数通 | VRRP虚拟路由冗余协议的配置

VRRP协议简述

VRRP(虚拟路由冗余协议):通过把几台路由设备联合组成一台虚拟路由设备,将虚拟路由设备的IP地址作为用户的默认网关地址实现与外部的通讯。当网关设备发生故障时,VRRP协议能够快速选举新的网关设备承担数据流量,保障网络的可靠通信。

Master路由器的选举:首先比较每台路由器的优先级,优先级大的成为Master路由器,优先级相同的话,就比较接口IP地址,IP地址大的成为Master路由器。Master路由器会周期性的发送Advertisement报文(组播),如果Backup路由器在规定的间隔时间内没收到Master路由器发来的Advertisement报文,则认为Master路由器“挂掉”了,那么就会进行新一轮的选举。

VRRP的三种状态:Initialize、Master和Backup

VRRP有三种状态:Initialize , Master, Backup

  • Initialize 状态
    系统刚启动VRRP的状态;在此状态,不处理VRRP报文。
  • Master状态
    当路由器处于Master状态时,路由器会处理:
    1、每隔1s发送VRRP组播报文,来报告自己的状态。
    2、响应对虚拟IP地址的ARP请求,并且响应的是虚拟MAC地址,而不是接口的真实MAC地址。
    3、转发目的MAC是虚拟MAC的IP报文。
    4、如果是虚拟IP拥有者,接受目的IP地址是虚拟IP地址的报文,否则丢弃。
    5、当接受到优先级大的VRRP报文时,变成backup;接口shutdown后,变为initialize状态。
  • Backup状态
    当路由器处于backup状态时,路由器将:
    1、监听Master发送的VRRP报文,如果在3个周期内不能接受到,变为master,并发送免费ARP(为什么)。
    2、不响应对虚拟IP地址的ARP请求。
    3、丢弃目的MAC为虚拟MAC的IP报文。
    4、丢弃目的IP为虚拟IP地址的报文。

拓扑图(含IP规划)

  • 配置任务
    按照拓扑图要求配置IP地址,配置VRRP虚拟路由冗余协议(将R1的eth0/0/0、R2的eth0/0/0加入到vrrid 1中并设置好优先级选择R1作为主用路由器、将R1的eth0/0/1、R2的eth0/0/1加入到vrrid 2中并设置好优先级选择R2作为主用路由器),并最终实现PC1和PC3的互相通信,且PC1->PC3所使用的网关设备是R1,PC3->PC1所使用的网关设备是R2。

  • 配置工具
    华为网络设备仿真平台eNSP

VRRP虚拟路由冗余协议的配置

配置步骤(含完整指令)

首先,配置主机PC1、PC2、PC3的IP信息很简单(注意,我们这里准备配置VRRP协议,所以这个网关地址就填那个“虚拟”的IP地址),比如PC1就这样:


配置主机PC1

然后,需要配置的是R1、R2的各个端口所分配的IP地址,以R1为例,需要配置的有Eth0/0/0(192.168.1.2/24)、Eth0/0/1(192.168.2.2/24)端口。

<Huawei>sys  #R1
Enter system view, return user view with Ctrl+Z.
[Huawei]int eth0/0/1
[Huawei-Ethernet0/0/1]ip address 192.168.2.2 24
[Huawei-Ethernet0/0/1]
Jul 26 2019 15:47:40-08:00 Huawei %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP on the interface Ethernet0/0/1 has entered the UP state.
Jul 26 2019 15:47:42-08:00 Huawei DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 1, the change loop count is 0, and the maximum number of records is 4095.
[Huawei-Ethernet0/0/1]int eth0/0/0
[Huawei-Ethernet0/0/0]ip address 192.168.1.2 24
[Huawei-Ethernet0/0/0]
Jul 26 2019 15:50:59-08:00 Huawei %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP on the interface Ethernet0/0/0 has entered the UP state.
Jul 26 2019 15:51:02-08:00 Huawei DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 2, the change loop count is 0, and the maximum number of records is 4095.
[Huawei-Ethernet0/0/0]

