HPE H3C S9500 Series User manual

Operation Manual – Reliability
H3C S9500 Series Routing Switches Table of Contents
i
Table of Contents
Chapter 1 VRRP Configuration....................................................................................................1-1
1.1 Introduction to VRRP.........................................................................................................1-1
1.2 Configuring VRRP .............................................................................................................1-2
1.2.1 Enabling/Disabling the Function to Ping the Virtual IP Address.............................1-3
1.2.2 Enabling/Disabling the Check of TTL Value of VRRP Packet................................1-3
1.2.3 Setting Correspondence between Virtual IP Address and MAC Address ..............1-3
1.2.4 Adding/Deleting a Virtual IP Address......................................................................1-4
1.2.5 Configuring the Priority of Switches in the Virtual Router.......................................1-5
1.2.6 Configuring Preemption and Delay for a Switch within a Virtual Router.................1-5
1.2.7 Configuring Authentication Type and Authentication Key.......................................1-6
1.2.8 Configuring Virtual Router Timer.............................................................................1-7
1.2.9 Configuring Switch to Track a Specified Interface..................................................1-8
1.3 Displaying and debugging VRRP ......................................................................................1-9
1.4 VRRP Configuration Example ...........................................................................................1-9
1.4.1 VRRP Single Virtual Router Example.....................................................................1-9
1.4.2 VRRP Tracking Interface Example ....................................................................... 1-11
1.4.3 Multiple Virtual Routers Example..........................................................................1-12
1.5 Troubleshooting VRRP....................................................................................................1-13
Chapter 2 HA Configuration.........................................................................................................2-1
2.1 Introduction to HA..............................................................................................................2-1
2.2 Configuring HA...................................................................................................................2-2
2.2.1 Restarting the Slave System Manually ...................................................................2-2
2.2.2 Starting the Master-Slave Switchover Manually .....................................................2-2
2.2.3 Enabling/Disabling Automatic Synchronization.......................................................2-2
2.2.4 Synchronizing the Configuration File Manually.......................................................2-3
2.2.5 Configuring the Load Mode of the Master and Slave boards .................................2-3
2.3 Displaying and Debugging HA Configuration....................................................................2-4
2.4 HA Configuration Example ................................................................................................2-4

Operation Manual – Reliability
H3C S9500 Series Routing Switches Chapter 1 VRRP Configuration
1-1
Chapter 1 VRRP Configuration
1.1 Introduction to VRRP
Virtual Router Redundancy Protocol (VRRP) is a fault-tolerant protocol. In general, a
default route (for example, 10.100.10.1 as shown in the following internetworking
diagram) will be configured for every host on a network, so that the packets destined to
some other network segment from the host will go through the default route to the Layer
3 Switch, implementing communication between the host and the external network. If
Switch is down, all the hosts on this segment taking Switch as the next-hop on the
default route will be disconnected from the external network.
Ethernet
Switch
Host 1 Host 2 Host 3
10.100.10.7 10.100.10.8 10.100.10.9
10.100.10.1
Network
Figure 1-1 Network diagram for LAN
VRRP, designed for LANs with multicast and broadcast capabilities (such as Ethernet)
settles the above problem. The diagram below is taken as an example to explain the
implementation principal of VRRP. VRRP combines a group of LAN switches (including
a Master and several Backups) into a virtual router.

Operation Manual – Reliability
H3C S9500 Series Routing Switches Chapter 1 VRRP Configuration
1-2
Ethernet
Master
Host 1 Host 2 Host 3
10.100.10.7 10.100.10.8 10.100.10.9
Virtual IP address10.100.10.1
Network
Backup
Virtual IP address10.100.10.1
Actual IP address10.100.10.2 Actual IP address10.100.10.3
Figure 1-2 Network diagram for virtual router
This virtual router has its own IP address: 10.100.10.1 (which can be the interface
address of a switch within the virtual router). The switches within the virtual router have
their own IP addresses (such as 10.100.10.2 for the Master switch and 10.100.10.3 for
the Backup switch). The host on the LAN only knows the IPaddress of this virtual router
10.100.10.1 (usually calledas virtual IP address of virtual router), but not the specific IP
addresses 10.100.10.2 of the Master switch and 10.100.10.3 of the Backup switch.
They configure their own default routes as the IP address of this virtual router:
10.100.10.1. Therefore, hosts within the network will communicate with the external
network through this virtual router. If a Master switch in the virtual group breaks down,
another Backup switch will function as the new Master switch to continue serving the
host with routing to avoid interrupting the communication between the host and the
external networks.
1.2 Configuring VRRP
The following sections describe the VRRP configuration tasks:
zEnabling/Disabling the Function to Ping the Virtual IP Address
zEnabling/Disabling the Check of TTL Value of VRRP Packet
zSetting Correspondence between Virtual IP Address and MAC Address
zAdding/Deleting a Virtual IP Address
zConfiguring the Priority of Switches in the Virtual Router
zConfiguring Preemption and Delay for a Switch within a Virtual Router
zConfiguring Authentication Type and Authentication Key
zConfiguring Virtual Router Timer
zConfiguring Switch to Track a Specified Interface

