Subject: [VRRP] Two MAC addresses for a same IP Primary address

From: Vincent Jardin <[email-masked]>
Date: Thu, 23 Mar 2006 10:38:12 +0100

Hi all,

According to the RFC3768, when a multicast VRRP packet is sent, the 
source IP address must be the *Primary IP Address* (section 5.2.1) and 
the source MAC address must be the *Virtual Router MAC Address*.

Moreover, the source MAC address of the the ICMP, TCP, ARP packets 
related to the *IP Address Owner*, must (of course) be the *Virtual 
Router MAC Address*.

Two routers running VRRP should have 2 differents *Primary IP Address*, 
and (of course) the same *IP Address Owner*.

So, if from a host, which is on the same Ethernet network, I send an 
ICMP echo request to:
   - the *Primary IP Address*, which source MAC address should the ICMP 
echo reply use ?
     According to me, it must NOT be the *Virtual Router MAC Address*.
   - the *IP Address Owner*, which source MAC address should the ICMP 
echo reply use ?
     According to me, it must be the *Virtual Router MAC Address*.

So it means that for any packets, when the source IP address is the 
*Primary IP Address*, the source MAC address could be any MAC address of 
the NIC; but when it is a VRRP Multicast packet to 224.0.0.18, the 
source MAC address must be the *Virtual Router MAC Address*.

Conclusion: a *Primary IP Address* can have two MAC addresses !!!, the 
*Virtual Router MAC Address* and the MAC address of the NIC !

It is not logical, so what are we missing ?

According to me:
   -Option1: the section 5.2.1 should specify that the source address 
should be an *IP Address Owner*, instead of the *Primary IP address*.
   -Option2: remove the constraint of the source MAC address of the VRRP 
packet = the *Virtual Router MAC Address*.

I prefer option 2 because it avoids the Ethernet switch from oscillating 
during a transition state.

Regards,
   Vincent

_______________________________________________
vrrp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/vrrp

---

From: "don provan" <[email-masked]>
Date: Thu, 23 Mar 2006 09:37:24 -0800

Vincent,

What you are missing is that there is no relation between the
source IP address in an IP packet and the source MAC address
in the ethernet packet carrying it. There is no requirement
whatsoever for them to match in any way, and thank goodness
because it would make routed packets somewhat difficult to
handle since they have source IP addresses completely unrelated
to any MAC address sending on the local network.

In other words, there is no such requirement as:

>Moreover, the source MAC address of the the ICMP, TCP, ARP
>packets related to the *IP Address Owner*, must (of course)
>be the *Virtual Router MAC Address*.

>Conclusion: a *Primary IP Address* can have two MAC
>addresses !!!, the *Virtual Router MAC Address* and
>the MAC address of the NIC !

The VR IP address "has" one MAC address: the VR MAC.
ARP should always advertise that mapping and no other.
But this has no relevance to the selection of source
MAC address when transmitting a packet.

I understand how startling this observation can be, but it's
just basic IP logic, nothing VRRP specific about it. Once
you get your thoughts around it, VRRP falls out nicely.
In particular, you realize that there is only one reason, ever,
to use the VR's MAC address as the source of an ethernet packet,
and that is to teach the ethernet switching infrastructure
where to send packets with that MAC address as the destination.
That is accomplished by sending the advertisement packets with
the VR MAC address as source since those packets are known to
be sent at the appropriate times.

For all other packets, the source MAC address retains its
original purpose: to identify the hardware that transmitted
the packet. If anything, this becomes *more* important in
a VRRP environment, since problems can be much harder to
diagnose if it's impossible to tell which system sent which
packets.

-don

-----Original Message-----
From: Vincent Jardin [mailto:[email-masked]] 
Sent: Thursday, March 23, 2006 1:38 AM
To: [email-masked]
Subject: [VRRP] Two MAC addresses for a same IP Primary address

Hi all,

According to the RFC3768, when a multicast VRRP packet is sent, the source
IP address must be the *Primary IP Address* (section 5.2.1) and the source
MAC address must be the *Virtual Router MAC Address*.

Moreover, the source MAC address of the the ICMP, TCP, ARP packets related
to the *IP Address Owner*, must (of course) be the *Virtual Router MAC
Address*.

Two routers running VRRP should have 2 differents *Primary IP Address*, and
(of course) the same *IP Address Owner*.

