The VRRP protocol

Kaspersky SD-WAN supports installing CPE devices at on locations to ensure high availability of these locations. One option for organizing high availability is to use the Virtual Router Redundancy Protocol (VRRP). You can configure VRRP between multiple CPE devices, or between a device and a third-party router.

When configuring VRRP, you must create VRRP instances that specify which CPE devices are combined into virtual routers for high availability.

Each VRRP instance is created with general VRRP settings such as the Virtual Router Identifier (VRID) and the virtual IP address for the network interface of the CPE device.

VRRP instances can be combined into groups to synchronize their operation. In this way, if a change to the primary VRRP router occurs in one of the VRRP instances within the group, the same change is also applied to all other VRRP instances in the group.

Enabling or disabling the VRRP protocol

You can enable or disable the VRRP protocol on an individual CPE device or on all devices that use the CPE template. When you enable VRRP, you must create a VRRP instance.

To enable or disable the VRRP protocol on an individual CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the VRRP tab.

   A table of VRPP instances is displayed.

4. Select the Override check box to ignore the applied CPE template and make the settings in the selected tab editable. This check box is cleared by default.
5. In the VRRP drop-down list, select one of the following values:
   • Enabled
   • Disabled (selected by default)
6. In the upper part of the settings area, click Save to save the configuration of the CPE device.

To enable or disable the VRRP protocol on all devices that use a CPE template:

1. In the menu, go to the SD-WAN → CPE templates subsection.

   A table of CPE templates is displayed.

2. Click the CPE template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the VRRP tab.

   A table of VRPP instances is displayed.

4. In the VRRP drop-down list, select one of the following values:
   • Enabled
   • Disabled (selected by default)
5. In the upper part of the settings area, click Save to save the configuration of the CPE template.

Creating a VRRP instance

Expand all | Collapse all

You can create a VRRP instance on an individual CPE device or on all devices that use the CPE template. Before creating a VRRP instance, you must create a network interface. To create a VRRP instance, use the following instructions:

• Creating a VRRP instance on an individual CPE device.

  To create a VRRP instance on an individual CPE device:

  1. In the menu, go to the SD-WAN section.

     By default, the CPE subsection is displayed with a table of CPE devices.

  2. Click the CPE device.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  3. Select the VRRP tab.

     A table of VRPP instances is displayed.

  4. Select the Override check box to ignore the applied CPE template and make the settings in the selected tab editable. This check box is cleared by default.
  5. Click + VRRP instance.
  6. This opens a window; in that window, in the Name field, enter the name of the VRRP instance. Maximum length: 16 characters.
  7. In the VRID field, enter the Virtual Router Identifier for the CPE device. You must specify the same VRID for all devices that you want to combine into a virtual router. Range of values: 1 to 255.
  8. In the Interface drop-down list, select a previously created network interface to which you want to assign a virtual IP address.
  9. In the VIP field, enter the virtual IP address for the network interface. You must assign the same virtual IP address to the network interfaces of all CPE devices that you want to combine into a virtual router.
  10. In the State drop-down list, select the role of the CPE device:
      • Backup for a backup VRRP router. This is the default setting.
      • Master for the primary VRRP router.
  11. In the Priority field, enter the priority of the VRRP router. The higher the value in this field, the higher the priority. When the primary VRRP router fails, it is replaced by the backup VRRP router with the highest priority. If the backup VRPP router has a higher priority than the primary router, it also becomes the primary router. Range of values: 1 to 1000. The default setting is 100.
  12. In the Advertise interval (sec.) field, enter the time interval in seconds for sending VRRP advertisements. Range of values: 1 to 60. The default setting is 5.
  13. If you do not want to change the role of the backup VRRP router that has become the primary router, even if the old primary VRRP router becomes operational again, select the Nopreempt check box. This check box is cleared by default.
  14. If necessary, configure sending VRRP advertisements as unicast messages:
      1. Select the Unicast check box. This check box is cleared by default.
      2. In the Main VRPP router IP field, enter the necessary value.
      3. In the Backup VRRP router IP field, enter the necessary value.
  15. If necessary, use a password for authenticating VRRP advertisements:
      1. Select the Authentication check box. This check box is cleared by default.
      2. Enter a password in the field that is displayed. Maximum length of the password: 16 characters. To see the entered password, you can click the show button .
  16. Click Create.

