Keepalived is an open source software project that can do many things related to high availability. One of these many things is the Virtual Router Redundancy Protocol, which provides for high availability for IP networking. In other words, you can have two routers and if one goes down, the second one kicks in automatically.
The way this works is two or more routers exchange VRRP messages on a subnet and based on their configuration, decide who is the master and who is the backup. Once this is decided they will agree on a pre-configured “virtual” IP, or an IP that is not configured on an interface, but a floating one that either router can assume responsibility for should the other one fail for some reason and VRRP messages stop flowing.
Topology
The relevant network here is on the bottom half, where a subnet of 192.168.0.0/24 is configured. The Ubuntu server has 192.168.0.2/24 on its ens3 interface, while Rocky has 192.168.0.3/24 on its ens3 interface. They will both have keepalived installed and through VRRP share virtual IP of 192.168.0.1/24. The Alpine linux “PC” at the bottom which is acting as a workstation or desktop computer will have its default route configured to point to 192.168.0.1, the VRRP address.
Ubuntu 20.04 configuration
On the Ubuntu server we’ll install the keepalived available from the package manager with this:
apt-get install keepalived
Once that’s installed, we’ll write the configuration file which is in /etc/keepalived/keepalived.conf. You’ll need to create the keepalived.conf file:
vrrp_instance VI_1 {
state MASTER
interface ens3
virtual_router_id 51
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass james
}
virtual_ipaddress {
192.168.0.1/24
}
}
I’ll go through the parameters here:
- state MASTER: the state that the router will start in.
- interface ens3: VRRP protocol messages should flow is ens3.
- virtual_router_id: An integer that both routers should have configured to the same thing.
- priority: who wins the master/backup election – higher numerical means higher priority.
- advert_int: backup waits this long (multiplied by 3) after messages from master fail before becoming master
- authentication: a clear text password authentication.
- virtual_ipaddress: the agreed-upon virtual IP that the routers will share
Restart keepalived to load the config:
systemctl restart keepalived
Rock Linux configuration
Since Rocky uses yum for package management, we install keepalived like this:
yum install keepalived
And in the /etc/keepalived/keepalived.conf file we’ll write this:
vrrp_instance VI_1 {
state BACKUP
interface ens3
virtual_router_id 51
priority 99
advert_int 1
authentication {
auth_type PASS
auth_pass james
}
virtual_ipaddress {
192.168.0.1/24
}
}
Make sure to restart keepalived to load the config:
systemctl restart keepalived
The only parameters that are different are the state and the priority.
Verify keepalived and VRRP
The first thing you can check on Ubuntu is the /var/log/syslog file to make sure keepalived started and is in the correct state:
tail /var/log/syslog --- Dec 1 12:23:47 u20vm Keepalived[12349]: Opening file '/etc/keepalived/keepalived.conf'. Dec 1 12:23:47 u20vm Keepalived[12349]: Starting VRRP child process, pid=12360 Dec 1 12:23:47 u20vm Keepalived_vrrp[12360]: Registering Kernel netlink reflector Dec 1 12:23:47 u20vm Keepalived_vrrp[12360]: Registering Kernel netlink command channel Dec 1 12:23:47 u20vm Keepalived_vrrp[12360]: Opening file '/etc/keepalived/keepalived.conf'. Dec 1 12:23:47 u20vm Keepalived_vrrp[12360]: Registering gratuitous ARP shared channel Dec 1 12:23:47 u20vm Keepalived_vrrp[12360]: (VI_1) Entering BACKUP STATE (init) Dec 1 12:23:48 u20vm Keepalived_vrrp[12360]: (VI_1) received lower priority (99) advert from 192.168.0.3 - discarding Dec 1 12:23:51 u20vm Keepalived_vrrp[12360]: message repeated 3 times: [ (VI_1) received lower priority (99) advert from 192.168.0.3 - discarding] Dec 1 12:23:51 u20vm Keepalived_vrrp[12360]: (VI_1) Entering MASTER STATE
On Rocky the journalctl -e command showed me the keepalived logs.
Once you’ve confirmed that keepalived is in the right state, you can prove it further with a wireshark capture. If you’re doing this lab in GNS3 like I am, it’s easy, just right click the link (in this case, between the Ubuntu server and the switch) and capture on it. Otherwise you can use something like tcpdump on the Ubuntu/Rocky routers themselves. Right when you restart the keepalived process you will see packets going back and forth. That’s the master election process and exchange of parameters/neighbor establishment:
But once the routers are in agreement and VRRP is working, packets will only flow from the master to the designated (in the RFC) VRRP multicast address at 224.0.0.18:
We can also further prove that when we initiate a ping to 8.8.8.8 from the Alpine “PC” (it’s a docker container), we can see that traffic is flowing through the Ubuntu router.
Simulate a failure
We’ll simulate a failure by shutting the ens3 interface on the Ubuntu router, like so:
ip link set ens3 down
The Rocky router will observe that VRRP “hello” messages are no longer going to 224.0.0.18, and quickly assume the role of master and take over for 192.168.0.1. I did a continuous ping on the Alpine PC and it didn’t actually show any failed pings! We can see that traffic is now flowing through the Rocky router:
Now let’s “fail back” to the Ubuntu router by re-enabling the ens3 interface:
ip link set ens3 up ip addr add 192.168.0.1/24 dev ens3
And we should be able to see keepalived resuming master responsibilities in the Ubuntu /var/log/syslog:
Dec 1 12:44:53 u20vm Keepalived_vrrp[12379]: Netlink reports ens3 up Dec 1 12:44:53 u20vm systemd-networkd[602]: ens3: Gained carrier Dec 1 12:44:55 u20vm systemd-networkd[602]: ens3: Gained IPv6LL Dec 1 12:45:04 u20vm Keepalived_vrrp[12379]: (VI_1) Entering BACKUP STATE Dec 1 12:45:04 u20vm Keepalived_vrrp[12379]: (VI_1) received lower priority (99) advert from 192.168.0.3 - discarding Dec 1 12:45:07 u20vm Keepalived_vrrp[12379]: message repeated 3 times: [ (VI_1) received lower priority (99) advert from 192.168.0.3 - discarding] Dec 1 12:45:08 u20vm Keepalived_vrrp[12379]: (VI_1) Entering MASTER STATE
While the Rocky log will show a similar message about becoming backup. We can see that pings are once again flowing through the Ubuntu router:
Hope you liked it.