| CPUG | |
| The Check Point User Group | |
| A Resource For The Check Point Community. Fast. Useful. Independent. | |
|
| |||||||
![]() |
| | LinkBack | Thread Tools | Display Modes |
| |||
| I would like to start a discussion on the merits of VRRP Simplified versus VRRP Legacy. My opinion is that VRRP Simplified is poorly thought out and should never ben used. My reasoning is as follows. In 'normal' VRRP Monitored Circuit, a different Virtual Router ID(VRID) is chosen for each VRRP interface. The different VRIDs then result in each VRRP interface having a unique VRRP MAC Address. My understanding of VRRP Simplified mode is that the Same VRID is used on each of the VRRP Interfaces. This results in the same VRRP MAC Address being used on each of the VRRP Interfaces. When using the same ethernet switch and just VLANing for each of the various VRRP segments, I see potential problems. You now have the same MAC address on multiple ports in the Siwtch address table. Some switches can not handle this. Also, in the event of switch failure, and a organization has to use the same switch for multiple segments, you now have the same broadcast domain with the Same MAC address on the multiple ports. This can cause the failure of the switch or the switch to shut down the VRRP ports. I see so many problems with Simplified VRRP just on Layer 2 that I cannot see it being useful. Perhaps someone can counter me? |
| |||
| You are correct with the way simplified VRRP is set up as well as how it uses the same MAC address for each VRID. This has been known to cause problems in the exact manner that you described. At that point we recommend that you use legacy mode VRRP or you can use simplified VRRP and specify the VMAC mode as Static and you can then put your own MAC address in for it to use it instead. If you are using a different switch/router/hub on each interface you will not have a problem using simplifed mode VRRP. I personally find simplified mode VRRP quicker and easier to set up than legacy and thus use it exclusively. |
| |||
| Not sure I understand you all. The first thing I see in the Simplified VRRP page is : "Create a new Monitored-Circuit Virtual Router" Just a matter of creating any monitored circuit needed (i.e. one per interface) then filling each of them with only one VRRP address, isn't it ? We then avoid the problem you describe. Personnally I love the new simplified mode. Creating a new VRID on the legacy page when you had already 10 interfaces in use with VRRP was a pain in the ass operation. But I agree that sharing the same VRID across multiple interface is definetely a bad thing ! Additionnally to the problems mentionned by Alienbaby, we can add it is bandwith consuming on the switch backplane (at least !). |
![]() |
| Thread Tools | |
| Display Modes | |
| |