CISCO SD-WAN Vrrp Interface Tracking Installation Guide

: June 15, 2024
: Cisco

CISCO SD-WAN Vrrp Interface Tracking

CISCO-SD-WAN-Vrrp-Interface-Tracking-PRO

Product Information

Description: VRRP Interface Tracking is a feature that enables VRRP to set the edge as active or standby based on the WAN Interface or SIG tracker events and increase the TLOC preference value on a new VRRP active to ensure traffic symmetry. This feature is available for Cisco vEdge Devices.

Release Information:

Feature Name	Release Information

VRRP Interface Tracking for Cisco SD-WAN Release vEdge
Devices| 20.4.1
VRRP Interface Tracking for Cisco SD-WAN Release vEdge
Devices| 20.7.1

Product Usage Instructions

Section 1: Introduction
The Virtual Router Redundancy Protocol (VRRP) is a LAN-side protocol that provides redundant gateway service for switches and other IP end stations. In Cisco SD-WAN, you can configure VRRP on interfaces and subinterfaces within a VPN.
Section 2: Restrictions and Limitations
- For more information, refer to the “Configuring VRRP” documentation.
- Starting from Cisco SD-WAN release 20.7.1, you can configure VRRP tracking using Cisco vManage feature template.
- In Cisco SD-WAN release 20.6.1 and earlier releases, to update any existing VRRP configuration and add VRRP tracking, convert the configuration and the VRRP tracking commands to the CLI template.
Section 3: VRRP Tracking Use Cases
The VRRP state is determined based on the tunnel link status. Ifthe tunnel or interface is down on the primary VRRP, then the traffic is directed to the secondary VRRP. The secondary VRRP router in the LAN segment becomes the primary VRRP to providegateway for the service-side traffic.
Section 4: Workflow to Configure VRRP Tracking
Note: We recommend using the same TLOC preference value for all TLOCs in a site.
- Configure an object tracker. For detailed instructions, refer to the “Configure an Object Tracker” section below.
- Configure VRRP for a VPN Interface template and associate the object tracker with the template. For detailed instructions, refer to the “Configure VRRP for a VPN Interface Template and Associate Interface Object Tracker” section below.
- Configure an Object Tracker
  To configure an object tracker, follow these steps:
- From the Cisco vManage menu, choose Configuration > Templates.
- Click Feature.
- Navigate to the System template for the device.
- Configure VRRP for a VPN Interface Template and Associate Interface Object Tracker
  To configure VRRP for a VPN Interface template and associate the object tracker, follow these steps:
- Step 1
- Step 2
- Step 3

Specifications

Feature Name : VRRP Interface Tracking
Supported Devices: Cisco vEdge Devices
Release Information:
- 20.4.1 – VRRP Interface Tracking for Cisco SD-WAN Release vEdge Devices
- 20.7.1 – VRRP Interface Tracking for Cisco SD-WAN Release vEdge Devices

FAQ

What is VRRP Interface Tracking?
VRRP Interface Tracking is a feature that enables VRRP to setthe edge as active or standby based on the WAN Interface or SIG tracker events and increase the TLOC preference value on a new VRRP active to ensure traffic symmetry.
Which devices support VRRP Interface Tracking?
VRRP Interface Tracking is supported on Cisco vEdge Devices.
How can I configure VRRP Interface Tracking?
To configure VRRP Interface Tracking, follow the workflow mentioned in Section 4 of the user manual.

Feature History

CISCO-SD-WAN-Vrrp-Interface-Tracking-FIG-1

Information About VRRP Interface Tracking, on page 1
Restrictions and Limitations, on page 2
VRRP Tracking Use Cases, on page 2
Workflow to Configure VRRP Tracking, on page 3
Configure an Object Tracker, on page 3
Configure VRRP for a VPN Interface Template and Associate Interface Object Tracker, on page 4
Configure VRRP Tracking Using CLI Templates, on page 5
Configuration Example for VRRP Object Tracking Using CLI, on page 6
Configuration Examples for SIG Object Tracking, on page 7
Verify VRRP Tracking, on page 7

Information About VRRP Interface Tracking

The Virtual Router Redundancy Protocol (VRRP) is a LAN-side protocol that provides redundant gateway service for switches and other IP end stations. In Cisco SD-WAN, you can configure VRRP on interfaces and subinterfaces, within a VPN.
For more information, see Configuring VRRP.
The VRRP Tracking feature enables switching to a backup or a secondary VRRP router in the following scenarios:
- If a single tunnel (or two tunnels – when you configure redundancy using Transport Locators (TLOC)) on a vEdge device goes down. In this case, the VRRP priority decrements and the secondary router becomes the primary router. VRRP notifies this change to the overlay through Overlay Management Protocol (OMP).
- VRRP can track up to one interface object or Secure Internet Gateway (SIG) object for a group. The interface object can have up to four interfaces. Hence, a group can track up to four tunnel interfaces. The VRRP priority decrements only if all the interfaces of an interface object go down.