Operation Manual – Reliability
H3C S9500 Series Routing Switches Chapter 1 VRRP Configuration
1-3
1.2.1 Enabling/Disabling the Function to Ping the Virtual IP Address
This operation enables or disables the function to ping the virtual IP address of the
virtual router. The standard protocol of VRRP does not support the ping function, then
the user cannot judge with ping command whether an IP address is used by the virtual
router. If the user configure the IPaddress for the host same as the virtual IP address of
the virtual router, then all messages in this segment will be forwarded to the host.
So H3C S9500 Series Routing Switches (hereinafter referred to as S9500 series)
provide the ping function to ping the virtual IP address of the virtual router.
Perform the following configuration in system view.
Table 1-1 Enable/disable the ping function
Operation Command
Enable to ping the virtual IP address vrrp ping-enable
Disable to ping the virtual IP address undo vrrp ping-enable
By default, the function to ping the virtual IP address is disabled.
You should set the ping function before configuring the virtual router. If a virtual router is
already established on the switch, it is not allowed to use the vrrp ping-enable
command and the undo vrrp ping-enable command to modify the configuration any
more.
1.2.2 Enabling/Disabling the Check of TTL Value of VRRP Packet
This operation configures whether to check TTL value of VRRP packet on the Backup
switch. The TTL value must be 225. If the Backup switch find TTL is not 225 when
receiving VRRP packet, the packet will be discarded.
Perform the following configuration in VLAN interface view.
Table 1-2 Enable/disable the check of TTL value of VRRP packet
Operation Command
Disable the check of TTL value of VRRP packet vrrp un-check ttl
Enable the check of TTL value of VRRP packet undo vrrp un-check ttl
By default, the switch checks TTL value of VRRP packets.
1.2.3 Setting Correspondence between Virtual IP Address and MAC Address
This operation sets correspondence between the virtual lP address and the MAC
address. In the standard protocol of VRRP, the virtual IP address of the virtual router

Operation Manual – Reliability
H3C S9500 Series Routing Switches Chapter 1 VRRP Configuration
1-4
corresponds to the virtual MAC address, to ensure correct data forwarding in the
sub-net.
Due to the chips installed, some switches support matching one IP address to multiple
MAC addresses.
S9500 series not only guarantee correct data forwarding in the sub-net, but also
support such function: the user can choose to match the virtual IP address with the real
MAC address or virtual MAC address of the routing interface.
The following commands can be used to set correspondence between the IP address
and the MAC address.
Perform the following configuration in system view.
Table 1-3 Set correspondence between virtual IP address and MAC address
Operation Command
Set correspondence between the virtual IP
address and the MAC address vrrp method { real-mac | virtual-mac }
Set the correspondence to the default value undo vrrp method
By default, the virtual IP address of the virtual router corresponds to the virtual MAC
address.
You should set correspondence between the virtual IP address of the virtual router and
the MAC address before configuring the virtual router. Otherwise, you cannot configure
the correspondence.
If you set correspondence between the IP address of the virtual router and the real
MAC address, you can configure only one virtual router on VLAN interface.
1.2.4 Adding/Deleting a Virtual IP Address
The following command is used for assigning a virtual IP address of the local segment
to a virtual router or removing an assigned virtual IPaddress of a virtual router from the
virtual address list.
Perform the following configuration in VLAN interface view.
Table 1-4 Add/delete a virtual IP address
Operation Command
Add a virtual IP address vrrp vrid virtual-router-ID virtual-ip virtual-address
Delete a virtual IP address undo vrrp vrid virtual-router-ID [ virtual-ip
virtual-address ]
The virtual-router-ID covers the range from 1 to 255.

