Source MAC access controls in a virtual redundant router protocol environment
In general, techniques provide a mapping of host devices to different virtual router identifiers used to identify the source MAC address used for forwarding packets to the participating host devices. For example, a method may include receiving an Address Resolution Protocol (ARP) request for a first Internet protocol (IP) address from a host device, the first IP address comprising a virtual IP address of the virtual router. The method may also include determining a virtual router redundancy protocol (VRRP) virtual router identifier (VRID) associated with the first IP address. The method may further include generating a mapping between the host device and the determined VRID. The method may also include determining a virtual source MAC address of the virtual router based on the mapping and forwarding a second packet to the host device that specifies a virtual source MAC address for the second packet.
1. A method comprising:
receiving, by a virtual router executing on a physical router, an Address Resolution Protocol (ARP) request for an Internet protocol (IP) address of a host device, the IP address comprising a virtual IP address of the virtual router;
determining, by the virtual router, a virtual router redundancy protocol (VRRP) virtual router identifier (VRID) associated with the IP address; and
generating, by the virtual router, a mapping between the IP address of the host device and the determined VRID for forwarding packets to the host device;
receiving, by the virtual router, a first packet including a destination IP address field specifying the IP address of the host device;
determining, by the virtual router and based on the mapping, a virtual source MAC address of the virtual router that is based on the VRID associated with the IP address; and
forwarding, by the virtual router, a second packet to the host device, the second packet specifying the determined virtual source MAC address as a source MAC address for the second packet, and the second packet including a payload of the first packet.
2. The method of claim 1 , wherein determining the virtual source MAC address of the virtual router based on the mapping further comprises:
determining the virtual source MAC address comprising a pre-determined byte address prefix and the VRID in a last byte of the virtual source MAC address.
3. The method of claim 1 , wherein forwarding the second packet to the host device further comprises:
updating a source MAC address field of the second packet to specify the virtual source MAC address.
4. The method of claim 1 , further comprising:
updating a next hop field of forwarding information specifying the IP address of the host device as a destination IP address with the determined virtual source MAC address.
5. The method of claim 1 , wherein the host device is configured with the IP address as a default gateway address.
6. The method of claim 1 , further comprising executing a plurality of virtual routers, including the virtual router, in accordance with VRRP.
7. A network device comprising:
a memory;
one or more processors operably coupled to the memory, wherein the one or more processors are configured to execute a virtual router to:
receive an Address Resolution Protocol (ARP) request for an Internet protocol (IP) address from a host device, the IP address comprising a virtual IP address of the virtual router;
determine a virtual router redundancy protocol (VRRP) virtual router identifier (VRID) associated with the IP address;
generate a mapping between the IP address of the host device and the determined VRID for forwarding packets to the host device; and
store the mapping in the memory;
receive a first packet including a destination IP address field specifying the IP address of the host device;
determine, based on the mapping, a virtual source MAC address of the virtual router that is based on the VRID associated with the IP address; and
forward a second packet to the host device, the second packet specifying the determined virtual source MAC address as a source MAC address for the second packet, and the second packet including a payload of the first packet.
8. The network device of claim 7 , wherein to determine the virtual source MAC address of the virtual router based on the mapping, the virtual router is further configured to:
determine the virtual source MAC address comprising a pre-determined byte address prefix and the VRID in a last byte of the virtual source MAC address.
9. The network device of claim 7 , wherein to forward the second packet to the host device, the virtual router is further configured to:
update a source MAC address field of the second packet to specify the virtual source MAC address.
10. The network device of claim 7 , wherein the virtual router is further configured:
update a next hop field of forwarding information specifying the IP address of the host device as a destination IP address with the determined virtual source MAC address.
11. The network device of claim 7 , wherein the host device is configured with the IP address as a default gateway address.
12. The network device of claim 7 , wherein the one or more processors are configured to execute a plurality of virtual routers, including the virtual router, in accordance with VRRP.
13. A non-transitory computer-readable storage medium comprising instructions for causing at least one programmable processor of a network device to execute a virtual router, wherein the instructions that cause the at least one programmable processor to execute the virtual router comprise instructions that cause the virtual router to:
receive an Address Resolution Protocol (ARP) request for a Internet protocol (IP) address of a host device, the IP address comprising a virtual IP address of the virtual router;
determine a virtual router redundancy protocol (VRRP) virtual router identifier (VRID) associated with the IP address; and
generate a mapping between the IP address of the host device and the determined VRID for forwarding packets to the host device;
receive a first packet including a destination IP address field specifying the IP address of the host device;
determine, based on the mapping, a virtual source MAC address of the virtual router that is based on the VRID associated with the IP address of the host device; and
forward a second packet to the host device, the second packet specifying the determined virtual source MAC address as a source MAC address for the second packet, and the second packet including a payload of the first packet.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions to determine the virtual source MAC address of the virtual router based on the mapping further comprise instructions to:
determine the virtual source MAC address comprising a pre-determined byte address prefix and the VRID in a last byte of the virtual source MAC address.
15. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions to forward the second packet to the host device comprise instructions to:
update a source MAC address field of the data packet to specify the virtual source MAC address.
16. The non-transitory computer-readable storage medium of claim 13 , further comprising instructions to:
update a next hop field of forwarding information specifying the IP address of the host device as a destination IP address with the determined virtual source MAC address.
17. The non-transitory computer-readable storage medium of claim 13 , wherein the host device is configured with the IP address as a default gateway address.
18. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions that cause the at least one programmable processor to execute the virtual router comprise instructions that cause the at least one programmable processor to execute a plurality of virtual routers including the virtual router, in accordance with VRRP.