Subject: Re: Doubt regarding ARP cache updation

From: basila <[email-masked]>
Date: Tue, 20 Jan 98 14:03:00 PST

Peter,

Thanks for your reply.

The following is the scenario i am thinking of.

                                                                   VRID=2
 VRID=1           +-----------------------------------------------------+
 +----------------+---------------------------------+                   |
 |       +-----+  |      +-----+      +-----+       |     +-----+       |
 |       |     |  |      | MR1 |      | MR2 |       |     |     |       |
 |       | BR1 |  |      |  &  |      |  &  |       |     | BR2 |       |
 |       |     |  |      | BR2 |      | BR1 |       |     |     |       |
 |       +-----+  |      +-----+      +-----+       |     +-----+       |
 | IP C --->*     |IP A --->*            *<--- IP B |        *<--- IP D |
 |          |     |         |            |          |        |          |
 +----------+-----+---------+------------+----------+        |          |
            |     +---------+------------+-------------------+----------+
            |               |            |                   |

 --------+---------------+------------+-----+--------+----+---+--------+-----  
 ---
                                               ^        ^        ^        ^
                                               |        |        |        |
                                             (IP A)   (IP B)   (IP C)   (IP 
D)
                                               |        |        |        |
                                            +--+--+  +--+--+  +--+--+ 
 +--+--+
                                            |  H1 |  |  H2 |  |  H3 |  |  H4 
|
                                            +-----+  +-----+  +--+--+ 
 +--+--+

      Legend:
               ---+---+---+--  =  802 network, Ethernet or FDDI
                            H  =  Host computer
                           MR  =  Master Router
                           BR  =  Backup Router
                            *  =  IP Address
                         (IP)  =  default router for hosts

There are two virtual routers VRID1 and VRID2. VRID 1 consists of three VRRP 
routers, IP A, IP B and IP C and IP A is the Master router. VRID2 consist of 
three VRRP routers IP A, IP B and IP D and IP B is the Master router.

The following are the doubts:

1) Whether the topology depicted above is allowed? What i feel it is the 
extension of the sample configuration specified in section 4.2 of 
"draft-ietf-vrrp-spec-04.txt"

If the topology depicted above is allowed, i have the following doubts

2) When IP A becomes master router for VRID 1, it is responsible for 
forwarding IP packets sent for IP A, IP B and IP C. Am i correct?
If i am correct the packet addressed for IP B will be forwarded by VRID1 as 
well as VRID 2.

3) When IP A becomes Master router for VRID1, Whether gratuitous is sent for 
the Master router (IP A) alone or even for Backup routers (IP B and IP C).

4) If the gratuitous ARP is sent for Backup routers also, then the IP 
packets addressed for IP B will be forwarded by VRID1 instead of VRID2. Is 
it allowed?

If the above topology is not allowed, even the configuration specified in 
section 4.2 of "draft-ietf-vrrp-spec-04.txt" should not allowed. Since both 
the topologies have the master router in one particular virtual router being 
backup router in another virtual router.

Regards
Rao & Basil

V.R.N. Rao & Anton Basil
Future Software Pvt., Ltd.,
481, Nandanam,
Madras - 600 035.

Voice : 91-44-4340323, 4330550 (Extn : 331)
Fax : 91-44-4344157, 4834551, 4834661
Email : [email-masked], [email-masked]

 ----------
From: Peter Hunt
To: basila
Cc: Peter Hunt; 'SMTP:[email-masked]'
Subject: Re: Doubt regarding ARP cache updation
Date: Monday, January 19, 1998 11:26AM

Rao & Basil,

> Thanks a lot for your reply. We have few thing to get clarified.

I hope I can help clarify them.

> You have considered the case where gratuitous ARP is sent for IP A by
> virtual router VRID1. But in the "draft-ietf-vrrp-spec-04.txt" section 8.2 

> paragraph 2 , it says gratuitous ARP should be sent for each IP Address on 

> that interface (all IP Address it owns).

That is correct. Section 8.2 Paragraph 2 states:

    - When configuring an interface, VRRP routers should broadcast a
      gratuitous ARP request containing the virtual router MAC address
      for each IP address on that interface.

So, in the diagram you included in your initial mail message:

                       VRID=1       VRID=2
                      +-----+      +-----+
                      | MR1 |      | MR2 |
                      |  &  |      |  &  |
                      | BR2 |      | BR1 |
                      +-----+      +-----+
         IP A ---------->*            *<---------- IP B
                         |            |
                         |            |
                         |            |
       ------------------+------------+-----+--------+--------+--------+--
                                            ^        ^        ^        ^
                                            |        |        |        |
                                          (IP A)   (IP A)   (IP B)   (IP B)
                                            |        |        |        |
                                         +--+--+  +--+--+  +--+--+  +--+--+
                                         |  H1 |  |  H2 |  |  H3 |  |  H4 |
                                         +-----+  +-----+  +--+--+  +--+--+

      Legend:
               ---+---+---+--  =  802 network, Ethernet or FDDI
                            H  =  Host computer
                           MR  =  Master Router
                           BR  =  Backup Router
                            *  =  IP Address
                         (IP)  =  default router for hosts

        ... the router on the left only has one IP address configured on
its LAN interface: IP A. Therefore, the router on the left will *only*
send a gratuitous ARP for IP A, and the MAC address in the ARP request
will be the virtual router MAC address for VRID 1 (ie. 00 00 5E XX XX 01).

