HP 6125XLG R2306-HP 6125XLG Blade Switch High Availability Configuration Guide - Page 47

Authentication method, VRRP timers, Skew_Time, VRRP advertisement interval

Get HP 6125XLG PDF manuals and user guides View all HP 6125XLG manuals
Add to My Manuals
Save this manual to your list of manuals

Page 47 highlights

• Preemptive mode-A backup starts a new master election and takes over as master when it detects that it has a higher priority than the current master. Preemptive mode makes sure the router with the highest priority in a VRRP group always acts as the master. Authentication method To avoid attacks from unauthorized users, VRRP member routers add authentication keys in VRRP packets to authenticate one another. VRRP provides the following authentication methods: • Simple authentication The sender fills an authentication key into the VRRP packet, and the receiver compares the received authentication key with its local authentication key. If the two authentication keys match, the received VRRP packet is legitimate. Otherwise, the received packet is illegitimate and gets discarded. • MD5 authentication The sender computes a digest for the packet to be sent by using the authentication key and MD5 algorithm, and saves the result in the VRRP packet. The receiver performs the same operation with the authentication key and MD5 algorithm, and compares the result with the content in the authentication header. If the results match, the received VRRP packet is legitimate. Otherwise, the received packet is illegitimate and gets discarded. On a secure network, you can choose to not authenticate VRRP packets. NOTE: IPv4 VRRPv3 and IPv6 VRRPv3 do not support VRRP packet authentication. VRRP timers Skew_Time Skew_Time helps avoid the situation that multiple backups in a VRRP group become the master at the same time when the master in the VRRP group fails. Skew_Time is not configurable and its value depends on the version of VRRP: • In VRRPv2 (described in RFC 3768), Skew_Time is (256 - Router priority)/256. • In VRRPv3 (described in RFC 5798), Skew_Time is ((256 - Router priority) × VRRP advertisement interval)/256. VRRP advertisement interval The master in a VRRP group periodically sends VRRP advertisements to declare its presence. You can configure the interval at which the master sends VRRP advertisements. If a backup does not receive a new VRRP advertisement from the master when the timer (3 × VRRP advertisement interval + Skew_Time) expires, it regards that the master has failed and takes over as the master. VRRP preemption delay timer To avoid frequent state changes among members in a VRRP group and provide the backups enough time to collect information (such as routing information). In preempt mode, a backup does not immediately become the master after it receives an advertisement with lower priority than the local priority. Instead, it waits for a period of time (preemption delay time + Skew_Time) before taking over as the master. 42

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
42
•
Preemptive mode
—A backup starts a new master election and takes over as master when it detects
that it has a higher priority than the current master. Preemptive mode makes sure the router with the
highest priority in a VRRP group always acts as the master.
Authentication method
To avoid attacks from unauthorized users, VRRP member routers add authentication keys in VRRP packets
to authenticate one another. VRRP provides the following authentication methods:
•
Simple authentication
The sender fills an authentication key into the VRRP packet, and the receiver compares the received
authentication key with its local authentication key. If the two authentication keys match, the
received VRRP packet is legitimate. Otherwise, the received packet is illegitimate and gets
discarded.
•
MD5 authentication
The sender computes a digest for the packet to be sent by using the authentication key and MD5
algorithm, and saves the result in the VRRP packet. The receiver performs the same operation with
the authentication key and MD5 algorithm, and compares the result with the content in the
authentication header. If the results match, the received VRRP packet is legitimate. Otherwise, the
received packet is illegitimate and gets discarded.
On a secure network, you can choose to not authenticate VRRP packets.
NOTE:
IPv4 VRRPv3 and IPv6 VRRPv3 do not support VRRP packet authentication.
VRRP timers
Skew_Time
Skew_Time helps avoid the situation that multiple backups in a VRRP group become the master at the
same time when the master in the VRRP group fails.
Skew_Time is not configurable and its value depends on the version of VRRP:
•
In VRRPv2 (described in RFC 3768), Skew_Time is (256 – Router priority)/256.
•
In VRRPv3 (described in RFC 5798), Skew_Time is ((256 – Router priority) × VRRP advertisement
interval)/256.
VRRP advertisement interval
The master in a VRRP group periodically sends VRRP advertisements to declare its presence.
You can configure the interval at which the master sends VRRP advertisements. If a backup does not
receive a new VRRP advertisement from the master when the timer (3 × VRRP advertisement interval +
Skew_Time) expires, it regards that the master has failed and takes over as the master.
VRRP preemption delay timer
To avoid frequent state changes among members in a VRRP group and provide the backups enough time
to collect information (such as routing information). In preempt mode, a backup does not immediately
become the master after it receives an advertisement with lower priority than the local priority. Instead,
it waits for a period of time (preemption delay time + Skew_Time) before taking over as the master.