Testing and troubleshooting the configuration
When a PC attempts to access a server that is behind a VRRP router, the PC starts by
ARPing for its gateway IP address, which is the VRRP virtual IP address. The VRRP master
then replies with a MAC address of the form 00-00-5e-00-01-xx, where xx is the VRID in
hexadecimal (for example 01 for VRRP instance 1).
You can confirm that VRRP is working correctly by looking at the FDB (forwarding database)
entries of the distribution switches. The entry for the VRRP virtual MAC address should
appear on the port that is connected to the master. For example, if port 1 on the distribution
switch is connected to the master switch, you should see the VRRP virtual MAC FDB entry
on port 1.
Therefore, to test whether VRRP is working, use the following steps:
1.
Enter the command show vrrp on each core switch, to check each switch's VRRP status.
Core 1 should be the VRRP master and core 2 should be the VRRP backup.
If the master and backup switches are the wrong way around, check the VRRP priorities.
If both switches claim to be the master, this is a serious problem, and probably indicates a
failure on the communication path between them.
2.
From the LAN behind one of the distribution switches, ping one of the servers. The ping
should succeed. If it doesn't, check the cabling, the VLAN configuration, and the IP
addresses. Also make sure that the PC is using the correct gateway address.
3.
On the distribution switch, check that there is an FDB entry for the VRRP MAC address
on the port that connects to core 1. This confirms that core 1 replied to the PC's ARP, so
core 1 is acting as the master.
4.
Power off core 2 (the backup) and ping the server again. The ping should still succeed and
the FDB entry should be present for the same port.
Note that just taking a link down is not an adequate test of this configuration because STP
can recover from a broken link. To test VRRP, you need to power the core switch off.
5.
Power core 2 back up and ping the server again. There should be no change.
Power off core 1, wait a few seconds, and ping the server again. The ping should still
6.
succeed because it will travel via core 2. Check the FDB on the distribution switch again.
This time, the FDB entry should be on the port that connects to core 2.
If core 2 doesn't take over as the master when you power core 1 down, check the cabling,
the VLAN configuration, and the VRRP configuration.
7.
Enter the show vrrp command on core 2. It should now be the VRRP master.
If failover happens but is slow, check that network devices are not blocking gratuitous ARPs.
The switch sends a gratuitous ARP when it becomes the VRRP master, so that connected
switches update their FDB entry for the VRRP virtual MAC. This minimises recovery time
because the switches do not have to wait for FDB entries to time out.
Page 8 | AlliedWare™ OS How To Note: VRRP
Testing and troubleshooting the configuration
Pagina afdrukken