How to Setup VRRP for Router Failover

ciscocisco-catalystcisco-commandsfhrpvrrp

I'm doing my VRRP networking lab. My understanding is if the Master failed then Backup will take over. In this scenarios, I have two layer 3 SW are connected together over LACP, and these two layer 3 switches are connected one Access Switch over LACP and one Firewall with static IPs. Now, two layer 3 sw are doing VRRP over SVI (Vlan 400). Now, if I shutdown one interface on Master that connected to FW then suppose Backup VRRP will take over, but the PC connected to Access can't ping FW IP (192.168.122.192). Any suggestion how I fix it?

enter image description here

here is configuration file
Core SW1

interface Loopback0
 ip address 10.10.10.10 255.255.255.255
!
interface Port-channel10
 switchport trunk allowed vlan 172,201,300,400
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface Port-channel20
 switchport trunk allowed vlan 172,201,300,400
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface Port-channel30
 switchport trunk allowed vlan 172,201,300,400
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet1/2
 no switchport
 description ---connected to DHCP---
 ip address 10.100.100.1 255.255.255.0
 ip helper-address 10.100.100.2
 negotiation auto
!
interface GigiabitEthernet 2/2
no switchport
description --connected to FW---
ip address 10.10.10.1 255.255.255.252
negotiation auto

interface Vlan400
 ip address 10.10.0.10 255.255.254.0
 ip helper-address 10.100.100.2
 vrrp 10 description -Load balance-
 vrrp 10 ip 10.10.0.1
 vrrp 10 ip 10.10.0.2 secondary
 vrrp 10 priority 254
 vrrp 10 authentication text cisco
!
router ospf 1
 network 10.10.0.0 0.0.3.255 area 1
 network 10.10.10.0 0.0.0.3 area 0
 network 10.10.10.10 0.0.0.0 area 0
 network 10.30.0.0 0.0.3.255 area 1
 network 10.100.100.0 0.0.0.255 area 1

CoreSW2

interface Loopback0
 ip address 20.20.20.20 255.255.255.255
!
interface Port-channel20
 switchport access vlan 300
 switchport trunk allowed vlan 172,201,300,400
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface Port-channel40
 switchport trunk allowed vlan 172,201,300,400
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface Port-channel45
 switchport trunk allowed vlan 172,201,300,400
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet2/0
 no switchport
 description ---Connected to FireWall---
 ip address 20.20.20.1 255.255.255.252
 ip ospf priority 0
 negotiation auto
!
interface Vlan400
 ip address 10.10.0.11 255.255.252.0
 ip helper-address 10.100.100.2
 vrrp 10 description -Load balance-
 vrrp 10 ip 10.10.0.1
 vrrp 10 ip 10.10.0.2 secondary
 vrrp 10 authentication text cisco
!
router ospf 1
 network 10.10.0.0 0.0.3.255 area 1
 network 10.30.0.0 0.0.3.255 area 1
 network 20.20.20.0 0.0.0.3 area 0
 network 20.20.20.20 0.0.0.0 area 0

FireWall

interface Loopback0
 ip address 40.40.40.40 255.255.255.255

!
interface GigabitEthernet2/0
 ip address 10.10.10.2 255.255.255.252
 description ---CoreSW1---
 ip nat inside
 ip virtual-reassembly
 ip ospf priority 255
 negotiation auto
!
interface GigabitEthernet3/0
 ip address 20.20.20.2 255.255.255.252
 description --CoreSW2---
 ip nat inside
 ip virtual-reassembly
 ip ospf priority 255
!
router ospf 1
 log-adjacency-changes
 network 10.10.10.0 0.0.0.3 area 0
 network 20.20.20.0 0.0.0.3 area 0
 network 40.40.40.40 0.0.0.0 area 0
 network 192.168.122.0 0.0.0.255 area 2 (ISP)

Best Answer

One thing I noticed is that you are not tracking the links to the firewall, and you have no way configured for VRRP to fail over to the other switch if a link goes down. You will fail over if the entire switch fails.

You probably want the priority on the primary VRRP switch to be set at 105, and the backup as 100, then decrement by 10 if the link to the firewall fails. Configure preempt so that the backup will preempt the primary, and that the primary will resume when the link comes back up. You should also put in a delay so that a bouncing link doesn't cause the primary to jump back and forth.

Something like:

Core SW1:

track 100 interface GigiabitEthernet2/2 line-protocol
!
interface Vlan400
 ip address 10.10.0.10 255.255.254.0  !*** doesn't match the other switch ***
 ip helper-address 10.100.100.2
 vrrp 10 ip 10.10.0.1
 vrrp 10 priority 105
 vrrp 10 preempt delay 30
 vrrp 10 track 100 decrement 10
 vrrp 10 authentication text cisco
!

Core SW2:

interface Vlan400
 ip address 10.10.0.11 255.255.252.0  !*** doesn't match the other switch ***
 ip helper-address 10.100.100.2
 vrrp 10 ip 10.10.0.1
 vrrp 10 priority 100
 vrrp 10 preempt delay 30
 vrrp 10 authentication text cisco
!

Also, with switches, it is a really bad idea to try to load balance the way you have it configured. You want the STP root bridge to match the FHRP primary, otherwise you will get suboptimal traffic flows. If you want, you can have one switch as the STP root FHRP primary for the odd numbered VLANs, and the other switch the same for the even numbered VLANs, or some other such scheme, but all the traffic from a VLAN will go to the STP root, which should be the FHRP primary for that VLAN.

Related Topic