<Huawei>sys  #R2
Enter system view, return user view with Ctrl+Z.
[Huawei]int eth0/0/0
[Huawei-Ethernet0/0/0]ip address 192.168.1.3 24
[Huawei-Ethernet0/0/0]
Jul 26 2019 15:51:50-08:00 Huawei %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP on the interface Ethernet0/0/0 has entered the UP state.
Jul 26 2019 15:51:52-08:00 Huawei DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 1, the change loop count is 0, and the maximum number of records is 4095.
[Huawei-Ethernet0/0/0]int eth0/0/1
[Huawei-Ethernet0/0/1]ip address 192.168.2.3 24
[Huawei-Ethernet0/0/1]
Jul 26 2019 15:52:05-08:00 Huawei %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP on the interface Ethernet0/0/1 has entered the UP state.
Jul 26 2019 15:52:12-08:00 Huawei DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 2, the change loop count is 0, and the maximum number of records is 4095.
[Huawei-Ethernet0/0/1]

再然后,就具体在路由器上配置vrrp协议:

[Huawei]int eth0/0/0   #R1
[Huawei-Ethernet0/0/0]vrrp vrid 1 virtual-ip 192.168.1.254 
[Huawei-Ethernet0/0/0]
Jul 26 2019 16:19:10-08:00 Huawei %%01VRRP/4/STATEWARNINGEXTEND(l)[4]:Virtual Router state BACKUP changed to MASTER, because of protocol timer expired. (Interface=Ethernet0/0/0, VrId=1, InetType=IPv4)
Jul 26 2019 16:19:13-08:00 Huawei DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 10, the change loop count is 0, and the maximum number of records is 4095.
[Huawei-Ethernet0/0/0]vrrp vrid 1 priority 120  #设置优先级(默认优先级为100,所以120这个就会在选举中成为主用路由)
[Huawei-Ethernet0/0/0]
Jul 26 2019 16:19:33-08:00 Huawei DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 11, the change loop count is 0, and the maximum number of records is 4095.
[Huawei-Ethernet0/0/0]vrrp vrid 1 preempt-mode ?
  disable  Cancel current configuration
  timer    Specify timer

[Huawei-Ethernet0/0/0]vrrp vrid 1 preempt-mode timer delay 20    #设置抢占等待时间
[Huawei-Ethernet0/0/0]
Jul 26 2019 16:20:23-08:00 Huawei DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 12, the change loop count is 0, and the maximum number of records is 4095.
[Huawei-Ethernet0/0/0]vrrp vrid 1 track interface eth0/0/1 reduced 30  # 监控上层端口状态调整优先级
[Huawei-Ethernet0/0/0]
Jul 26 2019 16:20:53-08:00 Huawei DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 13, the change loop count is 0, and the maximum number of records is 4095.
[Huawei-Ethernet0/0/0]int eth0/0/1
[Huawei-Ethernet0/0/1]vrrp vrid 2 virtual-ip 192.168.2.254
[Huawei-Ethernet0/0/1]
Jul 26 2019 16:24:13-08:00 Huawei DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 14, the change loop count is 0, and the maximum number of records is 4095.
Jul 26 2019 16:24:15-08:00 Huawei %%01VRRP/4/STATEWARNINGEXTEND(l)[5]:Virtual Router state BACKUP changed to MASTER, because of protocol timer expired. (Interface=Ethernet0/0/1, VrId=2, InetType=IPv4)
[Huawei-Ethernet0/0/1]

针对这条指令vrrp vrid 1 preempt-mode timer delay 20 #设置抢占等待时间

举个例子,R1的Eth0/0/0地址192.168.1.2/24 和 R2的Eth0/0/0地址192.168.1.3/24作为下层PC1的待选择网关,根据我们上面的拓扑图设置,R1的Eth0/0/0地址192.168.1.2/24会被选举为Master状态,也就是说下层PC1、PC2的网关地址会是192.168.1.2/24。
假设我们的R1因为故障宕机了,那么下层的PC1、PC2的网关地址岂不是会出错?当然了,VRRP自然不会容忍这种情况,即VRRP机制会让处于Master状态的R1不断地向所有处于Backup状态的R2间隔性发生VRRP组播报文,这样在R1宕机或是出现其他故障问题后,R2就会发现在一段时间内它都无法收到R1的VRRP组播报文,这样它就会认为R1已经“离开”了,然后发起新一轮的“选举”。
那么,这里的抢占等待时间,也就是说,R1在20s内没有发送VRRP组播报文(即R2在20s内没有收到VRRP组播报文),才会发起新的“选举”。(默认这个延迟等待时间是0s)
试想一下,我们这里为什么不推荐直接采用默认配置(0s)呢?

再来谈谈这条指令vrrp vrid 1 track interface eth0/0/1 reduced 30 # 监控上层端口状态调整优先级!

