3.4 High-Availability Gateways: VRRP and VSX Active-Gateway

3.4 High-Availability Gateways: VRRP and VSX Active-Gateway

In enterprise campus networks, end-user devices such as PCs, IP phones, wireless access points, and printers rely on a default gateway to communicate beyond their local Layer 2 broadcast domain. Standard client network stacks can only be configured with a single default gateway IP address (typically assigned via DHCP). If the physical switch or router hosting this gateway address fails, all connected endpoints on that subnet lose off-subnet and Internet connectivity.

To eliminate this single point of failure, network architects deploy First-Hop Redundancy Protocols (FHRP). In ArubaOS-CX environments, two primary gateway redundancy mechanisms are available: the industry-standard Virtual Router Redundancy Protocol (VRRP) and Aruba's native VSX Active-Gateway.

---

Virtual Router Redundancy Protocol (VRRP)

VRRP is an open-standard protocol defined by the IETF (RFC 3768 for IPv4, RFC 5798 for IPv4/IPv6). It dynamically elects an active/standby router pair to represent a shared Virtual IP (VIP) address.

VRRP Mechanics and Roles

• Master (Active) Router: The router that actively forwards packets addressed to the Virtual IP address. AOS-CX documentation calls this role Active. It responds to client ARP requests with a standardized Virtual MAC address.
• Backup (Standby) Router: One or more standby routers that monitor the health of the Master. The Backup does not actively forward traffic sent to the virtual gateway while the Master is operational.
• Virtual MAC Address: VRRP generates a deterministic Layer 2 MAC address based on the Virtual Router ID (VRID):

$\text{00:00:5E:00:01:}\text{[VRID in Hex]}$

For example, VRID 10 yields Virtual MAC 00:00:5E:00:01:0A.

Priority and Preemption

• Priority Range: Configured from 1 to 254 (default is 100). The router with the highest priority is elected Master.
• Owner Priority (255): Priority 255 is automatically assigned if the Virtual IP matches the real physical IP configured on the interface.
• Preemption: By default, preemption is enabled in AOS-CX (preempt in the VRRP group context). A higher-priority Standby takes over the Active role; no preempt stops that, but never prevents the address owner from resuming the Active role.

Heartbeat Timers and Convergence

• The Master transmits VRRP Advertisement multicasts to 224.0.0.18 every 1 second (default advertisement interval).
• The Backup router maintains a Master Down Timer calculated as:

$\text{Master Down Interval} = (3 \times \text{Advertisement Interval}) + \text{Skew Time}$

With default 1-second timers, the Backup waits approximately 3.6 seconds without receiving an advertisement before assuming the Master role. During this 3.6-second failover window, client traffic destined for the default gateway is dropped.

---

The Suboptimal Triangular Routing Penalty of VRRP

When VRRP is deployed in modern aggregation topologies utilizing Multi-Chassis Link Aggregation (VSX-LAG), a significant data-plane inefficiency emerges: triangular routing.

+-------------------------------------------------------------------------+
|                   VRRP ASYMMETRIC / TRIANGULAR ROUTING                  |
|                                                                         |
|   +-----------------------+              +-----------------------+      |
|   | VRRP MASTER (Switch A)|   ISL (LAG)  | VRRP BACKUP (Switch B)|      |
|   | Routes to Core / WAN  |<============>| Cannot Route to VMAC  |      |
|   +-----------+-----------+  TRANSIT     +-----------+-----------+      |
|         ^     |              TRAFFIC                 ^                  |
|         |     |                                      |                  |
|         |     |                                      | 50% Ingress      |
|         |     +------------------+ +-----------------+ Traffic          |
|         |                        | |                 |                  |
|   50% Direct              +======+=+======+          |                  |
|   Local Routing           |    VSX-LAG    | ---------+                  |
|                           +=======+=======+ (Suboptimal hop over ISL)   |
|                                   |                                     |
|                          +-----------------+                            |
|                          | Access Switch   |                            |
|                          +-----------------+                            |
+-------------------------------------------------------------------------+

