CPUG

The Check Point User Group

A Resource For The Check Point Community.  Fast.  Useful.  Independent.

1. CCSA/CCSE One-Week Dual-Certification Training Course with CPUG in San Francisco!
    Courses Starting 12/8, (2009) 1/19, 2/9, 3/9, 4/6, 5/4, 6/8, 7/6, 8/3.
2. Join Us On LinkedIn - We now have a CPUG group.


Go Back   CPUG: The Check Point User Group > Check Point Firewall-1/VPN-1 And Related Products > Miscellaneous
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 2005-11-25
Junior Member
 
Join Date: 2005-11-25
Posts: 17
Rep Power: 0
alienbaby has an average reputation (10+)
Default VRRP Simplified v. VRRP Legacy

I would like to start a discussion on the merits of VRRP Simplified versus VRRP Legacy.

My opinion is that VRRP Simplified is poorly thought out and should never ben used.

My reasoning is as follows.

In 'normal' VRRP Monitored Circuit, a different Virtual Router ID(VRID) is chosen for each VRRP interface.
The different VRIDs then result in each VRRP interface having a unique VRRP MAC Address.

My understanding of VRRP Simplified mode is that the Same VRID is used on each of the VRRP Interfaces. This results in the same VRRP MAC Address being used on each of the VRRP Interfaces.

When using the same ethernet switch and just VLANing for each of the various VRRP segments, I see potential problems. You now have the same MAC address on multiple ports in the Siwtch address table. Some switches can not handle this. Also, in the event of switch failure, and a organization has to use the same switch for multiple segments, you now have the same broadcast domain with the Same MAC address on the multiple ports. This can cause the failure of the switch or the switch to shut down the VRRP ports.

I see so many problems with Simplified VRRP just on Layer 2 that I cannot see it being useful.

Perhaps someone can counter me?
Reply With Quote
  #2 (permalink)  
Old 2005-11-26
Senior Member
 
Join Date: 2005-08-22
Location: Ottawa, Canada
Posts: 347
Rep Power: 4
Lackie has an average reputation (10+)
Default Re: VRRP Simplified v. VRRP Legacy

You are correct with the way simplified VRRP is set up as well as how it uses the same MAC address for each VRID. This has been known to cause problems in the exact manner that you described. At that point we recommend that you use legacy mode VRRP or you can use simplified VRRP and specify the VMAC mode as Static and you can then put your own MAC address in for it to use it instead. If you are using a different switch/router/hub on each interface you will not have a problem using simplifed mode VRRP.

I personally find simplified mode VRRP quicker and easier to set up than legacy and thus use it exclusively.
Reply With Quote
  #3 (permalink)  
Old 2005-11-29
Junior Member
 
Join Date: 2005-11-29
Posts: 19
Rep Power: 0
nooon has an average reputation (10+)
Default Re: VRRP Simplified v. VRRP Legacy

Not sure I understand you all.

The first thing I see in the Simplified VRRP page is :
"Create a new Monitored-Circuit Virtual Router"

Just a matter of creating any monitored circuit needed (i.e. one per interface)
then filling each of them with only one VRRP address, isn't it ? We then avoid the problem you describe.

Personnally I love the new simplified mode. Creating a new VRID on the legacy page when you had already 10 interfaces in use with VRRP was a pain in the ass operation.

But I agree that sharing the same VRID across multiple interface is definetely a bad thing ! Additionnally to the problems mentionned by Alienbaby, we can add it is bandwith consuming on the switch backplane (at least !).
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT -7. The time now is 21:23.


Powered by vBulletin® Version 3.7.4
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.2.0