Configuring VRRP

Contents

1Overview
1.1Preemption
1.2Fast Advertisements
1.3Core Interface Tracking
1.4IP Network Prefix Tracking
1.5BFD Liveliness Detection
1.6Typical VRRP Scenarios

2

Configuration and Operations Tasks
2.1Configuring a VRRP Owner Router
2.2Configuring a VRRP Backup Router
2.3Enabling BFD Liveliness Detection on a Backup VRRP Router
2.4Enabling IP Network Prefix Tracking
2.5VRRP Operations

3

Configuration Examples
3.1Basic VRRP
3.2Mutual VRRP
3.3Mutual VRRP on Different Subnets
3.4Mutual VRRP on Multiple Subnets
3.5MD5 Authentication
3.6BFD Liveliness Detection
3.7IP Network Prefix Tracking
Copyright

© Ericsson AB 2009–2011. All rights reserved. No part of this document may be reproduced in any form without the written permission of the copyright owner.

Disclaimer

The contents of this document are subject to revision without notice due to continued progress in methodology, design and manufacturing. Ericsson shall have no liability for any error or damage of any kind resulting from the use of this document.

Trademark List
SmartEdge is a registered trademark of Telefonaktiebolaget LM Ericsson.
NetOp is a trademark of Telefonaktiebolaget LM Ericsson.

1   Overview

This document provides an overview of the Virtual Router Redundancy Protocol (VRRP) and describes the tasks and commands used to configure, monitor, troubleshoot, and administer VRRP features through the SmartEdge® router.

VRRP eliminates the single point of failure that is common in the static default-routed environment and provides a higher-availability default path without requiring the configuration of dynamic routing or router discovery protocols on every end host.

VRRP works by dynamically assigning responsibility for a virtual router to a VRRP router on a LAN. A virtual router is defined by its virtual router identifier (VRID) and a set of IP addresses. Two types of VRRP routers exist—owner and backup. The VRRP router controlling the IP addresses associated with a virtual router is called the owner, and it forwards packets sent to the IP addresses.

If the VRRP router owns the IP address of the VRRP instance (in other words, the VRRP IP address is configured as an address for a logical interface on the same router), the VRRP router is the master of any virtual router associated with the IP addresses configured in the VRRP instance.

Each VRRP router has a single well-known medium access control (MAC) address allocated to it. The MAC address is used as the source in all periodic VRRP messages sent by the owner router, enabling bridge learning in an extended LAN. Any of the LAN IP addresses for a virtual router can then be used as the default first-hop router by end hosts. When VRRP is configured on multiple virtual LANs (VLANs) on the same Ethernet port, unique VRIDs must be used on each VLAN to allow MAC-level filtering to be done on a port basis.

A VRRP router can associate a virtual router with its real addresses on an interface and can also be configured with additional virtual router mapping and priorities for virtual routers that it backs up. The mapping between VRIDs and addresses must be coordinated among all VRRP routers on a LAN. However, no restriction exists for reusing a VRID with a different address mapping on different LANs. The scope of each virtual router is restricted to a single LAN.

1.1   Preemption

When preemption is enabled on a backup router, a server with high priority tries to preempt a lower-priority VRRP master as quickly as possible. However, after the connection has been reestablished, an interval may occur before all the routing protocols have converged; therefore, it may not be desirable for preemption to take place immediately. You can configure a preemption hold time that allows the higher-priority server to wait before trying to preempt the current master while the system completely converges.

A VRRP master router that is also configured as an owner can never be preempted by another router, and always advertises a VRRP priority of 255. The priority of 255 is reserved for the owner VRRP router.

Note:  
If a master VRRP router is configured as a backup VRRP router, it does not advertise a VRRP priority of 255. Instead, it advertises a user-specified VRRP priority (configured with the priority command).

If a failure occurs in a master VRRP router, a backup router takes over until the master VRRP router comes back up. In such cases, the master VRRP router immediately preempts the backup router; if a preempt hold time is configured on the master VRRP router, it is ignored.

To minimize network traffic, only the owner for each virtual router sends periodic VRRP advertisement messages. A backup router does not attempt to preempt the owner unless it has higher priority, eliminating service disruption unless a more preferred path is available. The one exception is that a VRRP router always becomes the owner of any virtual router associated with addresses it owns. If the owner becomes unavailable and preemption is disabled, the highest-priority backup router transitions to owner status after a short delay, thus providing a controlled transition of the virtual router responsibility with minimal service interruption.