1. Downstream access switches distribute outbound client frames across both uplinks of the VSX-LAG using standard LACP load-balancing hash algorithms (roughly 50% per link).
2. Frames hashing to the VRRP Master (Switch A) are immediately routed upstream at wire speed.
3. Frames hashing to the VRRP Backup (Switch B) encounter a problem: because Switch B is in Backup status, it is not authorized to route packets addressed to the VRRP Virtual MAC.
4. Switch B must bridge these frames across the Inter-Switch Link (ISL) to Switch A. Switch A then routes the packets upstream.
5. This suboptimal detour consumes valuable ISL bandwidth, introduces latency jitter, and effectively halves the routing throughput of the aggregation layer.

---

Aruba VSX Active-Gateway

To overcome the active/standby limitations of VRRP, Aruba introduced VSX Active-Gateway. Active-Gateway provides native active/active Layer 3 first-hop redundancy tailored specifically for VSX pairs.

Active-Gateway Architecture and Forwarding

• Both the Primary and Secondary VSX switches are configured with the exact same Virtual IP address and Virtual MAC address on their corresponding VLAN Switched Virtual Interfaces (SVIs).
• Unlike VRRP, there is no active/standby distinction: both switches actively route traffic simultaneously.
• When a client transmits a frame to the default gateway's virtual MAC, whichever VSX switch receives the frame routes it locally in hardware at full ASIC wire speed.
• No transit routing traffic traverses the Inter-Switch Link (ISL). 100% of aggregation routing capacity is utilized.

ARP Resolution and Instantaneous Failover

• When a downstream host sends an ARP request for the default gateway IP, both VSX peers can reply with the configured virtual MAC address.
• If one VSX switch or physical uplink fails, the downstream switch's LACP hashing algorithm automatically redirects traffic to the surviving uplink.
• Because the surviving VSX peer already has the identical IP, identical virtual MAC, and synchronized routing tables programmed into its ASICs, failover convergence is instantaneous (0 seconds). No protocol state machine transitions or ARP renegotiations take place.

---

Comprehensive Architectural Comparison

---

Configuration and Implementation

1. VRRP Configuration on AOS-CX

switch(config)# interface vlan 10
switch(config-if-vlan)# ip address 10.1.10.2/24
switch(config-if-vlan)# vrrp 10 address-family ip
switch(config-if-vrrp)# address 10.1.10.1 primary
switch(config-if-vrrp)# priority 110
switch(config-if-vrrp)# no shutdown

2. VSX Active-Gateway Configuration on AOS-CX

Active-Gateway requires an IP address on each peer's SVI in the same subnet as the virtual IP, plus matching active-gateway parameters. VRRP and active-gateway cannot be configured on the same SVI, and the virtual MAC must not reuse the VSX system MAC (AOS-CX 10.14 CLI Guide):

! --- VSX Primary Switch (Switch A) ---
switch-A(config)# interface vlan 10
switch-A(config-if-vlan)# ip address 10.1.10.2/24
switch-A(config-if-vlan)# active-gateway ip mac 02:00:0a:01:0a:01
switch-A(config-if-vlan)# active-gateway ip 10.1.10.1

! --- VSX Secondary Switch (Switch B) ---
switch-B(config)# interface vlan 10
switch-B(config-if-vlan)# ip address 10.1.10.3/24
switch-B(config-if-vlan)# active-gateway ip mac 02:00:0a:01:0a:01
switch-B(config-if-vlan)# active-gateway ip 10.1.10.1

Verification is performed using show active-gateway (active-gateway) or show vrrp (VRRP). An abbreviated example:

switch-A# show active-gateway
VLAN  IPv4 Address     MAC Address        Status
-------------------------------------------------
10    10.1.10.1        02:00:0a:01:0a:01  Active