What is VRRP in SONiC Networking? How Does It Work?

What Is VRRP ？

VRRP (Virtual Router Redundancy Protocol) is a standardized First Hop Redundancy Protocol (FHRP) that allows multiple Layer 3 devices to act as a single virtual default gateway, improving the availability of the default gateway in a LAN.

VRRP is defined by the IETF (Internet Engineering Task Force) and was standardized based on concepts similar to Cisco HSRP. The initial VRRP specification was published in RFC 2338, and the latest version is defined in RFC 9568.

The primary purpose of VRRP is to prevent the default gateway from becoming a single point of failure.

Without VRRP, a host typically uses a physical router as its default gateway. If this router fails, traffic from the local subnet to external networks will be interrupted. VRRP uses an election mechanism to determine the Active router and Backup routers. When the Active router fails, VRRP automatically triggers a failover, allowing a Backup router to take over the virtual gateway IP address. This ensures high network availability without requiring any reconfiguration on the host side.

Core Concepts of VRRP

Before diving into how VRRP works, let’s first understand some key concepts.

• VRRP Router: A router running the Virtual Router Redundancy Protocol. A VRRP router can be a member of one or more virtual router groups at the same time.
• Virtual Router: An abstract object managed by VRRP that acts as the default gateway for hosts on a shared LAN. It consists of a Virtual Router Identifier (VRID) and a set of associated IPv4 or IPv6 addresses.
• Virtual Router Identifier (VRID): An integer value ranging from 1 to 255, used to uniquely identify a virtual router instance on a LAN. All routers participating in the backup of the same set of IP addresses must be configured with the same VRID.
• Virtual Router MAC Address: A dedicated multicast Ethernet MAC address used by VRRP for communication.
  • IPv4 format: 00-00-5E-00-01-{VRID}
  • IPv6 format: 00-00-5E-00-02-{VRID}
  • This mapping ensures that hosts always use the same MAC address regardless of which router is currently acting as the Active Router.
• Active Router: The VRRP router currently responsible for forwarding traffic. It forwards packets destined for the virtual IP address and responds to ARP requests for IPv4 or Neighbor Discovery (ND) requests for IPv6. If the IP address owner is available, it will always become the Active Router.
• Backup Router: A set of available VRRP routers that are ready to take over forwarding responsibilities when the current Active Router fails.

How Does VRRP Work?

This section explains how VRRP works from four aspects: VRRP messages, state machine, workflow, and preemption mechanism.

1. VRRP Messages

VRRP defines only one message type: ADVERTISEMENT message.

The Active Router periodically sends Advertisement messages to all other VRRP routers on the LAN. These messages advertise the Active Router’s priority, Maximum Advertisement Interval, and the associated IPvX address list.

The main purposes of Advertisement messages are:

• Maintaining the Active Router’s availability status.
• Triggering failover when the Active Router becomes unavailable.
• Allowing the Active Router to voluntarily give up its role by sending an Advertisement message with a priority value of 0.

Key parameters include:

• Virtual Router ID (VRID): Identifies a virtual router instance on the LAN.
• Priority: Used for Active Router election. A higher value indicates a higher priority.
• Maximum Advertisement Interval: Specifies how frequently the Active Router sends Advertisement messages. The unit is centiseconds. The default value is 100 centiseconds (1 second).
• Associated IPvX Address List: Lists all IPv4 or IPv6 addresses managed by the virtual router. These addresses define which IP traffic is forwarded by the virtual gateway.

2. VRRP State Machine

A VRRP router implements a state machine for each virtual router instance. The state machine includes three states:

Initialize:

The router waits for startup events. If the priority is 255 (the IP Address Owner), it immediately transitions to the Active state. Otherwise, it transitions to the Backup state.

Backup:

The router monitors the availability of the Active Router. In this state, it does not respond to ARP/ND requests for the virtual IP address and discards packets destined for the virtual MAC address.

When the Backup Router stops receiving Advertisement messages from the Active Router, or receives an Advertisement message with a priority value of 0, it triggers a new election process. The router with the highest priority becomes the new Active Router.

Active:

The router takes responsibility for forwarding traffic. It responds to ARP/ND requests, forwards traffic destined for the virtual MAC address, and periodically sends Advertisement messages to maintain its Active role.

When the router voluntarily relinquishes the Active role or detects a failure condition, it leaves the Active state and transitions back to the Backup state or the Initialize state.

3. VRRP Workflow

The core workflow of VRRP follows a cycle of election, maintenance, and failover:

a. Election:

VRRP elects the Active Router based on priority values ranging from 0 to 255. The router with the highest priority becomes the Active Router, while the others become Backup Routers.

