The VRRP management groups on the master and the backup exchange information about the operation states of the firewalls through VGMP packets. In this way, the firewalls can maintain stability of their states and perform switchover between them when necessary.

VGMP packets are evolved from VRRP packets. VGMP packets mainly include Hello messages, state switchover request messages, response messages allowing state switchover, and response messages denying state switchover.

• Hello message

  Similar to VRRP groups, the VGMP group on the master regularly sends hello messages to the backup to inform the backup of the masters operation state, including the priority of the master and the states of the VRRP backup groups. When the backup receives a hello message, it returns an acknowledgement (ACK) message, which contains the priority of the backup and the states of the VRRP groups on the backup. The two firewalls exchange their state information through Hello messages.

  By default, the interval for sending VGMP hello messages is 1 second. When the backup fails to receive a hello message from the master after three hello messages periods, it deems that the master fails, and then becomes the master.

• State switchover message

  When a member in the backup group on the master fails, the VRRP management group can immediately sense the failure. In this case, the VRRP management group adjusts its own priority and sends a state switchover message to the peer. When the peer receives the message, it compares the priority in the message and its own priority. If its own priority is higher than that in the message, the peer returns an ACK message to allow switchover and at the same time becomes the master. When the faulty firewall receives the ACK message, it immediately becomes the backup. When the state of the VRRP management group is switched, the states of all VRRP backup groups in the VGMP group are switched accordingly.

  If the priority of the peer is lower than that in the message, a NACK message is returned to deny state switchover. Then, the states of bothfirewalls do not change.

  The VGMP group can proactively send a state switchover message immediately after it senses the fault on the interface. State switchover does not rely on timeout of three Hello messages. Therefore, the response to faults is much quicker.

This document is very well done

Excellent Post

useful document, thanks