Subject: VRRP misconfiguration issue

From: Ravi Singh <[email-masked]>
Date: Mon, 11 Mar 2002 00:55:31 -0800 (PST)

Hi
Section 7.1 of RFC 2338, mentions that VRRP advertisements that fail
authentication check, must be discarded. This can lead to multiple VRRP
routers asserting themselves as masters for the same virtual IP.
Therefore, I dont quite see how the security problem is solved, more so in the
case of operation over extended LANs using learning bridges.

Section 10.2 (Simple text password) says that "a new router must first be
configured with the correct password before it can run VRRP with another
router".
This seems to say that a router X when configured for VRRP must listen for
VRRP advertisements from the current master (if any), and decide if own
password is correct. If not, VRRP router X must shutdown VRRP.
This is different from what section 7.1 says.

Please advise what is the expected behavior.
Regards
Ravi.