If multiple routers have the same priority, the router with the higher interface IP address becomes the Active Router.

b. Steady-State Maintenance

The Active Router periodically sends Advertisement messages based on the configured Advertisement_Interval.

Backup Routers monitor the Active Router using the Active_Down_Timer. This timer is calculated locally by the Backup Router based on the Advertisement_Interval value carried in the Advertisement message. If the timer expires without receiving an Advertisement message, the Backup Router considers the Active Router unavailable.

c. Failover

When the Active_Down_Timer expires, a Backup Router transitions to the Active state. It then sends Advertisement messages and triggers Gratuitous ARP (GARP) for IPv4 or Unsolicited Neighbor Advertisement (UNA) for IPv6.

These messages notify the LAN switches to update their MAC address tables and remap the virtual MAC address to the new router port, ensuring that subsequent traffic is forwarded to the new Active Router.

d. MAC Learning Optimization

To accelerate convergence, the new Active Router immediately sends Gratuitous ARP or Unsolicited Neighbor Advertisement messages after the state transition. During normal operation, periodic Advertisement messages help maintain the MAC forwarding information on network devices.

4. VRRP Preemption Mechanism

The goal of VRRP is not to allow the first available router to permanently become the Active Router. Instead, VRRP allows administrators to control whether a higher-performance router should take over the Active role, or whether the original high-priority router should reclaim the Active role after recovery.

This mechanism ensures that traffic can always be forwarded through the preferred path, such as a link with lower cost or higher performance.

In VRRP, Preempt_Mode is enabled by default (True). When a new router joins the VRRP group and has a higher priority, it can preempt the current Active Router with a lower priority and become the new Active Router.

The preemption process strictly follows priority comparison rules:

• Higher Priority Wins: A Backup Router can only attempt to preempt when its priority is higher than the priority advertised by the current Active Router.
• Avoiding Unnecessary Flapping: To reduce unnecessary service interruptions, a Backup Router with the same or lower priority will not trigger preemption as long as the current Active Router is operating normally.
• Backup Router Behavior: When a Backup Router receives an Advertisement message, it compares its own priority with the priority carried in the message. If its priority is higher and preemption is enabled, it ignores the received Advertisement message.
• Since it no longer accepts the current Active Router’s advertisements, its local Active_Down_Timer eventually expires, causing the router to transition to the Active state and take over forwarding responsibilities.

In environments that require high stability and do not want frequent network path changes, administrators can disable preemption by setting Preempt_Mode to False. This prevents traffic from repeatedly switching between routers due to events such as frequent restarts of a preferred router with lower link cost but unstable availability.

In summary, the preemption mechanism gives administrators control over the balance between performance optimization and network stability.

Where Can You Use VRRP?

1. Eliminating Single Point of Failure in Default Gateways

This is the most common application scenario for VRRP. In most LAN environments, end hosts such as PCs and servers are configured with a static default gateway or obtain gateway information through DHCP.

• Problem: If the default gateway router fails, all hosts using that gateway lose external network connectivity because they cannot automatically detect an alternative path.
• Solution: VRRP allows multiple routers to form a virtual router. Hosts only need to configure the virtual IP address as their default gateway. When the current Active Router fails, a Backup Router takes over forwarding responsibilities within a short period of time (typically around 3 seconds), ensuring uninterrupted host communication.

2. Multi-Gateway Load Sharing

VRRP can provide more than redundancy. By configuring multiple virtual router instances, administrators can improve hardware resource utilization.

Example scenario: Assume a LAN has two physical routers: Router-1 and Router-2.

• Group 1 (VRID=1): Router-1 acts as the Active Router, and Router-2 acts as the Backup Router.
• Group 2 (VRID=2): Router-2 acts as the Active Router, and Router-1 acts as the Backup Router.

Result: Administrators can configure half of the hosts in the LAN to use the virtual gateway of VRID 1 and the other half to use VRID 2.

Under normal conditions, both routers actively forward traffic. If either router fails, the other router takes over all forwarding responsibilities, combining redundancy with load sharing.

3. Faster IPv6 Network Convergence

In IPv6 networks, VRRP provides faster failure detection and gateway failover compared with standard mechanisms.

• Comparison: The standard IPv6 Neighbor Discovery (ND) process may take more than 10 seconds to detect router failures.
• Advantage: With VRRP, Backup Routers can complete the failover process within approximately 3 seconds using default parameters. This process does not require interaction with hosts, improving user experience and reducing the risk of transport protocol timeouts.