1.2   Fast Advertisements

Because VRRP is a redundancy mechanism, it is desirable to reduce as much as possible the window during which forwarding is not possible when the master router fails. This interval depends mostly on the time it takes for the backup router to detect that the master has failed and subsequently take over mastership. This release introduces the ability to send advertisements at subsecond intervals, which minimizes the time required for VRRP backup routers to detect the failure of the master.

This feature is supported only for IPv4. If millisecond granularity is configured, VRRP authentication is not supported.

Note:  
The fast advertisement feature is supported on PPA2+ cards only.

1.3   Core Interface Tracking

A VRRP router is elected master by considering the configured priority of the router plus various other tie-breaking selection criteria. Among the selection criteria may be the status of various links, including the status of important non-VRRP interfaces. The ability to associate the state of other interfaces with VRRP status is called core interface tracking. In this release, the SmartEdge router can track up to 10 core interfaces for each VRRP group. When this feature is enabled, the VRRP priority of a router dynamically changes according to the availability of the tracked interfaces. If the new priority of a master reaches zero or less, the master abdicates by sending an advertisement with zero priority.

Note:  
Interface tracking is supported on backup VRRP routers only.

1.4   IP Network Prefix Tracking

A backup VRRP router can be configured to track a network through the IP network prefix of that network. VRRP IP network prefix tracking prevents traffic loss by detecting connectivity failures; a backup VRRP router can track up to ten IP network prefixes. When a change occurs in an IP network prefix that is tracked (for example, when a backup VRRP router loses connectivity to a neighbor network), the RIB on the backup router updates VRRP and the priority of the backup VRRP router is decremented by the amount configured with the track network command. The backup VRRP router learns about network connectivity failures through regular routing updates to the router.

When a network regains reachability, the VRRP router reverts to its original priority. A change in router priority can cause a master VRRP router to become a backup VRRP router, and a backup to become a master.

Note:  
IP network prefix tracking is supported on backup VRRP routers only.

1.5   BFD Liveliness Detection

If BFD is enabled on a backup VRRP router, that router uses BFD to monitor the state of the master VRRP router. During an XCRP switchover, the BFD session on the backup VRRP router triggers an early switchover. In such instances, the backup VRRP router takes over as the master router without waiting for three advertisement intervals to pass, as is typical. Use the bfd-monitoring neighbor command in VRRP configuration mode to enable BFD liveliness detection on a backup VRRP router.

During a switchover, traffic may be lost for up to three VRRP advertisement intervals because the standby XCRP does not support VRRP in hot standby mode. If the VRRP advertisement interval has been configured in milliseconds (with the advertise interval command), the interval reverts to the default value where VRRP advertisements are sent every second.

Note:  
For BFD liveliness detection to work, BFD must be enabled on the VRRP interface that connects the master and backup VRRP routers. Be aware that BFD liveliness detection is supported on backup VRRP routers only.

1.6   Typical VRRP Scenarios

The typical operational scenarios are defined as two redundant routers, multiple routers with distinct path preferences among each router, or a combination of both. When more than two redundant paths have equal preference, duplicate packets may be forwarded for a brief period during owner election. However, typical operational scenarios cover most deployments. Loss of the owner router is infrequent, and the expected duration in owner election convergence is minimal (less than one second). These VRRP optimizations represent significant simplifications in the protocol design, while incurring an insignificant probability of brief network degradation.

The SmartEdge router supports a standard authentication method plus a proprietary Message Digest 5 (MD5) method, providing simple deployment in insecure environments, added protection against misconfiguration, and strong sender authentication in security-conscious environments.

For more details on VRRP, see RFC 2338, Virtual Router Redundancy Protocol.

2   Configuration and Operations Tasks

Note:  
In this section, the command syntax in the task tables displays only the root command.

2.1   Configuring a VRRP Owner Router

To configure a VRRP owner router, perform the tasks described in Table 1. Enter all commands in VRRP configuration mode, unless otherwise noted.

Table 1    Configure a VRRP Owner Router

Task

Root Command

Notes

Enter VRRP configuration mode and configure the VRRP ID.

vrrp

Enter this command in interface configuration mode. Use the following command syntax:


vrrprouter-idowner

Configure the interval at which VRRP advertisements are sent out from the specified interface.

advertise-interval

Use the following syntax to set the interval in seconds:


advertise-interval interval


Use the following syntax to set the interval in milliseconds:


advertise-interval millisecond interval


The advertise-interval command is available for PPA2 cards only.