Restrictions and Limitations

VRRP is only supported with service-side VPNs. If you are using subinterfaces, configure VRRP physical interfaces in VPN 0.
VRRP tracking is enabled on either a physical uplink interface or a logical tunnel interface (IPSEC or GRE or both).
The VRRP Tracking feature does not support IP prefix as an object.
You can track a maximum of four interfaces simultaneously using a single tracker. VRRP state transition gets triggered only if all four interfaces go down.
You can use the same tracker under multiple VRRP groups or VPNs.
You cannot configure tloc-change and increase-preference on more than one VRRP group.
In Cisco SD-WAN release 20.6.1 and earlier releases, you can configure VRRP tracking only through Cisco vManage CLI template.
Note
- Starting from Cisco SD-WAN release 20.7.1, you can configure VRRP tracking using Cisco vManage feature template as well.
- In Cisco SD-WAN release 20.6.1 and earlier releases, to update any existing VRRP configuration and add VRRP tracking, convert the configuration and the VRRP tracking commands to the CLI template.

VRRP Tracking Use Cases

The VRRP state is determined based on the tunnel link status. If the tunnel or interface is down on the primary VRRP, then the traffic is directed to the secondary VRRP. The secondary VRRP router in the LAN segment becomes primary VRRP to provide gateway for the service-side traffic.

Zscaler Tunnel Use Case 1—Primary VRRP, Single Internet Provider
The primary and secondary Zscaler tunnels are connected through a single internet provider to the primary VRRP. The primary and secondary VRRP routers are connected through using TLOC extension. In this scenario, the VRRP state transition occurs if the primary and secondary tunnels go down on primary VRRP. The predetermined priority value decrements when the tracking object is down, which triggers the VRRP state transition. To avoid asymmetric routing, VRRP notifies this change to the Overlay through OMP.

Zscaler Tunnel Use Case 2—VRRP Routers in TLOC Extension, Dual Internet Providers
The primary and secondary VRRP routers are configured in TLOC extension high availability mode. The primary and secondary Zscaler tunnels are directly connected with primary and secondary VRRP routers, respectively, using dual internet providers. In this scenario too, the VRRP state transition occurs if the primary and secondary tunnels go down on primary VRRP. The predetermined priority value decrements when the tracking object is down, which triggers the VRRP state transition. VRRP notifies this change to the Overlay through OMP.

TLOC Preference
Transport Locators (TLOCs) connect an OMP route to a physical location. A TLOC is directly reachable using an entry in the routing table of the physical network, or represented by a prefix beyond a NAT device.
The TLOC change preference is an optional configuration under VRRP group. If you configure TLOC change preference value using the tloc-change-pref command, the value increases by 1 when a node becomes the primary node. The configured or default TLOC preference is applied back on standby state.
Note
We recommend that you use the same TLOC preference value for all TLOCs in a site. For a Cisco vEdge device, the default TLOC preference for the tunnel interface can be modified irrespective of whether VRRP is configured or not. However, if you want to use the VRRP tracking feature and utilize the advantage of TLOC preference values for VRRP tracking, ensure that the default tunnel preference is same on both the VRRP routers.

Workflow to Configure VRRP Tracking

Configure an object tracker. For more information, see Configure an Object Tracker, on page 3.
Configure VRRP for a VPN Interface template and associate the object tracker with the template. For more information, see Configure VRRP for a VPN Interface Template and Associate Interface Object Tracker, on page 4.

Configure an Object Tracker

Use the System template to configure an object tracker.

From the Cisco vManage menu, choose Configuration > Templates.
Click Feature.
Navigate to the System template for the device.
Note To create a System template, see Create System Template
Click Tracker, and click New Object Tracker to configure the tracker parameters.
Click Add.
Click Save.

Configure VRRP for a VPN Interface Template and Associate Interface

Object Tracker

To configure VRRP for a VPN template, do the following:

From the Cisco vManage menu, choose Configuration > Templates.
Click Feature Templates.
Note In Cisco vManage Release 20.7.x and earlier releases, Feature Templates is titled Feature.
Navigate to the VPN Interface Ethernet template for the device.
Note For information about creating a new VPN Interface Ethernet template, see Configure VPN Ethernet Interface.
Click VRRP and choose IPv4.
Click New VRRP to create a new VRRP or edit the existing VRRP and configure the following parameters:
Click the Add Tracking Object link, and in the Tracking Object dialog box that is displayed, click Add Tracking Object.
In the Tracker Name field, enter the name of the tracker.
From the Action drop-down list, choose Decrement and enter the Decrement Value.
Click Add.
Click Add to save the VRRP details.
Click Save.

Configure VRRP Tracking Using CLI Templates

You can configure VRRP tracking using the CLI add-on feature templates and CLI device templates. For more information, see CLI Templates.

VRRP Object Tracking Using CLI

Configure Track List Interface
Use the following configuration to add an interface to a track list using Cisco vManage device CLI tempale:

CISCO-SD-WAN-Vrrp-Interface-Tracking-FIG-4

Configure Interface Tracking and Priority Decrement

CISCO-SD-WAN-Vrrp-Interface-Tracking-FIG-5

SIG Container Tracking

The following example shows how to configure a track list and tracking for SIG containers using the Cisco vManage device CLI template.
Note In SIG Object Tracking, you can only set global as the variable for Service Name.