4. Preferred Path Selection

In environments with multiple uplinks, VRRP allows administrators to define preferred forwarding paths based on factors such as link cost, bandwidth, or device performance.

• Implementation: By configuring different priority values, administrators can control which router handles traffic under normal conditions. Traffic can be directed through the router with better performance or lower-cost connectivity.
• Flexible Failback: When the preferred router recovers, the preemption mechanism allows traffic to automatically switch back to the preferred path.

5. Supporting Multiple Logical Subnets

VRRP supports multiple logical IPvX subnets on the same LAN segment. This is useful in enterprise networks or data center environments where multiple business networks share the same physical infrastructure, while each subnet requires an independent redundant gateway.

VRRP is suitable for any LAN environment that requires transparent gateway failover. Whether addressing the reliability limitations of static IPv4 gateway configurations, improving IPv6 convergence speed, or enabling load sharing in dual-router deployments, VRRP provides a low-overhead and efficient industry-standard solution.

VRRP vs. GLBP vs. HSRP

As an open standard protocol, VRRP is often compared with HSRP and GLBP.

Both HSRP and GLBP are Cisco proprietary protocols and belong to the Cisco First Hop Redundancy Protocol (FHRP) family. HSRP was introduced earlier than VRRP and was primarily designed to solve the default gateway single point of failure issue.

In a traditional LAN environment, end hosts usually configure only one default gateway. If this gateway fails, the entire subnet may lose external connectivity. HSRP solves this problem by creating a virtual router that allows multiple physical routers to share a single gateway identity. When the Active router fails, a Standby router takes over the forwarding responsibility.

However, HSRP has a limitation: although it provides gateway redundancy, only one router actively forwards traffic at a time. Other routers remain mostly idle, resulting in inefficient utilization of available bandwidth and hardware resources.

GLBP was introduced to address this limitation. While maintaining gateway redundancy, GLBP adds gateway load balancing, allowing multiple routers to actively participate in traffic forwarding instead of having only one Active router handle all traffic.

The following table compares VRRP, HSRP, and GLBP from the perspectives of protocol ownership, messages, states, and application scenarios.

Item	HSRP	VRRP	GLBP
Protocol Ownership	Cisco proprietary protocol.	IETF open standard protocol. The latest specification is defined in RFC 9568.	Cisco proprietary protocol.
Main Messages	Hello messages, typically using UDP port 1985. Multicast addresses vary by version.	Advertisement messages, using IP protocol number 112. The commonly used IPv4 multicast address is 224.0.0.18.	Hello-based control messages, typically using UDP port 3222. The multicast address is 224.0.0.102.
States / Roles	Active / Standby / Listen, etc. Typically, only one Active router forwards traffic.	Initialize / Backup / Active. The Active Router is elected based on priority.	AVG / AVF roles. The AVG is responsible for load distribution, while multiple AVFs participate in traffic forwarding.
Common Use Cases	Default gateway redundancy in Cisco networks to eliminate gateway single points of failure.	Default gateway redundancy in multi-vendor environments, focusing on standardization and interoperability.	Cisco environments that require both gateway redundancy and load balancing.

All three protocols aim to improve default gateway availability, but they differ significantly in protocol ownership, message mechanisms, state models, and applicable scenarios.

How to Configure VRRP on SONiC Platform ?

Implementing VRRP on enterprise open networking platforms such as SONiC / AsterNOS follows a general workflow to provide gateway high availability and fast failover:

1. Enable VRRP globally.
2. Configure the VRID.
3. Configure the virtual IP address.
4. Configure parameters such as priority and advertisement interval.
5. Verify the configuration and status using show vrrp / show vrrp6.

For detailed step-by-step configuration examples for the following scenarios, refer to the VRRP Configuration Guide:

• VRRP and MSTP Integrated Configuration Scenario
• MC-LAG Device Configuration with VRRP Scenario
• MC-LAG Interconnection with Enabled VRRP/VRRP6 Firewall Scenario

Summary

Implementing VRRP on the SONiC platform is a fundamental and critical feature for dual-WAN routers. Through virtual routers, priority-based election, Advertisement messages, and the preemption mechanism, VRRP enables high-availability default gateway failover and prevents service interruptions caused by single points of failure.

VRRP is not only applicable to traditional LAN gateway redundancy, but also supports scenarios such as multi-gateway load sharing and fast IPv6 convergence. In addition, with VRRP Sync Group support, multiple related VRRP instances can be bound into a single logical group. This allows WAN-side and LAN-side VRRP instances, or multiple service-related virtual IPs, to converge together during failover, further improving availability and consistency.