Configure authentication of VRRP exchanges.

authentication (VRRP)

Configure VRID instance state change logging.

log-state-change

 

Configure the virtual IP address for the VRRP interface.

virtual-address

2.2   Configuring a VRRP Backup Router

To configure a VRRP backup router, perform the tasks described in Table 2. Enter all commands in VRRP configuration mode, unless otherwise noted.

Table 2    Configure a VRRP Backup Router

Task

Root Command

Notes

Enter VRRP configuration mode and configure the VRRP ID.

vrrp

Enter this command in interface configuration mode. Use the following command syntax:


vrrprouter-idbackup

Configure the interval at which VRRP advertisements are sent out from the specified interface.

advertise-interval

Configure authentication of VRRP exchanges.

authentication (VRRP)

Configure BFD-liveliness detector.

bfd-monitoring

See Section 2.3.

Configure routes connected to a specified virtual IP address in the routing table of the current VRRP routing context.

connected-route

Configure VRID wait interval prior to advancing from the initial state.

init-wait

 

 

log-state-changes (VRRP)

 

Enable a higher priority VRRP backup router to preempt a lower priority VRRP master.

preempt

Configure VRRP owner election priority for a backup virtual router.

priority

Enable core interface tracking on the VRRP instance.

track interface

To track multiple interfaces, each interface to be tracked must be specified by a separate command entry.

Enable core network tracking on the VRRP instance.

track network

See Section 2.4 for details

Configure the virtual IP address of the VRRP interface.

virtual-address

2.3   Enabling BFD Liveliness Detection on a Backup VRRP Router

To enable BFD liveliness detection on a backup VRRP router, perform the tasks described in Table 3.

Table 3    Enabling BFD Liveliness Detection

Step

Task

Root Command

Notes

Enable BFD on the next hop neighbor you want to track.

1.

Enter BFD router configuration mode.

router bfd

Enter this command in context configuration mode.

2.

Enable BFD for the next hop neighbor and enter interface configuration mode for the interface that connects the master and backup VRRP routers.

interface {if-name | ip-addr}

Use the if-name or ip-addr argument to specify the name or IP address of the interface on which you want to enable BFD.


Be aware that BFD liveliness detection only works if BFD is enabled on the VRRP interface that connects the master and backup VRRP routers

Enable BFD liveliness detection on a backup VRRP router.

3.

Enter context configuration mode.

context

Enter this command in global configuration mode.

4.

Enter BFD interface configuration mode.

interfaceif-name

Use the if-name argument to specify the name of the interface on which you want to enable BFD liveliness detection. This is the interface you configured in step 2.

5.

Enters VRRP configuration mode for a backup router.

vrrp router-id backup

Replace router-id with virtual router ID for the backup router you want to configure. Range is 1 to 255.

6.

Enables BFD liveliness detection for the specified neighbor.

bfd-monitoring neighbor ip-addr

Replace ip-addr with the IP address of the BFD neighbor you want to track.


An individual VRRP instance can monitor up to 3 BFD neighbors.

7.

Enable BFD liveliness detection for additional neighbors.

bfd-monitoring neighbor ip-addr

2.4   Enabling IP Network Prefix Tracking

To enable IP network prefix tracking on a backup VRRP router, perform the tasks described in Table 4.

Table 4    Enabling IP Network Prefix Tracking

Task

Root Command

Notes

Enter context configuration mode.

context

Enter this command in global configuration mode.

Enter interface configuration mode.

interface {if-name | ip-addr}

Use the if-name or ip-addr argument to specify the name or IP address of the interface to be used to track an IP network prefix.

Enters VRRP configuration mode for a backup router.

vrrprouter-id backup

Replace router-id with virtual router ID for the backup router you want to configure. Range is 1 to 255.

Enable the backup VRRP router to track a specified network through the IP network prefix of that network.

track network ip-addr [decrementpriority]

Replace ip-addr with the IP address of the network to be tracked by the VRRP instance.


Use the optional priority argument to specify the amount by which the priority of the VRRP instance is decremented if the specified network becomes unreachable. The default priority value is 10.


