FHRP Group and Interface Assignment

[ultrapista]

Hello guys,

currently in our organisation we use Cisco Nexus boxes which have on their Vlan interfaces configured VRRPv3 protocol. The catch is that we use the IP address on the Vlan interface same as VIP address for VRRPv3 (on the first box.. the second one uses second available IP). The issue comes to how should we get it in Netbox because you can not have both on the same interface (same IP for FHRP VIP and Vlan Interface IP). How should we proceed? Thanks

@jeremystretch @drobnymichal

[candlerb]

(Aside: I don't think it is good manners to ping specific people, especially not the most senior)

The catch is that we use the IP address on the Vlan interface same as VIP address for VRRPv3

Sorry, I don't understand. Can you show the configs? The way I do it is:

interface Vlan1000
...
  ip address 10.0.0.2/24   ! on other device: 10.0.0.3/24
...
  vrrpv3 1 address-family ipv4
    priority 200           ! on other device: 100
    address 10.0.0.1 primary

From what you wrote, it sounds like you're doing:

interface Vlan1000
...
  ip address 10.0.0.1/24
...
  vrrpv3 1 address-family ipv4
    priority 200           ! on other device: 100
    address 10.0.0.1 primary

but that would be insane, and almost certainly won't work in a failover situation, e.g. if you decide to move the VRRP over to the secondary to do maintenance on the primary.

If that's what you actually have, you'd have to disable ENFORCE_GLOBAL_UNIQUE to put it into Netbox.

[candlerb]

In the case where device B is active on the VIP, then device B will respond to ARP requests for 10.1.1.129 (being the VIP), and device A will respond to ARP requests for 10.1.1.129 (being its primary IP address on that interface). This means you'll get MAC address churn in your switch tables (which they will hate), non-deterministic routing of packets, and general mayhem.

This isn't like a Cisco ASA, where you just have two IPs, and 'active' and 'standby' roles swap over the IPs.

Also, you haven't specified priorities, so it'll be arbitrary which one gets the VIP.

I suggest you look at Cisco's examples where the VIP is different from the main IPs on both devices.

[netravnen]

Netbox aims for the common standard, first, afais. Not all network vendor platforms support 2-address VRRP configurations. #7714

From the PR. The FHRP model in Netbox is build to support HSRP, VRRP, CARP, GLBP as choice of FHRP protocol.

my 2c would be to update the configuration to use the more common format of 1 VIP and 2 interface addresses. This way you can also easily document the setup in Netbox.

(For software tools, especially (F)OSS. If you don't pay the developers. You have no direct say in the projects general direction and feature request [other than submitting FR's]. Sometimes a hard leasson. And why some companies will always go with the paid option and chose closed source products to have the support contract)

[drobnymichal]

Hi @candlerb ,

In our organization we use VRRP in the same way as @ultrapista describes. We followed Cisco's instructions, which directly mention this setting in their configuration. The guide is available here: Link

The crucial sentence is here:

An important aspect of the VRRP redundancy scheme is the VRRP router priority because the priority
determines the role that each VRRP router plays and what happens if the primary router fails.

If a VRRP router owns the virtual IP address and the IP address of the physical interface, this router functions
as the primary. The priority of the primary is 255.

The priority also determines if a VRRP router functions as a backup router and the order of ascendancy to
becoming a primary if the primary fails.

[candlerb]

If a VRRP router owns the virtual IP address and the IP address of the physical interface, this router functions
as the primary. The priority of the primary is 255.

Hmm, then that machine is hard-wired to be primary. I guess if you wanted to fail over manually (e.g. for planned maintenance) you'd have to shutdown the entire interface.

[netravnen]

#11649