分析这种情况

上面图中很明显地,标明VRRP协议所“选举”出来的Master状态的R1的上层链路出现故障,这时候,R1的Eth0/0/0端口的IP地址就不能再担当下层PC1、PC2的网关IP地址了,这在本拓扑图中很明显吧。VRRP协议有这样的规定——我可以监控R1的所有(或特定的某个)上层端口(可以理解为“非网关”端口),每当我探查到其中一个出现链路故障,我就给这个参与“选举”的R1降低优先级。
试想一下,我们为什么不对出现上层链路不通的路由器直接做“剥夺选举资格”的操作?

[Huawei]int eth0/0/0   #R2
[Huawei-Ethernet0/0/0]vrrp vrid 1 virtual-ip 192.168.1.254
[Huawei-Ethernet0/0/0]
Jul 26 2019 16:27:53-08:00 Huawei DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 3, the change loop count is 0, and the maximum number of records is 4095. 
[Huawei-Ethernet0/0/0]int eth0/0/1
[Huawei-Ethernet0/0/1]vrrp vrid 2 virtual-ip 192.168.2.254 
[Huawei-Ethernet0/0/1]
Jul 26 2019 16:28:33-08:00 Huawei DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 4, the change loop count is 0, and the maximum number of records is 4095.
[Huawei-Ethernet0/0/1]vrrp vrid 2 priority 120
[Huawei-Ethernet0/0/1]
Jul 26 2019 16:28:45-08:00 Huawei %%01VRRP/4/STATEWARNINGEXTEND(l)[0]:Virtual Router state BACKUP changed to MASTER, because of priority calculation. (Interface=Ethernet0/0/1, VrId=2, InetType=IPv4)
Jul 26 2019 16:28:53-08:00 Huawei DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 5, the change loop count is 0, and the maximum number of records is 4095.
[Huawei-Ethernet0/0/1]vrrp vrid 2 preempt-mode timer delay 20
[Huawei-Ethernet0/0/1]
Jul 26 2019 16:29:13-08:00 Huawei DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 6, the change loop count is 0, and the maximum number of records is 4095.
[Huawei-Ethernet0/0/1]vrrp vrid 2 track interface eth0/0/0 reduced 30
[Huawei-Ethernet0/0/1]
Jul 26 2019 16:29:43-08:00 Huawei DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 7, the change loop count is 0, and the maximum number of records is 4095.
[Huawei-Ethernet0/0/1]

结果验证

  • ping验证(PC1上ping PC3)
PC>ping 192.168.2.1

Ping 192.168.2.1: 32 data bytes, Press Ctrl_C to break
From 192.168.2.1: bytes=32 seq=1 ttl=127 time=187 ms
From 192.168.2.1: bytes=32 seq=2 ttl=127 time=78 ms
From 192.168.2.1: bytes=32 seq=3 ttl=127 time=94 ms
From 192.168.2.1: bytes=32 seq=4 ttl=127 time=78 ms
From 192.168.2.1: bytes=32 seq=5 ttl=127 time=94 ms

--- 192.168.2.1 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 78/106/187 ms

  • tracert验证
PC>tracert 192.168.2.1  #PC1->PC3的路由追踪
-
YI7
';]=`  
traceroute to 192.168.2.1, 8 hops max
(ICMP), press Ctrl+C to stop
 1  192.168.1.2   78 ms  47 ms  46 ms

 2  192.168.2.1   94 ms  78 ms  94 ms

PC>tracert 192.168.1.4   #PC3->PC1的路由追踪

traceroute to 192.168.1.4, 8 hops max
(ICMP), press Ctrl+C to stop
 1  192.168.2.3   78 ms  47 ms  47 ms
 2  192.168.1.4   78 ms  94 ms  93 ms

VRRP与BFD

当R1或R1到R2间链路出现故障时,VRRP报文“重新选举”需要一定的协商周期。为了实现链路故障时快速切换,在链路中部署了BFD链路检测机制,实现当主用接口或者链路出现故障时,Backup状态设备迅速切换为Master状态,承担网络流量,以减少故障对业务传输的影响。

BFD:(Bidirectional Forwarding Detection,双向转发检测)协议提供一种轻负载、快速检测两台邻接路由器/交换机之间转发路径连通状态的方法,它是一个简单的“Hello”协议,在很多方面,它与那些著名的路由协议的邻居检测部分相似。之所以被称为双向,是因为BFD协议通过三次握手机制,能提供链路来回两个方向的连通性检测。

参考文献

推荐阅读更多精彩内容