Operation Manual – Reliability
H3C S9500 Series Routing Switches Chapter 1 VRRP Configuration
1-5
The virtual-address can be an unused address in the network segment where the
virtual router resides, or the IP address of an interface in the virtual router. If the IP
address is of the switch in the virtual router, it can also be configured as virtual-address.
In this case, the switch will be called an IP Address Owner. When adding the first IP
address to a virtual router, the system will create a new virtualrouter accordingly. When
adding a new address to this virtual router thereafter, the system will directly add it into
the virtual IP address list.
After the last virtual IP address is removed from the virtual router, the whole virtual
router will also be removed. That is, there is no more virtual router on the interface any
more and any configuration of it is invalid accordingly.
1.2.5 Configuring the Priority of Switches in the Virtual Router
The status of each switch in the virtual router will be determined by its priority in VRRP.
The switch with the highest priority will become the Master.
Perform the following configuration in VLAN interface view.
Table 1-5 Configure the priority of switches in the virtual router.
Operation Command
Configure the priority of switches in the
virtual router.
vrrp vrid virtual-router-ID priority
priority
Clear the priority of switches in the
virtual router. undo vrrp vrid virtual-router-ID priority
The priority ranges from 0 to 255. The greater the number, the higher the priority.
However the value can only be taken from 1 to 254. The priority 0 is reserved for special
use and 255 is reserved for the IP address owner by the system.
By default, the priority is 100.
Note:
The priority for IP address owner is always 255, which cannot be configured otherwise.
1.2.6 Configuring Preemption and Delay for a Switch within a Virtual Router
Once a switch in the virtual router becomes the Master switch, so long as it still
functions properly, other switches, even configured with a higher priority later, cannot
become the Master switch unless they are configured to work in preemption mode. The
switch in preemption mode will become the Master switch, when it finds its own priority

Operation Manual – Reliability
H3C S9500 Series Routing Switches Chapter 1 VRRP Configuration
1-6
is higher than that of the current Master switch. Accordingly, the former Master switch
will become the Backup switch.
Together with preemption settings, a delay can also be set. In this way, a Backup will
wait for a period of time before becoming a Master. In an unstable network if the Backup
switch has not received the packets from the Master switch punctually, it will become
the Master switch. However, the failure of Backup to receive the packets may be due to
network congestion, instead of the malfunction of the Master switch. In this case, the
Backup will receive the packet after a while. The delay settings can thereby avoid the
frequent status changing.
Perform the following configuration in VLAN interface view.
Table 1-6 Configure preemption and delay for a switch within a virtual router
Operation Command
Enable the preemption mode and
configure a period of delay.
vrrp vrid virtual-router-ID preempt-mode
[ timer delay delay-value ]
Disable the preemption mode. undo vrrp vrid virtual-router-ID
preempt-mode
The delay ranges from 0 to 255, measured in seconds. By default, the preemption
mode is preemption with a delay of 0 second.
Note:
If preemption mode is cancelled, the delay time will automatically become 0 second.
1.2.7 Configuring Authentication Type and Authentication Key
VRRP provides following authentication types:
zsimple: Simple character authentication
zmd5: MD5 authentication
In a network under possible security threat, the authentication type can be set to
simple. Then the switch will add the authentication key into the VRRP packets before
transmitting it. The receiver will compare the authentication key of the packet with the
locally configured one. If they are the same, the packet will be taken as a true and legal
one. Otherwise it will be regarded as an illegal packet to be discarded. In this case, an
authentication key not exceeding 8 characters should be configured.
In a totally unsafe network, the authentication type can be set to md5. The switch will
use the authentication type and MD5 algorithm provided by the Authentication Header

