For one of the many projects that I’ve been assigned at work, I got the chance to join the InfoSec Team and help design and configure their second site for their expanding network. Of course, any network engineer always wants to design and provision a network, they can call his/her own! So we were put on a plane and off to Sunny Glasgow, with a plan of attack and 4 days to get this first phase done.
To say it was a busy few days would be the understatement of the year, long days and nights on the data floor stacking, racking, patching and configuring. We had hard deadline to get everything configured and remotely accessible, so making sure the network was sorted was key! But one good thing was that the data floor was in one of our office buildings and it had a window! Inserts shameless instagram plug!
For those who haven’t worked in a dedicated datacentre, you wouldn’t understand how great natural light and view can be after 10 hours of work haha
In the end, phase one was completed on time (just), with everything working as expected. Inserts another shameless instagram plug
Network sorted 😁😁😁 couple bits to left to do but all remotely accessible 🙌🏾🙌🏾🙌🏾 3 long days but all done by me 😁 #officeracks #EX4550 #EX4200 #EX4300 #juniper #messycabling #datafloor A photo posted by Keeran Marquis (@kdmarquis87) on
Missing from that post above was a Cisco 3750X that was used for vendor redundancy as part of the network. The guys had a HP c7000 Blade Chassis with 2 HP Virtual Connects Chassis Switches which needed to be connected to the edge switches, a Juniper EX4300 and the Cisco. This meant that I would have to span a vlan across two switches and share a default gateway between them. With this being the case, I had use a First-hop Redundancy Protocol (FHRP) and as I was using a multiple vendor topology, the FHRP of choice would have to be VRRP (Virtual Router Redundancy Protocol).
VRRP is best defined in RFC3768:
As VRRP is an open standard, it’s interoperable between both Cisco and Juniper devices. If it were just using Cisco devices, I would have had a choice between VRRP or HSRP (Hot Standby Router Protocol). HSRP works similar as VRRP but it’s a Cisco Proprietary Protocol, which means it’s only compatible between Cisco devices. You can see more detail on HSRP in RFC2281
Due to the upstream routing requirements and the EX4300 being higher specced switch, it was decided that the EX4300 was going to be the Master. The topology I was working with is shown below.
Juniper Configuration
xe-0/2/3 {
description "TRUNK to Edge Cisco";
enable;
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members reith;
}
}
}
}
irb {
enable;
unit 100 {
enable;
family inet {
address 10.199.6.1/23 {
vrrp-group 1 {
virtual-address 10.199.7.254;
priority 150;
no-preempt;
accept-data;
}
}
}
}
}
vlans {
reith {
vlan-id 100;
l3-interface irb.100;
}
}
Cisco Configuration
egde-cisco#show run int t1/1/2 Building configuration... Current configuration : 137 bytes ! interface TenGigabitEthernet1/1/2 description "TRUNK to Edge Juniper" switchport trunk encapsulation dot1q switchport trunk allowed vlan 100 switchport mode trunk end
egde-cisco#show run int vlan100 Building configuration... Current configuration : 176 bytes ! interface Vlan100 ip address 10.199.6.2 255.255.254.0 vrrp 1 description "TRUNK to Edge Juniper" vrrp 1 ip 10.199.7.254 no vrrp 1 preempt vrrp 1 priority 145 end
Juniper Verification
Depending on the level of detail you want to go into, you can run of any of these commands show vrrp summary, show vrrp detail or show vrrp extensive. I mostly use show vrrp summary or show vrrp detail as ive found (most of time) that you get want you need from either useless you’ve had a big issue and extensive detail is needed!
[email protected]> show vrrp summary Interface State Group VR state VR Mode Type Address irb.100 up 1 master Active lcl 10.199.6.1 vip 10.199.7.254
[email protected]> show vrrp detail Physical interface: irb, Unit: 100, Address: 10.199.6.1/23 Index: 547, SNMP ifIndex: 567, VRRP-Traps: disabled, VRRP-Version: 2 Interface state: up, Group: 1, State: master, VRRP Mode: Active Priority: 150, Advertisement interval: 1, Authentication type: none Advertisement threshold: 3, Computed send rate: 0 Preempt: no, Accept-data mode: yes, VIP count: 1, VIP: 10.199.7.254 Advertisement Timer: 0.064s, Master router: 10.199.6.1 Virtual router uptime: 19:40:12, Master router uptime: 19:40:04 Virtual Mac: 00:00:5e:00:01:01 Tracking: disabled
Cisco Verification
On a Cisco, you can check VRRP status by running the command show vrrp
egde-cisco#show vrrp Vlan100 - Group 1 "TRUNK to Edge Juniper" State is Backup Virtual IP address is 10.199.7.254 Virtual MAC address is 0000.5e00.0101 Advertisement interval is 1.000 sec Preemption disabled Priority is 145 Master Router is 10.199.6.1, priority is 145 Master Advertisement interval is 1.000 sec Master Down interval is 3.433 sec
And with that we are done! Confirmed VRRP is working as expected! To be honest, before getting started I was a little worried that ill be running into plenty of issues running cross vendor but it was pretty straightforward, which is always good when you’re under the gun 🙂
