For one of the many projects that I’ve been assigned at work, I got the chance to join the InfoSec Team and help design and configure their second site for their expanding network. Of course, any network engineer always wants to design and provision a network, they can call his/her own! So we were put on a plane and off to Sunny Glasgow, with a plan of attack and 4 days to get this first phase done.

To say it was a busy few days would be the understatement of the year, long days and nights on the data floor stacking, racking, patching and configuring. We had hard deadline to get everything configured and remotely accessible, so making sure the network was sorted was key! But one good thing was that the data floor was in one of our office buildings and it had a window! Inserts shameless instagram plug!


New network being created up in super sunny Glasgow! At least I got a view and window on the datafloor haha #datafloor #datacenter #officeracks #juniper #c7000 #cabling #latenights #cisco #vmware #network

A photo posted by Keeran Marquis (@kdmarquis87) on Oct 28, 2015 at 12:37am PDT


For those who haven’t worked in a dedicated datacentre, you wouldn’t understand how great natural light and view can be after 10 hours of work haha! In the end, phase one was completed on time (just), with everything working as expected. Inserts another shameless instagram plug

Network sorted 😁😁😁 couple bits to left to do but all remotely accessible 🙌🏾🙌🏾🙌🏾 3 long days but all done by me 😁 #officeracks #EX4550 #EX4200 #EX4300 #juniper #messycabling #datafloor A photo posted by Keeran Marquis (@kdmarquis87) on Oct 29, 2015 at 1:49pm PDT


Missing from that post above was a Cisco 3750X that was used for vendor redundancy as part of the network. The guys had a HP c7000 Blade Chassis with 2 HP Virtual Connects Chassis Switches which needed to be connected to the edge switches, a Juniper EX4300 and the Cisco. This meant that I would have to span a vlan across two switches and share a default gateway between them. With this being the case, I had use a First-hop Redundancy Protocol (FHRP) and as I was using a multiple vendor topology, the FHRP of choice would have to be VRRP (Virtual Router Redundancy Protocol).

VRRP is best defined in RFC3768:

The Virtual Router Redundancy Protocol (VRRP) is designed to eliminate the single point of failure inherent in the static default routed environment. VRRP specifies an election protocol that dynamically assigns responsibility for a virtual router to one of the VRRP routers on a LAN. The VRRP router controlling the IP address(es) associated with a virtual router is called the Master, and forwards packets sent to these IP addresses. The election process provides dynamic fail-over in the forwarding responsibility should the Master become unavailable.

As VRRP is an open standard, it’s interoperable between both Cisco and Juniper devices. If it were just using Cisco devices, I would have had a choice between VRRP or HSRP (Hot Standby Router Protocol). HSRP works similar as VRRP but it’s a Cisco Proprietary Protocol, which means it’s only compatible between Cisco devices. You can see more detail on HSRP in RFC2281

Due to the upstream routing requirements and the EX4300 being higher specced switch, it was decided that the EX4300 was going to be the Master. The topology I was working with is shown below.

VRRP Topology

With that all explained, Let’s get cracking :D

Juniper Configuration

Physical Interface Configuration

xe-0/2/3 {
    description "TRUNK to Edge Cisco";
    unit 0 {
        family ethernet-switching {
            interface-mode trunk;
            vlan {
                members reith;

Integrated Routing & Bridging Configuration

irb {
    unit 100 {                          
        family inet {
            address {
                vrrp-group 1 {
                    priority 150;

Vlan Configuration

vlans {
    reith {
        vlan-id 100;
        l3-interface irb.100;

With the irb configuration, under the vrrp-group stanza, I had to add the command accept-data. Adding this command it will enable the master router to accept all packets destined for the Virtual IP (VIP) address. If this isn’t enabled when the EX4300 is set/becomes master, it will not respond to any packets sent to the VIP address!

Cisco Configuration

Physical Interface t1/1/2

egde-cisco#show run int t1/1/2 
Building configuration...

Current configuration : 137 bytes
interface TenGigabitEthernet1/1/2
 description "TRUNK to Edge Juniper"
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 100
 switchport mode trunk

Routed VLAN Interface

egde-cisco#show run int vlan100
Building configuration...

Current configuration : 176 bytes
interface Vlan100
 ip address
 vrrp 1 description "TRUNK to Edge Juniper"
 vrrp 1 ip
 no vrrp 1 preempt
 vrrp 1 priority 145

Juniper Verification

Depending on the level of detail you want to go into, you can run of any of these commands show vrrp summary, show vrrp detail or show vrrp extensive. I mostly use show vrrp summary or show vrrp detail as ive found (most of time) that you get want you need from either useless you’ve had a big issue and extensive detail is needed!

Show VRRP Summary

marquk01@edge-juniper> show vrrp summary     
Interface     State       Group   VR state       VR Mode    Type   Address 
irb.100       up              1   master          Active    lcl         

Show VRRP Detail

marquk01@edge-juniper> show vrrp detail       
Physical interface: irb, Unit: 100, Address:
  Index: 547, SNMP ifIndex: 567, VRRP-Traps: disabled, VRRP-Version: 2
  Interface state: up, Group: 1, State: master, VRRP Mode: Active
  Priority: 150, Advertisement interval: 1, Authentication type: none
  Advertisement threshold: 3, Computed send rate: 0
  Preempt: no, Accept-data mode: yes, VIP count: 1, VIP:       
  Advertisement Timer: 0.064s, Master router:
  Virtual router uptime: 19:40:12, Master router uptime: 19:40:04
  Virtual Mac: 00:00:5e:00:01:01 
  Tracking: disabled

Cisco Verification

On a Cisco, you can check VRRP status by running the command show vrrp

egde-cisco#show vrrp 
Vlan100 - Group 1  
"TRUNK to Edge Juniper"
  State is Backup  
  Virtual IP address is
  Virtual MAC address is 0000.5e00.0101
  Advertisement interval is 1.000 sec
  Preemption disabled
  Priority is 145 
  Master Router is, priority is 145 
  Master Advertisement interval is 1.000 sec
  Master Down interval is 3.433 sec

And with that we are done! Confirmed VRRP is working as expected! To be honest, before getting started I was a little worried that ill be running into plenty of issues running cross vendor but it was pretty straightforward, which is always good when you’re under the gun :)

Share on LinkedIn
Share on Reddit