A single backup VRRP router can track up to ten IP network prefixes.

2.5   VRRP Operations

To manage VRRP functions, perform the appropriate tasks described in Table 5. Enter the show command (in any mode); enter the clear and debug commands in exec mode.

Table 5    VRRP Operations Tasks

Task

Root Command

Clear VRRP Statistics.

clear vrrp statistics

Enable the Generation of VRRP Debug Messages.

debug vrrp

Display VRRP Route Information.

show vrrp

3   Configuration Examples

The examples that follow show how to configure VRRP.

3.1   Basic VRRP

The snapshots that follow are from two configuration files that configure two routers running VRRP on a single interface, with the SE2 router backing up the SE1 router.

The SE1 router configuration is as follows:

[local]SE1(config)#context local 

[local]SE1(config-ctx)#interface one 

[local]SE1(config-if)#ip address 10.1.1.1/24 

[local]SE1(config-if)#vrrp 1 owner 

[local]SE1(config-vrrp)#virtual-address 10.1.1.1 

[local]SE1(config-vrrp)#exit 

[local]SE1(config-if)#exit 

[local]SE1(config-ctx)#exit 

[local]SE1(config)#port ethernet 7/2 

[local]SE1(config-port)#bind interface one local 

[local]SE1(config-port)#no shutdown 

The SE2 router configuration is as follows:

[local]SE2(config)#context local 

[local]SE2(config-ctx)#interface one 

[local]SE2(config-if)#ip address 10.1.1.2/24 

[local]SE2(config-if)#vrrp 1 backup 

[local]SE2(config-if-vrrp)#virtual-address 10.1.1.1 

[local]SE2(config-vrrp)#exit 

[local]SE2(config-if)#exit 

[local]SE2(config-ctx)#exit 

[local]SE2(config)#port ethernet 7/2 

[local]SE2(config-port)#bind interface one local 

[local]SE2(config-port)#no shutdown 

3.2   Mutual VRRP

The snapshots that follow are from two configuration files that configure two routers running VRRP on a single interface, with the two routers backing up each other.

The SE1 router configuration is as follows:

[local]SE1(config)#context local 

[local]SE1(config-ctx)#interface one 

[local]SE1(config-if)#ip address 10.1.1.1/24 

[local]SE1(config-if)#vrrp 1 owner 

[local]SE1(config-vrrp)#virtual-address 10.1.1.1 

[local]SE1(config-vrrp)#exit 

[local]SE1(config-if)#vrrp 2 backup 

[local]SE1(config-vrrp)#virtual-address 10.1.1.2 

[local]SE1(config-vrrp)#exit 

[local]SE1(config-if)#exit 

[local]SE1(config-ctx)#exit 

[local]SE1(config)#port ethernet 7/2 

[local]SE1(config-port)#bind interface one local 

[local]SE1(config-port)#no shutdown 

The SE2 router configuration is as follows:

[local]SE2(config)#context local 

[local]SE2(config-ctx)#interface one 

[local]SE2(config-if)#ip address 10.1.1.2/24 

[local]SE2(config-if)#vrrp 1 backup 

[local]SE2(config-vrrp)#virtual-address 10.1.1.1 

[local]SE2(config-vrrp)#exit 

[local]SE2(config-if)#vrrp 2 owner 

[local]SE2(config-vrrp)#virtual-address 10.1.1.2 

[local]SE2(config-vrrp)#exit 

[local]SE2(config-if)#exit 

[local]SE2(config-ctx)#exit 

[local]SE2(config)#port ethernet 7/2 

[local]SE2(config-port)#bind interface one local 

[local]SE2(config-port)#no shutdown 

3.3   Mutual VRRP on Different Subnets

The snapshots that follow are from two configuration files that configure two routers running VRRP on a single interface, with the two routers backing up each other on different subnets.

