Troubleshooting VRRP

In a previous lesson I demonstrated how to troubleshoot a HSRP issue. This time we’ll troubleshoot VRRP. These two protocols have many similarities, if you can troubleshoot one then the other shouldn’t be a problem.

Let’s take a look, I will use the following topology:

HSRP Troubleshooting Topology

The router on the left is our “client” device, R2 and R3 are configured for VRRP. The goal is to reach 4.4.4.4 from the client. Unfortunately, this is not working:

Client#ping 4.4.4.4

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:
U.!!!
Success rate is 60 percent (3/5), round-trip min/avg/max = 8/13/20 ms

Some of the IP packets are not arriving at 4.4.4.4. Let’s check what default gateway our client is using:

Client#show ip route 
Default gateway is 192.168.123.254

Host               Gateway           Last Use    Total Uses  Interface
ICMP redirect cache is empty

IP routing has been disabled and the client is using gateway IP address 192.168.123.254. Let’s check if we can reach this address:

Client#ping 192.168.123.254

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.123.254, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/7/20 ms

Pinging the gateway address is no problem. Are our two VRRP routers able to reach 4.4.4.4 ? Let’s try that:

R2#ping 4.4.4.4

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R3#ping 4.4.4.4

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/7/20 ms

R2 is unable to reach 4.4.4.4 but R3 has no issues. Before we continue checking why R2 is unable to reach 4.4.4.4 we’ll take a look at the VRRP configuration to see which router is the master:

R2#show vrrp 
FastEthernet0/0 - Group 1  
  State is Master  
  Virtual IP address is 192.168.123.254
  Virtual MAC address is 0000.5e00.0101
  Advertisement interval is 1.000 sec
  Preemption enabled
  Priority is 100 
  Authentication MD5, key-string "WRONGPASS"
  Master Router is 192.168.123.2 (local), priority is 100 
  Master Advertisement interval is 1.000 sec
  Master Down interval is 3.609 sec
R3#show vrrp 
FastEthernet0/0 - Group 1  
  State is Master  
  Virtual IP address is 192.168.123.254
  Virtual MAC address is 0000.5e00.0101
  Advertisement interval is 1.000 sec
  Preemption enabled
  Priority is 100 
  Authentication MD5, key-string "SECRET"
  Master Router is 192.168.123.3 (local), priority is 100 
  Master Advertisement interval is 1.000 sec
  Master Down interval is 3.609 sec

The output of show vrrp is interesting. Both routers think they are active and if you look closely you can see why. Authentication has been enabled and there is a mismatch in the key-string. Since both routers are active half of the packets will end up at R2 and the rest at R3. This is why our client sees some packets arriving and others not. Let’s fix our authentication:

R2(config)#interface FastEthernet 0/0
R2(config-if)#vrrp 1 authentication md5 key-string SECRET

We’ll make sure the key-string is the same. Now you’ll see something on the console:

R2# %VRRP-6-STATECHANGE: Fa0/0 Grp 1 state Master -> Backup

This message on the console of R2 is promising. R3 has become the master:

R2#show vrrp | include Master
  Master Router is 192.168.123.3, priority is 100
R3#show vrrp | include Master
  State is Master  
  Master Router is 192.168.123.3 (local), priority is 100

R3 has been elected as the master router. Now let’s find out why R2 was unable to reach 4.4.4.4:

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career!
  • Full Access to our 660 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

507 Sign Ups in the last 30 days

satisfaction-guaranteed
100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Tags: ,


Ask a question or start a discussion by visiting our Community Forum