Subject: [VRRP] Changing Adver Interval

From: "M. T. Hollinger" <[email-masked]>
Date: Tue, 11 Nov 2003 18:55:12 -0500

Suppose an administrator initially deploys 3 VRRP routers for a single VRID,
sending advertisements at 2 second intervals.  At some point in the future,
he decides to change back to the default 1 second interval, but one of the
Backup Routers doesn't get changed.  Maybe it was down for maintenance at
the time and didn't return until the following week.

The VRRPv3 draft says that upon receiving a VRRP packet, a router:

>   - MUST verify that the Adver Interval in the packet is the same as
>     the locally configured for this virtual router
>
> If the above check fails, the receiver MUST discard the packet,

This would appear to mean that once the BR does come back, it will ignore
all the VRRP packets and enter Master state.  The network will then limp
along with two MR's until the administrator figures out the problem and
manually corrects it.  Is that what we intend?

Other options would be to:

  Have the BR log the discrepancy but accept the packet anyway

  Have the BR enter Initialize state (awaiting manual startup)

  Have the BR adjust its own interval and continue (see below)

If the Backup Rouer's interval is already greater than the one in the
received packet, then there is no danger in just accepting the packet.  The
BR expects a packet every 2 seconds, but the MR is sending one every second.
On the other hand, if the received interval is larger than the BR's own
interval, but still reasonable (say, within 10 seconds of the BR's
permanently configured interval), the BR could simply increase its own
interval to match.

Probably the main danger from accepting a bogus packet is a denial of
service attack, where an intruder maliciously shuts down a VRRP Backup
Router.  Of course, it wouldn't be possible to shut down a Master Router,
which doesn't look at received VRRP packets at all.  I think we could
maintain a certain level of resistance to attacks while also being more
robust to router misconfigurations than the current draft implies.

              - Mark

_______________________________________________
vrrp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/vrrp

---

From: "Don Provan" <[email-masked]>
Date: Tue, 11 Nov 2003 17:33:38 -0800

Yeah, the more I deal with VRRP in practice, the sillier
dropping any packet that isn't what you're expecting seems.
The issue you raise doesn't require any special circumstances:
if you have to walk from one router to the next to change the
interval, the network will be conflicted while you're walking.

I decided the only reasonable attitude towards a different
interval is to assume that a change is in progress. So
any backup hearing a different interval from the master
uses the master's interval. If the master hears a faster
interval from anyone, he switches to that interval to make
sure the backup doesn't take over accidentally. As long as
you configure the master last when slowing down, it works
fine without any fighting.

-don