The SE1 router configuration is as follows:

[local]SE1(config)#context local 

[local]SE1(config-ctx)#interface one 

[local]SE1(config-if)#ip address 10.1.1.1/24 

[local]SE1(config-if)#ip address 20.1.1.1/24 secondary 

[local]SE1(config-if)#vrrp 1 owner 

[local]SE1(config-vrrp)#virtual-address 10.1.1.1 

[local]SE1(config-vrrp)#exit 

[local]SE1(config-if)#vrrp 2 backup 

[local]SE1(config-vrrp)#virtual-address 20.1.1.2 

[local]SE1(config-vrrp)#exit 

[local]SE1(config-if)#exit 

[local]SE1(config-ctx)#exit 

[local]SE1(config)#port ethernet 7/2 

[local]SE1(config-port)#bind interface one local 

[local]SE1(config-port)#no shutdown 

The SE2 router configuration is as follows:

[local]SE2(config)#context local 

[local]SE2(config-ctx)#interface one 

[local]SE2(config-if)#ip address 10.1.1.2/24 

[local]SE2(config-if)#ip address 20.1.1.2/24 secondary 

[local]SE2(config-if)#vrrp 1 backup 

[local]SE2(config-vrrp)#virtual-address 10.1.1.1 

[local]SE2(config-vrrp)#exit 

[local]SE2(config-if)#vrrp 2 owner 

[local]SE2(config-vrrp)#virtual-address 20.1.1.2 

[local]SE2(config-vrrp)#exit 

[local]SE2(config-if)#exit 

[local]SE2(config-ctx)#exit 

[local]SE2(config)#port ethernet 7/2 

[local]SE2(config-port)#bind interface one local 

[local]SE2(config-port)#no shutdown 

3.4   Mutual VRRP on Multiple Subnets

The following snapshots from three configuration files configure three routers running VRRP on a single interface, with the routers backing up each other on different subnets. For each subnet, there is an owner and two backups. Using VRRP priority, one backup is preferred over another.

The SE1 router configuration is as follows:

[local]SE1(config)#context local 

[local]SE1(config-ctx)#interface one 

[local]SE1(config-if)#ip address 10.1.1.1/24 

[local]SE1(config-if)#ip address 20.1.1.1/24 secondary 

[local]SE1(config-if)#ip address 30.1.1.1/24 secondary 

[local]SE1(config-if)#vrrp 1 owner 

[local]SE1(config-vrrp)#virtual-address 10.1.1.1 

[local]SE1(config-vrrp)#exit 

[local]SE1(config-if)#vrrp 2 backup 

[local]SE1(config-vrrp)#virtual-address 20.1.1.2 

[local]SE1(config-vrrp)#priority 100 

[local]SE1(config-vrrp)#exit 

[local]SE1(config-if)#vrrp 3 backup 

[local]SE1(config-vrrp)#virtual-address 30.1.1.3 

[local]SE1(config-vrrp)#priority 200 

[local]SE1(config-vrrp)#exit 

[local]SE1(config-if)#exit 

[local]SE1(config-ctx)#exit 

[local]SE1(config)#port ethernet 7/2 

[local]SE1(config-port)#bind interface one local 

[local]SE1(config-port)#no shutdown 

The SE2 router configuration is as follows:

[local]SE2(config)#context local 

[local]SE2(config-ctx)#interface one 

[local]SE2(config-if)#ip address 10.1.1.2/24 

[local]SE2(config-if)#ip address 20.1.1.2/24 secondary 

[local]SE2(config-if)#ip address 30.1.1.2/24 secondary 

[local]SE2(config-if)#vrrp 1 backup 

[local]SE2(config-vrrp)#virtual-address 10.1.1.1 

[local]SE2(config-vrrp)#priority 200 

[local]SE2(config-vrrp)#exit 

[local]SE2(config-if)#vrrp 2 owner 

[local]SE2(config-vrrp)#virtual-address 20.1.1.2 

[local]SE2(config-vrrp)#exit 

[local]SE2(config-if)#vrrp 3 backup 

[local]SE2(config-vrrp)#virtual-address 30.1.1.3 

[local]SE2(config-vrrp)#priority 100 

[local]SE2(config-vrrp)#exit 

[local]SE2(config-if)#exit 

[local]SE2(config-ctx)#exit 

[local]SE2(config)#port ethernet 7/2 

[local]SE2(config-port)#bind interface one local 

[local]SE2(config-port)#no shutdown 

The SE3 router configuration is as follows:

