
switch(config-if-vl40)#
  • This command sets the minimum and reload preempt time to zero for virtual router 20 on VLAN 40.
    switch(config-if-vl40)#no vrrp 20 preempt delay
switch(config-if-vl40)#

vrrp preempt

The vrrp preempt command controls a virtual routers preempt mode setting. When preempt mode is enabled, if the switch has a higher priority it will preempt the current master virtual router. When preempt mode is disabled, the switch can become the master virtual router only when a master virtual router is not present on the subnet, regardless of VRRP priority level settings. By default, preempt mode is enabled.

The no vrrp preemptcand default vrrp preemptccommands disable preempt mode for the specified virtual router; the default vrrp preempt command stores a corresponding no vrrp preempt statement in running-config. The vrrp preempt command enables preempt mode by removing the corresponding no vrrp preempt statement from running-config.

The no vrrp command also enables preempt mode by removing the no vrrp preempt command for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group preempt

no vrrp group preempt

default vrrp group preempt

Parameters

  • group virtual router identifier (VRID). Values range from 1 to 255.

Related Commands

Examples

  • This command disables preempt mode for virtual router 20 on VLAN 40.
    switch(config)#interface vlan 40
switch(config-if-vl40)#no vrrp 20 preempt
switch(config-if-vl40)#
  • This command enables preempt mode for virtual router 20 on VLAN 40.
    switch(config-if-vl40)#vrrp 20 preempt
switch(config-if-vl40)#

vrrp priority-level

The vrrp priority-level command configures the switchs priority setting for a VRRP virtual router. Priority values range from 1 to 254. The default value is 100.

The router with the highest VRRP priority level setting for a group becomes the master virtual router for that group. The master virtual router controls the IP address and is responsible for forwarding traffic sent. The vrrp preempt command controls the time when a switch can become the master virtual router.

The no vrrp priority-level and default vrrp priority-level commands restore the default priority of 100 to the virtual router on the configuration mode interface by removing the corresponding vrrp priority-level command from running-config. The no vrrp command also removes the vrrp priority-level command for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group priority-level level

no vrrp group priority-level level

default vrrp group priority-level level

Parameters

  • group virtual router identifier (VRID). Values range from 1 to 255.
  • level priority setting for the specified virtual router. Values range from 1 to 254.

Examples

  • This command sets the virtual router priority value of 250 for virtual router group 45 on VLAN 20.
    switch(config)#interface vlan 20
switch(config-if-vl20)#vrrp 45 priority-level 250
switch(config-if-vl20)#

vrrp session description

The vrrp session description command associates a text string to a VRRP virtual router on the configuration mode interface. The string has no functional impact on the virtual router. The maximum length of the string is 80 characters.

The no vrrp session description and default vrrp session description commands remove the text string association from the VRRP virtual router by deleting the corresponding vrrp session description command from running-config. The no vrrp command also removes the vrrp session description command for the specified virtual router.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group session description label_text

no vrrp group session description

default vrrp group session description

Parameters

  • group virtual router identifier (VRID). Values range from 1 to 255.
  • label_text text that describes the virtual router. Maximum string length is 80 characters.

Example

  • This command associates the text string Laboratory Router to virtual router 15 on VLAN 20.
    switch(config)#interface vlan 20
switch(config-if-vl20)#vrrp 15 session description Laboratory Router
switch(config-if-vl20)#

vrrp timers delay reload

The vrrp timers delay reload command delays the time for VRRP initialization after a system reboot.

The no vrrp timers delay reload and default vrrp timers delay reload commands restore the default value of 0 by deleting the vrrp timers delay reload statement from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group timers delay reload [INTERVAL]

no vrrp group timers delay reload

default vrrp group timers delay reload

Parameters

  • INTERVAL The number of seconds for the delay (seconds). Options include:
    • <no parameter> Default value of 0 seconds.
    • <0 to 3600> Ranges between 0 and 60 minutes.

Example

  • These commands configure the VRRP reload delay interval to 15 minutes.
    switch(config)#interface vlan 100
switch(config-if-Vl100)#vrrp 2 timers delay reload 900
switch(config-if-Vl100)#
  • These commands removes the VRRP reload delay interval.
    switch(config)#interface vlan 100
switch(config-if-Vl100)#no vrrp 2 timers delay reload
switch(config-if-Vl100)#

vrrp tracked-object

The vrrp tracked-object command configures the VRRP client process on the configuration mode interface to track the specified tracked object and react when its status changes to down. The tracked object is created by the track command.

The no vrrp tracked-object and default vrrp tracked-object commands cause the VRRP client process to stop tracking the specified tracked object by removing the corresponding vrrp tracked-object command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

vrrp group tracked-object object_name ACTION amount

no vrrp group tracked-object object_name ACTION

default vrrp group tracked-object object_name ACTION

Parameters

  • group virtual router identifier (VRID). Values range from 1 to 255.
  • object_name name of tracked object.
  • amount amount to decrement VRRP priority level. Values range from 1 to 254.
  • ACTION The action that VRRP is to take when the tracked objects status changes to down. Options include:
    • decrement decrease VRRP priority level by amount.
    • shutdown shut down VRRP on the configuration mode interface.

      If both decrement and shutdown are configured on the same interface for the same VRRP group, then VRRP will be shut down on the interface if the tracked object is down.

Related Commands

Example

  • This command causes Ethernet interface 5 to disable VRRP when tracked object ETH8 changes state.
    switch(config-if-Et5)#vrrp 1 tracked-object ETH8 shutdown
switch(config-if-Et5)#