The Virtual Router Redundancy Protocol (VRRP) is a LAN-side protocol that provides redundant gateway service for switches and other IP end stations. In Cisco SD-WAN, you can configure VRRP on interfaces and subinterfaces, within a VPN.

For more information, see Configuring VRRP.

The VRRP Tracking feature enables switching to a backup or a secondary VRRP router in the following scenarios:

• If a single tunnel (or two tunnels - when you configure redundancy using Transport Locators (TLOC)) on a vEdge device goes down. In this case, the VRRP priority decrements and the secondary router becomes the primary router. VRRP notifies this change to the overlay through Overlay Management Protocol (OMP).

• VRRP can track up to one interface object or Secure Internet Gateway (SIG) object for a group. The interface object can have up to four interfaces. Hence, a group can track up to four tunnel interfaces. The VRRP priority decrements only if all the interfaces of an interface object go down.

The VRRP state is determined based on the tunnel link status. If the tunnel or interface is down on the primary VRRP, then the traffic is directed to the secondary VRRP. The secondary VRRP router in the LAN segment becomes primary VRRP to provide gateway for the service-side traffic.

Zscaler Tunnel Use Case 1—Primary VRRP, Single Internet Provider

The primary and secondary Zscaler tunnels are connected through a single internet provider to the primary VRRP. The primary and secondary VRRP routers are connected through using TLOC extension. In this scenario, the VRRP state transition occurs if the primary and secondary tunnels go down on primary VRRP. The predetermined priority value decrements when the tracking object is down, which triggers the VRRP state transition. To avoid asymmetric routing, VRRP notifies this change to the Overlay through OMP.

Zscaler Tunnel Use Case 2—VRRP Routers in TLOC Extension, Dual Internet Providers

The primary and secondary VRRP routers are configured in TLOC extension high availability mode. The primary and secondary Zscaler tunnels are directly connected with primary and secondary VRRP routers, respectively, using dual internet providers. In this scenario too, the VRRP state transition occurs if the primary and secondary tunnels go down on primary VRRP. The predetermined priority value decrements when the tracking object is down, which triggers the VRRP state transition. VRRP notifies this change to the Overlay through OMP.

TLOC Preference

Transport Locators (TLOCs) connect an OMP route to a physical location. A TLOC is directly reachable using an entry in the routing table of the physical network, or represented by a prefix beyond a NAT device.

The TLOC change preference is an optional configuration under VRRP group. If you configure TLOC change preference value using the tloc-change-pref command, the value increases by 1 when a node becomes the primary node. The configured or default TLOC preference is applied back on standby state.

Note

We recommend that you use the same TLOC preference value for all TLOCs in a site. For a Cisco vEdge device, the default TLOC preference for the tunnel interface can be modified irrespective of whether VRRP is configured or not. However, if you want to use the VRRP tracking feature and utilize the advantage of TLOC preference values for VRRP tracking, ensure that the default tunnel preference is same on both the VRRP routers.

Use the System template to configure an object tracker.

1. From the Cisco vManage menu, choose Configuration > Templates.

2. Click Feature.

3. Navigate to the System template for the device.

   Note	To create a System template, see Create System Template

4. Click Tracker, and click New Object Tracker to configure the tracker parameters.

   Table 2. Tracker Parameters

   Field	Description
   Tracker Type	Choose Interface or SIG to configure the Object tracker.
   Tracker List	Enter the name of the tracker list.
   Interface	Choose global or device-specific tracker interface name.

5. Click Add.

6. Click Save.

To configure VRRP for a VPN template, do the following:

1. From the Cisco vManage menu, choose Configuration > Templates.

2. Click Feature Templates.

   Note	In Cisco vManage Release 20.7.x and earlier releases, Feature Templates is titled Feature.

3. Navigate to the VPN Interface Ethernet template for the device.

   Note	For information about creating a new VPN Interface Ethernet template, see Configure VPN Ethernet Interface.

4. Click VRRP and choose IPv4.

5. Click New VRRP to create a new VRRP or edit the existing VRRP and configure the following parameters:

   Parameter Name	Description
   TLOC Preference Change	(Optional) Choose On or Off to set whether the TLOC preference can be changed or not.

6. Click the Add Tracking Object link, and in the Tracking Object dialog box that is displayed, click Add Tracking Object.

7. In the Tracker Name field, enter the name of the tracker.

8. From the Action drop-down list, choose Decrement and enter the Decrement Value.

9. Click Add.

10. Click Add to save the VRRP details.

11. Click Save.

Interface Object Tracking Using CLI

This example shows how to addan interface to a track list using Cisco vManage device CLI template:

Configure terminal
 system
track-list zs1 interface ge0/1 gre1 ipsec1 
commit
exit

Configure Interface Tracking and Priority Decrement

vpn 1
name vpn-name
interface ge0/2
ip address 172.16.10.1/24
no shutdown
vrrp 100
track zs1 decrement 10
exit
ipv4 172.16.10.100
tloc-change-pref

Configure Track List for SIG Container

config terminal
system
track-list SIG sig-container global
 exit 
exit

Configure SIG Container Tracking and Priority Decrement

vpn 1
name vpn-name
interface ge0/2
ip address 172.16.10.1/24
no shutdown
vrrp 100
track SIG decrement 10
exit
ipv4 172.16.10.100
tloc-change-pref