      The VRRP instance is created and displayed in the table.

  17. In the upper part of the settings area, click Save to save the configuration of the CPE device.
• Creating a VRRP instance on all devices that use the CPE template.

  To create a VRRP instance on all devices that use the CPE template:

  1. In the menu, go to the SD-WAN → CPE templates subsection.

     A table of CPE templates is displayed.

  2. Click the CPE template.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  3. Select the VRRP tab.

     A table of VRPP instances is displayed.

  4. Click + VRRP instance.
  5. This opens a window; in that window, in the Name field, enter the name of the VRRP instance. Maximum length: 16 characters.
  6. In the VRID field, enter the Virtual Router Identifier for the CPE device. You must specify the same VRID for all devices that you want to combine into a virtual router. Range of values: 1 to 255.
  7. In the Interface drop-down list, select a previously created network interface to which you want to assign a virtual IP address.
  8. In the VIP field, enter the virtual IP address for the network interface. You must assign the same virtual IP address to the network interfaces of all CPE devices that you want to combine into a virtual router.
  9. In the State drop-down list, select the role of the CPE device:
     • Backup for a backup VRRP router. This is the default setting.
     • Master for the primary VRRP router.
  10. In the Priority field, enter the priority of the VRRP router. The higher the value in this field, the higher the priority. When the primary VRRP router fails, it is replaced by the backup VRRP router with the highest priority. If the backup VRPP router has a higher priority than the primary router, it also becomes the primary router. Range of values: 1 to 1000. The default setting is 100.
  11. In the Advertise interval (sec.) field, enter the time interval in seconds for sending VRRP advertisements. Range of values: 1 to 60. The default setting is 5.
  12. If you do not want to change the role of the backup VRRP router that has become the primary router, even if the old primary VRRP router becomes operational again, select the Nopreempt check box. This check box is cleared by default.
  13. If necessary, configure sending VRRP advertisements as unicast messages:
      1. Select the Unicast check box. This check box is cleared by default.
      2. In the Main VRPP router IP field, enter the necessary value.
      3. In the Backup VRRP router IP field, enter the necessary value.
  14. If necessary, use a password for authenticating VRRP advertisements:
      1. Select the Authentication check box. This check box is cleared by default.
      2. Enter a password in the field that is displayed. Maximum length of the password: 16 characters. To see the entered password, you can click the show button .
  15. Click Create.

      The VRRP instance is created and displayed in the table.

  16. In the upper part of the settings area, click Save to save the configuration of the CPE template.

Editing a VRRP instance

You can edit a VRRP instance on an individual CPE device or on all devices that use the CPE template. For a description of the settings, see the instructions for creating a VRRP instance.

To edit a VRRP instance on an individual CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the VRRP tab.

   A table of VRPP instances is displayed.

4. Select the Override check box to ignore the applied CPE template and make the settings in the selected tab editable. This check box is cleared by default.
5. Click Edit next to the VRRP instance.
6. This opens a window; in that window, edit the settings that you want to change.
7. Click Save.
8. In the upper part of the settings area, click Save to save the configuration of the CPE device.

To edit a VRRP instance on all devices that use the CPE template:

1. In the menu, go to the SD-WAN → CPE templates subsection.

   A table of CPE templates is displayed.

2. Click the CPE template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the VRRP tab.

   A table of VRPP instances is displayed.

4. Click Edit next to the VRRP instance.
5. This opens a window; in that window, edit the settings that you want to change.
6. Click Save.
7. In the upper part of the settings area, click Save to save the configuration of the CPE template.

Deleting a VRRP instance

You can delete a VRRP instance on an individual CPE device or on all devices that use the CPE template. Deleted VRRP instances cannot be restored.

To delete a VRRP instance on an individual CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the VRRP tab.

   A table of VRPP instances is displayed.

4. Select the Override check box to ignore the applied CPE template and make the settings in the selected tab editable. This check box is cleared by default.
5. Click Delete next to the VRRP instance.
6. In the confirmation window, click Delete.

   The VRRP instance is deleted and is no longer displayed in the table.