Operation Manual – Reliability
H3C S9500 Series Routing Switches Chapter 1 VRRP Configuration
1-7
to authenticate the VRRP packets. In this case an authentication key not exceeding 8
characters should be configured.
Those packets failing to pass the authentication will be discarded and a trap packet will
be sent to the network management system.
Perform the following configuration in VLAN interface view.
Table 1-7 Configure authentication type and authentication key
Operation Command
Configure authentication type and
authentication key
vrrp authentication-mode
authentication-type authentication-key
Remove authentication type and
authentication key undo vrrp authentication-mode
The authentication key is case sensitive.
Note:
The same authentication type and authentication keyshould be configured for all VLAN
interfaces that belong to the virtual router.
1.2.8 Configuring Virtual Router Timer
The Master switch advertises its normal operation state to the switches within the
VRRP virtual router by sending them VRRP packets regularly (at adver-interval). And
the backup switch only receives VRRP packets. If the Backup has not received any
VRRPpacket from the Master after a period of time (specified by master-down-interval),
it will consider the Master as down, and then take its place and become the Master.
You can use the following command to set a timer and adjust the interval, adver-interval,
between Master transmits VRRP packets. The master-down-interval of the Backup
switch is three times that of the adver-interval. The excessive network traffic or the
differences between different switch timers will result in master-down-interval timing out
and state changing abnormally. Such problems can be solved through prolonging the
adver-interval and setting delay time. adver-interval is measured in seconds.
Perform the following configuration in VLAN interface view.

Operation Manual – Reliability
H3C S9500 Series Routing Switches Chapter 1 VRRP Configuration
1-8
Table 1-8 Configure virtual router timer
Operation Command
Configure virtual router timer vrrp vrid virtual-router-ID timer advertise
adver-interval
Clear virtual router timer undo vrrp vrid virtual-router-ID timer advertise
By default, adver-interval is configured to be 1.
1.2.9 Configuring Switch to Track a Specified Interface
VRRP interface track function has expanded the backup function. Backup is provided
not only to the interface where the virtual router resides, but also to some other
malfunctioning switch interface. By implementing the following command you can track
some interface.
If the interface which is tracked is Down,the priority of the switch including the interface
will reduce automatically by the value specified by value-reduced, thus resulting in
comparatively higher priorities of other switches within the virtual router, one of which
will turn to Master switch so as to track this interface.
Perform the following configuration in VLAN interface view.
Table 1-9 Configure switch to track a specified interface
Operation Command
Configure the switch to
track a specified interface vrrp vrid virtual-router-ID track vlan-interface interface-number [ reduced value-reduced ]
Stop tracking the specified
interface
undo vrrp vrid virtual-router-ID track [ vlan-interface
interface-number ]
By default, value-reduced is taken 10.
Note:
zWhen the switch is an IP address owner, its interfaces cannot be tracked.
zIf the interface tracked is up again, the corresponding priority of the switch, including
the interface, will be restored automatically
zYou can only track up to eight interfaces in one virtual router.

Operation Manual – Reliability
H3C S9500 Series Routing Switches Chapter 1 VRRP Configuration
1-9
1.3 Displaying and debugging VRRP
After the above configuration, execute display command in any view to display the
running of the VRRPconfiguration, and to verify the configuration. Execute debugging
command in user view to debug VRRP configuration.
Table 1-10 Display and debug VRRP
Operation Command
Display VRRP state information display vrrp [ interface vlan-interface
interface-number [ virtual-router-ID ] ]
Display VRRP statistics
information display vrrp statistics [vlan-interface interface-number [ virtual-router-ID ]
Display VRRP summary
information display vrrp summary
Clear the statistics information
about VRRP reset vrrp statistics [vlan-interface interface-number [ virtual-router-ID ] ]
Enable VRRP debugging. debugging vrrp { state |packet |error }
Disable VRRP debugging. undo debugging vrrp { state |packet |error }
You can enable VRRP debugging to check its running. You may choose to enable
VRRP packet debugging (option as packet), VRRP state debugging (option as state),
and/or VRRP error debugging (option as error). By default, VRRP debugging is
disabled.
1.4 VRRP Configuration Example
1.4.1 VRRP Single Virtual Router Example
I. Networking requirements
Host A uses the VRRP virtual router which combines switch A and switch B as its
default gateway to access host B on the Internet.
VRRP virtual router information includes: virtual router ID1, virtual IP address
202.38.160.111, switch A as the Master and switch B as the Backup allowed
preemption.