Vincent,

What you are missing is that there is no relation between the
source IP address in an IP packet and the source MAC address
in the ethernet packet carrying it. There is no requirement
whatsoever for them to match in any way, and thank goodness
because it would make routed packets somewhat difficult to
handle since they have source IP addresses completely unrelated
to any MAC address sending on the local network.

In other words, there is no such requirement as:

>Moreover, the source MAC address of the the ICMP, TCP, ARP
>packets related to the *IP Address Owner*, must (of course)
>be the *Virtual Router MAC Address*.

>Conclusion: a *Primary IP Address* can have two MAC
>addresses !!!, the *Virtual Router MAC Address* and
>the MAC address of the NIC !

The VR IP address "has" one MAC address: the VR MAC.
ARP should always advertise that mapping and no other.
But this has no relevance to the selection of source
MAC address when transmitting a packet.

I understand how startling this observation can be, but it's
just basic IP logic, nothing VRRP specific about it. Once
you get your thoughts around it, VRRP falls out nicely.
In particular, you realize that there is only one reason, ever,
to use the VR's MAC address as the source of an ethernet packet,
and that is to teach the ethernet switching infrastructure
where to send packets with that MAC address as the destination.
That is accomplished by sending the advertisement packets with
the VR MAC address as source since those packets are known to
be sent at the appropriate times.

For all other packets, the source MAC address retains its
original purpose: to identify the hardware that transmitted
the packet. If anything, this becomes *more* important in
a VRRP environment, since problems can be much harder to
diagnose if it's impossible to tell which system sent which
packets.

-don

-----Original Message-----
From: Vincent Jardin [mailto:Vincent.Jardin@6wind.com] 
Sent: Thursday, March 23, 2006 1:38 AM
To: vrrp@ietf.org
Subject: [VRRP] Two MAC addresses for a same IP Primary address

Hi all,

According to the RFC3768, when a multicast VRRP packet is sent, the source
IP address must be the *Primary IP Address* (section 5.2.1) and the source
MAC address must be the *Virtual Router MAC Address*.

Moreover, the source MAC address of the the ICMP, TCP, ARP packets related
to the *IP Address Owner*, must (of course) be the *Virtual Router MAC
Address*.

Two routers running VRRP should have 2 differents *Primary IP Address*, and
(of course) the same *IP Address Owner*.

So, if from a host, which is on the same Ethernet network, I send an ICMP
echo request to:
   - the *Primary IP Address*, which source MAC address should the ICMP echo
reply use ?
     According to me, it must NOT be the *Virtual Router MAC Address*.
   - the *IP Address Owner*, which source MAC address should the ICMP echo
reply use ?
     According to me, it must be the *Virtual Router MAC Address*.

So it means that for any packets, when the source IP address is the *Primary
IP Address*, the source MAC address could be any MAC address of the NIC; but
when it is a VRRP Multicast packet to 224.0.0.18, the source MAC address
must be the *Virtual Router MAC Address*.

Conclusion: a *Primary IP Address* can have two MAC addresses !!!, the
*Virtual Router MAC Address* and the MAC address of the NIC !

It is not logical, so what are we missing ?

According to me:
   -Option1: the section 5.2.1 should specify that the source address should
be an *IP Address Owner*, instead of the *Primary IP address*.
   -Option2: remove the constraint of the source MAC address of the VRRP
packet = the *Virtual Router MAC Address*.

I prefer option 2 because it avoids the Ethernet switch from oscillating
during a transition state.

Regards,
   Vincent

_______________________________________________
vrrp mailing list
vrrp@ietf.org
https://www1.ietf.org/mailman/listinfo/vrrp


_______________________________________________
vrrp mailing list
vrrp@ietf.org
https://www1.ietf.org/mailman/listinfo/vrrp