[local]SE3(config)#context local 

[local]SE3(config-ctx)#interface one 

[local]SE3(config-if)#ip address 10.1.1.3/24 

[local]SE3(config-if)#ip address 20.1.1.3/24 secondary 

[local]SE3(config-if)#ip address 30.1.1.3/24 secondary 

[local]SE3(config-if)#vrrp 1 backup 

[local]SE3(config-vrrp)#virtual-address 10.1.1.1 

[local]SE3(config-vrrp)#priority 100 

[local]SE3(config-vrrp)#exit 

[local]SE3(config-if)#vrrp 2 backup 

[local]SE3(config-vrrp)#virtual-address 20.1.1.2 

[local]SE3(config-vrrp)#priority 200 

[local]SE3(config-vrrp)#exit 

[local]SE3(config-if)#vrrp 3 owner 

[local]SE3(config-vrrp)#virtual-address 30.1.1.3 

[local]SE3(config-vrrp)#exit 

[local]SE3(config-if)#exit 

[local]SE3(config-ctx)#exit 

[local]SE3(config)#port ethernet 7/2 

[local]SE3(config-port)#bind interface one local 

[local]SE3(config-port)#no shutdown 

3.5   MD5 Authentication

The following snapshots (from two configuration files) configure two routers running VRRP on a single interface using MD5 authentication.

The SE1 router configuration is as follows:

[local]SE1(config)#context local 

[local]SE1(config-ctx)#interface one 

[local]SE1(config-if)#ip address 10.1.1.1/24 

[local]SE1(config-if)#vrrp 1 owner 

[local]SE1(config-vrrp)#authentication redback-md5 rbak-md5-chain

[local]SE1(config-vrrp)#exit 

[local]SE1(config-if)#exit 

[local]SE1(config-ctx)#key-chain rbak-md5-chain key-id 1 

[local]SE1(config-key-chain)#key-string secret 

[local]SE1(config-key-chain)#exit 

[local]SE1(config-ctx)#exit 

[local]SE1(config)#port ethernet 7/2 

[local]SE1(config-port)#bind interface one local 

[local]SE1(config-port)#no shutdown 

The SE2 router configuration is as follows:

[local]SE2(config)#context local 

[local]SE2(config-ctx)#interface one 

[local]SE2(config-if)#ip address 10.1.1.2/24 

[local]SE2(config-if)#vrrp 1 backup 

[local]SE2(config-vrrp)#virtual-address 10.1.1.1 

[local]SE2(config-vrrp)#authentication redback-md5 rbak-md5-chain 

[local]SE2(config-vrrp)#exit 

[local]SE2(config-if)#exit 

[local]SE2(config-ctx)#key-chain rbak-md5-chain key-id 1 

[local]SE2(config-key-chain)#key-string secret 

[local]SE2(config-key-chain)#exit 

[local]SE2(config-ctx)#exit 

[local]SE2(config)#port ethernet 7/2 

[local]SE2(config-port)#bind interface one local 

[local]SE2(config-port)#no shutdown 

3.6   BFD Liveliness Detection

The following snapshot enables BFD on the interface called vlan1, and configures the backup VRRP router 1 to track the neighbors with the IP addresses of129.100.0.1 and 129.100.0.3.

[local]SE1(config)#context local 
[local]SE1(config-ctx)#router bfd
[local]SE1(config-bfd)#interface vlan1 
[local]SE1(config-bfd-if)#commit
[local]SE1(config-bfd-if)#exit
[local]SE1(config-bfd)#exit
[local]SE1(config-ctx)#interface vlan1
[local]SE1(config-if)#ip address 129.100.0.3/16
[local]SE1(config-if)#ip access-group vlan in count
[local]SE1(config-if)#vrrp 1 backup
[local]SE1(config-vrrp)#virtual-address 129.100.0.1

[local]SE1(config-vrrp)#bfd-monitoring neighbor 129.100.0.1
[local]SE1(config-vrrp)#bfd-monitoring neighbor 129.100.0.2

3.7   IP Network Prefix Tracking

The following snapshot configures the backup VRRP router 1 to track the network with the IP network prefix 192.168.100.1/24. In this example, the priority of VRRP router 1 is decremented by 100 if the network with the IP network prefix 192.168.100.1/24 cannot be reached.

[local]SE1(config)#context local 
[local]SE1(config-ctx)#interface vlan1 
[local]SE1(config-if)#ip address 120.100.0.2/16 
[local]SE1(config-if)#ip access-group vlan in count 
[local]SE1(config-if)#vrrp 1 backup

[local]SE1(config-vrrp)#priority 250
[local]SE1(config-vrrp)#preempt hold-time 180
[local]SE1(config-vrrp)#track network 192.168.100.1/24 decrement 100