Nortel Switched Firewall 2.3.3 User’s Guide and Command Reference
Redundant Firewalls
121
213455-L, October 2005
VRRP failover-based on links
Link failures decrement the internal priority value that VRRP maintains for both Switched
Firewalls. A link failure is defined as a loss of link at the VRRP interface.
At initialization, VRRP sets the priority value to 100 for both firewalls. When a physical link
fails, VRRP reduces the priority value for that firewall by two. If that causes the firewall’s
priority value to fall below the other firewall’s, failover occurs.
When the link is restored, the priority value for that firewall is increased by two. This may
cause both firewalls to have the same priority values. Nevertheless, the cluster status will not
change until a link failure occurs on the backup that causes VRRP to reduce its priority value
by two and triggers a failover.
MAC address mapping
MAC address mapping is different for active-standby (high-availability) and active-active
configurations.
Active-Standby (High Availability)
: The active master uses its vrid to set a unique virtual
router MAC address according to this formula: 0x00005E0001<vrid>. This is the address that
the active master returns in response to end-host ARP requests and Proxy ARP requests.
GARP messages also contain the active master’s virtual router MAC address. Meanwhile, the
backup retains its physical MAC address.
When the active master becomes the backup, it overwrites its virtual router MAC address with
its physical MAC address. At the same time, the newly active master overwrites its physical
MAC address with its unique virtual router MAC address.
Active-Active:
The virtual router responds to end-host ARP requests and Proxy ARP requests
with the physical MAC address of addr1 or addr2 (
cfg/net/if/addr1
or
cfg/net/if/addr2
), depending on which firewall is the active master. The virtual router
IP address never changes. GARP messages also contain the real MAC addresses of the active
master’s virtual router ports.
N
OTE
–
In practice, GARP messaging is usually the mechanism that informs switches and
routers of MAC address changes.