7. In the upper part of the settings area, click Save to save the configuration of the CPE device.

To delete a VRRP instance on all devices that use the CPE template:

1. In the menu, go to the SD-WAN → CPE templates subsection.

   A table of CPE templates is displayed.

2. Click the CPE template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the VRRP tab.

   A table of VRPP instances is displayed.

4. Click Delete next to the VRRP instance.
5. In the confirmation window, click Delete.

   The VRRP instance is deleted and is no longer displayed in the table.

6. In the upper part of the settings area, click Save to save the configuration of the CPE template.

Creating a group of VRRP instances

You can create a VRRP instance group on an individual CPE device or on all devices that use the CPE template. Before creating a VRRP instance group, you must create at least one VRRP instance.

To create a VRRP instance group on an individual CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the VRRP → VRRP instance groups tab.

   A table of VRRP instance groups is displayed.

4. Select the Override check box to ignore the applied CPE template and make the settings in the selected tab editable. This check box is cleared by default.
5. Click + VRRP instance group.
6. This opens a window; in that window, in the Name field, enter the name of the VRRP instance group. Maximum length: 16 characters. The default setting is 1.
7. In the VRRP instances drop-down list, select the instances that you want to add to the group.
8. Click Create.

   The VRRP instance group is created and displayed in the table.

9. In the upper part of the settings area, click Save to save the configuration of the CPE device.

To create a VRRP instance group on all devices that use the CPE template:

1. In the menu, go to the SD-WAN → CPE templates subsection.

   A table of CPE templates is displayed.

2. Click the CPE template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the VRRP → VRRP instance groups tab.

   A table of VRRP instance groups is displayed.

4. Click + VRRP instance group.
5. This opens a window; in that window, in the Name field, enter the name of the VRRP instance group. Maximum length: 16 characters. The default setting is 1.
6. In the VRRP instances drop-down list, select the instances that you want to add to the group.
7. Click Create.

   The VRRP instance group is created and displayed in the table.

8. In the upper part of the settings area, click Save to save the configuration of the CPE template.

Editing a group of VRRP instances

You can edit a VRRP instance group on an individual CPE device or on all devices that use the CPE template. For a description of the settings, see the instructions for creating a VRRP instance group.

To edit a VRRP instance group on an individual CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the VRRP → VRRP instance groups tab.

   A table of VRRP instance groups is displayed.

4. Select the Override check box to ignore the applied CPE template and make the settings in the selected tab editable. This check box is cleared by default.
5. Click Edit next to the VRRP instance group.
6. This opens a window; in that window, edit the settings that you want to change.
7. Click Save.
8. In the upper part of the settings area, click Save to save the configuration of the CPE device.

To edit a VRRP instance group on all devices that use the CPE template:

1. In the menu, go to the SD-WAN → CPE templates subsection.

   A table of CPE templates is displayed.

2. Click the CPE template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the VRRP → VRRP instance groups tab.

   A table of VRRP instance groups is displayed.

4. Click Edit next to the VRRP instance group.
5. This opens a window; in that window, edit the settings that you want to change.
6. Click Save.
7. In the upper part of the settings area, click Save to save the configuration of the CPE template.

Deleting a group of VRRP instances

You can delete a VRRP instance group on an individual CPE device or on all devices that use the CPE template. Deleted VRRP instance groups cannot be restored.

To delete a VRRP instance group on an individual CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the VRRP → VRRP instance groups tab.

   A table of VRRP instance groups is displayed.

4. Select the Override check box to ignore the applied CPE template and make the settings in the selected tab editable. This check box is cleared by default.
5. Click Delete next to the VRRP instance group.
6. In the confirmation window, click Delete.

   The VRRP instance group is deleted and is no longer displayed in the table.

7. In the upper part of the settings area, click Save to save the configuration of the CPE device.

To delete a VRRP instance group on all devices that use the CPE template:

1. In the menu, go to the SD-WAN → CPE templates subsection.

   A table of CPE templates is displayed.

2. Click the CPE template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the VRRP → VRRP instance groups tab.

   A table of VRRP instance groups is displayed.

4. Click Delete next to the VRRP instance group.
5. In the confirmation window, click Delete.

   The VRRP instance group is deleted and is no longer displayed in the table.

6. In the upper part of the settings area, click Save to save the configuration of the CPE template.