So, if from a host, which is on the same Ethernet network, I send an ICMP
echo request to:
   - the *Primary IP Address*, which source MAC address should the ICMP echo
reply use ?
     According to me, it must NOT be the *Virtual Router MAC Address*.
   - the *IP Address Owner*, which source MAC address should the ICMP echo
reply use ?
     According to me, it must be the *Virtual Router MAC Address*.

So it means that for any packets, when the source IP address is the *Primary
IP Address*, the source MAC address could be any MAC address of the NIC; but
when it is a VRRP Multicast packet to 224.0.0.18, the source MAC address
must be the *Virtual Router MAC Address*.

According to me:
   -Option1: the section 5.2.1 should specify that the source address should
be an *IP Address Owner*, instead of the *Primary IP address*.
   -Option2: remove the constraint of the source MAC address of the VRRP
packet = the *Virtual Router MAC Address*.

Regards,
   Vincent

---

From: Vincent Jardin <[email-masked]>
Date: Fri, 24 Mar 2006 09:24:25 +0100

Don,

> in the ethernet packet carrying it.

I definitively agree, that's why I was suspicious with our understanding 
of the RFC !

> The VR IP address "has" one MAC address: the VR MAC.

Here, what you call VR IP address is defined by *IP Address Owner* into 
the RFC, isn't it ?

> MAC address when transmitting a packet.

I agree that Address Resolution (ARP) of *IP Address Owner* must only 
adverise the *Virtual Router MAC Address*.

> where to send packets with that MAC address as the destination.

Of course, it is the basic goal of VRRP.

> be sent at the appropriate times.

Please, here, when you write "by sending the advertisement packets with 
VR MAC address", please, what is the IPv4 source address ?
   1-> the *IP Address Owner*
   2-> xor the *Primary IP Address*

Our issue is related to the fact that 2 IP addresses are defined into 
the RFC *IP Address Owner* and *Primary IP Address*. It is clear how the 
*IP Address Owner* must be used with the VR MAC address on many gateways 
running VRRP on a same link, but it is unclear for the *Primary IP Address*.

I would be interested in better understanding how is supposed to be used 
the *Primary IP Address* on 3 gateways running VRRP on a same link:
   -> There are 3 *Primary IP addresses* at least, aren't there ?

   -> Are these 3 *Primary IP addresses* reachable at anytime even if 
the gateway is in the backup state ?

Thanks,
   Vincent

---

From: "Don Provan" <[email-masked]>
Date: Fri, 24 Mar 2006 11:23:35 -0800

> Here, what you call VR IP address is defined by *IP Address 
> Owner* into the RFC, isn't it ?

There is a VR IP address. The VR IP address has an owner, but
it is the VR master, whether currently the owner or not, that
uses the VR MAC address.

> adverise the *Virtual Router MAC Address*.

The *master* is the one that ARPs the VR IP address, regardless
of whether it is the VR IP address owner. In any case, we agree
with the important point: ARP always maps VR IP address to VR MAC
address.

>    2-> xor the *Primary IP Address*

The source is the primary IP address of the interface through
which the advertisement is sent. For the VR IP address owner,
this could be the VR IP address itself, but for any other router
supporting this VR, it has to be an IP address unrelated to the
VR. (In my implementation, even the VR IP address owner uses
an unrelated IP address as it's primary IP address.)

> the RFC *IP Address Owner* and *Primary IP Address*. It is 
> clear how the *IP Address Owner* must be used with the VR MAC address on 
> many gateways running VRRP on a same link, but it is unclear for the 
> *Primary IP Address*.

The primary IP address uniquely identifies each router participating
in the VR. It is the IP address assigned to the router because it is
an IP node on that network; it was nothing to do with the fact that
the router is now assigned to support VRRP.

>    -> There are 3 *Primary IP addresses* at least, aren't there ?

Yes. Each router has its own, unique primary IP address on the
network VRRP is running on. (The VR IP address owner is allowed but
not required to use the VR IP address as its primary IP address.)

> the gateway is in the backup state ?

The primary IP address are assigned to the physical router. Its
reachability is unrelated to the VRRP protocol in any way. One would
expect the address to be reachable whenever that interface is up just
as one would expect any other node's IP addresses to be reachable when
the node is active. As it turns out, VRRP doesn't even require that much:
VRRP never sends a packet *to* the Primary IP address (unless I'm
forgetting something....), so for VRRP to work, the Primary IP address
need not be actually reachable, although I don't think the protocol spec
itself mentions this unimportant detail.

-don