> So gratuitous ARP will be sent to  both IP A as well as IP B and all
> the four hosts will be updated with the  virtual address of VRID1 and
> Load sharing will not happen.

        This is where we start to disagree :).

        The only case in which the router on the left will send a gratuitous
ARP request for IP B is if the router on the right fails. In that case, the
router on the left adopts all the virtual router information from the failed
router, including the failed router's VRID, in addition to its own.

        So, while it's true that in this situation, the router on the left
will have both IP A and IP B configured on its LAN interface, IP B will
still be associated with VRID 2. So when the router on the left sends out
the gratuitous ARP message for IP B, it will contain the virtual router
MAC address for VRID 2 (ie. 00 00 5E XX XX 02). Any ARP responses sent
for IP A will still contain the virtual router MAC address for VRID 1
(ie. 00 00 5E XX XX 01).

        I hope some of this helps. If I'm still not considering the
situation you're thinking of, please describe the situation in more detail.

        Thanks and regards,

        Peter

---

From: Peter Hunt <[email-masked]>
Date: Wed, 21 Jan 1998 08:38:45 -0800

Rao & Basil,

	thanks for giving more detail; sorry I didn't get back to
you yesterday. I think I can help clarify things.

> 1) Whether the topology depicted above is allowed? What i feel it
> is the extension of the sample configuration specified in
> section 4.2 of "draft-ietf-vrrp-spec-04.txt"

Yes, the configuration you've described is allowed.

> forwarding IP packets sent for IP A, IP B and IP C. Am i correct?

No, that is not correct. A virtual router only contains the IP
addresses for one of the routers. Or, to put it another way,
backup routers of a virtual router don't have their addresses
backed up by that virtual router.

Let me illustrate this using a simpler configuration, and then
I'll come back to the configuration you've described:

                       VRID=1
                      +-----+      +-----+
                      |     |      |     |
                      | MR1 |      | BR1 |
                      |     |      |     |
                      +-----+      +-----+
         IP A ---------->*            *<---------- IP B
                         |            |
                         |            |
                         |            |
       ------------------+------------+--------------

In this configuration, IPA is backed up using virtual router VRID1.
The router on the left is the owner of IP A; whenever it is up, it
will forward packets for IP A. The router on the right is a backup
router for VRID1. Whenever the router on the left fails, it will
take over responsibility for forwarding packets for IP A.

The router on the right is configured with IP B, which it uses
to access the LAN. IP B is not backed up using VRID 1. If the router
on the right fails, nothing adopts IP B. In order to back up IP B,
you'd have to configure a second virtual router, with the router
on the right as owner, and the router on the left as backup.

When first configured, the router on the left will send a gratuitous
ARP request for IP A, using 00:00:5E:XX:XX:01. The router on the
right will send one for IP B using it's device's physical MAC address.
The two routers will respond to ARP requests the same way.

If the router on the left fails, the router on the right will adopt
the information for VRID 1. Until the router on the left comes back,
the router on the right will respond to ARP requests for IP A, using
00:00:5E:XX:XX:01, *and* respond to ARP requests for IP B using
it's device's physical MAC address.

In the configuration you've specified, IP A will be backed up by
VRID 1, and IP B will be backed up by VRID 2. IP C and IP D won't
be backed up; you would need another virtual router for each of
these addresses to implement failover for them.

So whoever is master of VRID 1 will respond to ARP requests for
IP A, using 00:00:5E:XX:XX:01, and whoever is master of VRID 2
will respond to ARP requests for IP B, using 00:00:5E:XX:XX:02.
ARP requests for IP C and IP D will only ever be responded to by
the routers which are shown to have them now. Those responses will
contain the physical LAN addresses of those routers.

I hope this helps clarify how virtual routers work in VRRP2. I
also hope I haven't put you to sleep with my long-winded
description.

Your question makes me think that we may need to clarify the
definitions and example text in the draft to explain this better.

Do you think we need to do this?

-- 
| Peter Hunt                              |  Phone: +1 408 990 2093
| Ipsilon Networks Inc.                   |  Fax:   +1 408 743 5677
| 232 Java Drive, Sunnyvale CA 94089-1318 |  Email: [email-masked]