Subject: [VRRP] Explanation of virtual MAC addresss

From: Matthew Bloch <[email-masked]>
Date: Sat, 6 Sep 2003 18:10:05 +0100

Hello,

I've been looking at methods of implementing router failover between a pair
of OpenBSD machines and found VRRP.  After a lot of looking around for UNIX
implementations (and finding no finshed OpenBSD implementation), I backed
away from it in the end in favour of wackamole(.org) which does the same job
for UNIX machines: to share a group of virtual IPs among a group of hosts,
and ensure only one of hosts has possession of them at a time.

Before I found wackamole, I had a question about the VRRP spec: why is there
a need for a virtual MAC address?  The reason given is "to enable bridge
learning in an extended LAN".  Putting UNIX implementation difficulties
aside, I don't understand what network equipment would benefit from this
trick.

wackamole is configured to do a blanket gratuitous ARP response to all hosts
on the network when a virtual IP changes hands, which ought to be enough to
alter the ARP caches everywhere on the LAN, however far extended or bridged
it is.  In fact I would have thought security-conscious switches would have
flagged a problem if it saw a hardware address jumping between switch ports:
the standard configuration for switches at my old college was to stop
working if you kept changing hardware addresses.  So that seems like another
headache for the administrator to work around.

In fact to avoid confusing switches, gratuitous ARP is already required of a
VRRP implementation when the IP addresses changes hands, presumably for the
benefit of the directly-connected switch, but why not just allow the MAC
address to change with the virtual IP and remove a the headache of
implementing it?

It seems to me at least that the virtual MAC address should be an optional
part of any VRRP implementation, only needed for setups which require it. 
At any rate I'm polishing a portable UNIX implementation of VRRP which does
not bother with the virtual MAC address, since it should still be able to
participate 100% in a group of VRRP-enabled routers, and to be able to take
over the virtual IPs if necessary, and I wonder whether other implementors
will do the same?

Any thoughts on the matter would be appreciated. Cheers,

- -- 
Matthew Bloch                             Bytemark Hosting
                                  tel. +44 (0) 8707 455026
                        http://www.bytemark-hosting.co.uk/
          Dedicated Linux hosts from 15ukp ($26) per month

_______________________________________________
vrrp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/vrrp

---

From: [email-masked]
Date: Mon, 8 Sep 2003 17:53:12 -0500

I didn't declare the consensus :) (that's why I had
those 2 questions marks next to that sentence).

I just wanted to hear some arguments against removing 
VMACs.

Sorry if my last mail created any confusions.

regards
Mukesh

> -----Original Message-----
> From: ext Radia Perlman - Boston Center for Networking
> [mailto:[email-masked]]
> Sent: Monday, September 08, 2003 3:13 PM
> To: [email-masked]; [email-masked]; Gupta Mukesh (IPRG/MtView)
> Cc: [email-masked]; [email-masked]
> Subject: RE: [VRRP] Explanation of virtual MAC addresss
> 
> 
> 
> 	What about VRRP for IPv6. I am observing that the WG is 
> 	inclined towards NOT using VMACs (??). Are there people who
> 	would like to keep the VMACs in VRRPv3 (VRRP for IPv6) ?
> 	If not, then we should update the current draft with 
> 	this change.
> 
> I'm not sure there's enough traffic on this issue to be sure of
> consensus. But if we did want to remove VMACs for IPv6, what
> is the equivalent of "gratuitous ARP" that would work in IPv6?
> Is there one?
> 
> Radia
> 
>

---

From: [email-masked]
Date: Fri, 19 Sep 2003 11:55:23 -0500

There is another perspective to this issue which was 
discussed in the meeting.

Use of VMACs make the VRRP switchover completely 
transparent to the hosts.

Now the debate can be "should the hosts be aware of 
the switch over or not" ??

Opinions/arguments ??

> From: ext Jeffrey Haas [mailto:[email-masked]]
> Sent: Friday, September 19, 2003 9:25 AM
> To: Radia Perlman - Boston Center for Networking
> Cc: [email-masked]
> Subject: Re: [VRRP] Explanation of virtual MAC addresss
> 
> 
> On Thu, Sep 18, 2003 at 02:19:50PM -0400, Radia Perlman - 
> Boston Center for Networking wrote:
> > Anyway, it would be good if people who care either way 
> would give their
> > arguments:
> > 
> > a) for VMACs
> > b) for no VMACs, and using unsolicited ND once
> > c) for no VMACs, and using unsolicted ND periodically
> > d) some other proposal
> 
> I believe it was asserted at some point that the vmac made certain
> switching situations easier to deal with.  If someone could expand
> on that point a bit, that might be helpful.
> 
> What was definitely the case was the problem with gratuitous arps
> and hosts that didn't listen to them.   In this particular case,
> our question should be "Do common implementations support unsolicited
> ND messages and thus don't require a virtual mac?"
> 
> Seems like a good question for the ipv6 folks.
> 
> -- 
> Jeff Haas 
> NextHop Technologies
>