1-3If two switches have the same VRRP priority, the one whose VLAN interface takes effect earlierbecomes the master.Preemptive mode and preemption delay of a switch in a VRRP groupYou can configure an S5600 Ethernet switch to operate in preemptive mode.z In non-preemptive mode, as long as a switch in a VRRP group becomes the master, it stays as themaster as long as it operates normally, even if a backup is assigned a higher priority later.z If all the switches in a VRRP group are set to operate in preemptive mode, a backup sends VRRPadvertisements when it finds that its priority is higher than that of the current master. In this case anew election of master is triggered, and the backup becomes the master and the former masterbecomes a backup accordingly.You can also set the preemption delay for an S5600 switch.Setting a delay period aims at:z In an unstable network, backups in a VRRP group possibly cannot receive VRRP advertisementsfrom the master in time due to network congestions. In this case, the backup considers itself as themaster and sends out VRRP advertisements to elect master. This causes the master of the VRRPgroup to be determined frequently.z With preemption delay configured, if a backup does not receive VRRP advertisements from themaster in time, it waits for a while before switching to a new master. The backup does not sendVRRP advertisements if it receives VRRP advertisements from the master during the specifieddelay period.Authentication type and authentication key of a switch in a VRRP groupVRRP provides the following authentication types:z simple: Simple text authentication. In a network under possible security threat, the authenticationtype can be set to simple. With the simple authentication type configured, the switch adds anauthentication key into a VRRP packet before transmitting it. The receiver then compares theauthentication key of the packet with the locally configured one. If they are the same, the packet willbe taken as a true and legal one. Otherwise it will be regarded illegal and discarded.z md5: MD5 authentication. In a vulnerable network, the authentication type can be set to md5. Theswitch then uses the authentication type provided in the Authentication Header and the local MD5algorithm to authenticate the VRRP packets. Packets that fail to pass the authentication arediscarded. The switch then sends trap messages to the NMS.Virtual Router OverviewVRRP group and virtual router IP address configurationTo create a VRRP group, you need to configure an IP address for the VRRP group virtual router. TheVRRP group is automatically created after you configure the first IP address for the VRRP group virtualrouter. Other IP addresses configured for the virtual router after this one are just added to the IP addresslist of the virtual router.The virtual router IP address has the following features:
