A YANG Data Model for the Virtual Router Redundancy Protocol (VRRP)
Arrcus, Inc.301 Midenhall WayCaryNC27513United States of Americaacee.ietf@gmail.comIndividualUnited States of Americaxufeng.liu.ietf@gmail.comJabil8281 Greensboro Drive, Suite 200McLeanVA22102United States of AmericaAthanasios_Kyparlis@jabil.comZooxUnited States of Americaparikh_ravi@ymail.comChina Tower9 Dongranbeijie Haidian DistrictBeijingChinazhangmg3@chinatowercom.cnNetwork ManagementRoutingYANG
This document describes a YANG data model for the Virtual Router Redundancy
Protocol (VRRP). Both versions 2 and 3 of VRRP are covered.
The VRRP terminology has been updated to conform to inclusive language
guidelines for IETF technologies.
This document obsoletes RFC 8347.
This document introduces a YANG data model
for the Virtual Router Redundancy Protocol
(VRRP) , . VRRP provides
higher resiliency by specifying an election protocol that dynamically
assigns responsibility for a virtual router to one of the VRRP routers
on a LAN.
The YANG module specified in this document supports both
versions 2 and 3 of VRRP. VRRP version 2 (defined
in ) supports IPv4. VRRP version 3
(defined in ) supports both IPv4 and IPv6.
The VRRP terminology has been updated to conform to inclusive language
guidelines for IETF technologies.
This document obsoletes VRRP Version 3 .
The following changes have been made consistent with IETF inclusive
language guidelines:
The typedef "new-master-reason-type" was changed to
"new-active-reason-type". The associated descriptive text
was also updated.
The enum "not-master" was changed to "not-active".
The associated descriptive text was also updated.
The descriptive text for enum "preempted" was updated.
The descriptive text for enum "no-response" was updated.
The identity "vrrp-event-master-timeout" was changed to
"vrrp-event-active-timeout". The associated descriptive text
was also updated.
The identity "vrrp-event-lower-priority-master" was changed to
"vrrp-event-lower-priority-active". The associated descriptive text
was also updated.
The descriptive text for identity "vrrp-event-higher-priority-backup"
was updated.
The descriptive text for identify "vrrp-event-owner-prempt" was updated.
The descriptive text for identity "backup" was updated.
The identity "master" was changed to "active".
The associated descriptive text was also updated.
The descriptive text for container "preempt" was updated.
The descriptive text for leaf "hold-time" was updated.
The descriptive text for leaf "accept-mode" was updated.
The leaf "master-down-interval" was changed to
"active-down-interval". The associated descriptive text was also updated.
The leaf "new-master-reason" was changed to "new-active-reason".
The associated descriptive text was also updated.
The leaf "new-master-reason" was changed to "new-active-reason".
The associated descriptive text was also updated.
The leaf "master-transitions" was changed to "active-transitions".
The associated descriptive text was also updated.
The notification "vrrp-new-master-event" was changed to
"vrrp-new-active-event". The associated descriptive text was also updated.
The notification leaf "master-ip-address" was changed to "active-ip-address".
The associated descriptive text was also updated.
The notification leaf "new-master-reason" was changed to
"new-active-reason". The associated descriptive text was also updated.
The following additions have been made to the ietf-vrrp module:
The leaf "effective-priority" was add to the grouping
"grouping vrrp-state-attributes" to reflect the effective priority due
to the VRRP router owning the address or any local policy adjusting the
priority.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL",
"SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED",
"NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document
are to be interpreted as described in BCP 14
when,
and only when, they appear in all capitals, as shown here.
The following terms are defined in and
are not redefined here:
augment
data node
A simplified graphical representation of the data model is used in
this document. The meaning of the symbols in these diagrams is
defined in .
In this document, names of data nodes, actions, and other data model
objects are often used without a prefix, as long as it is clear from
the context in which YANG module each name is defined. Otherwise,
names are prefixed using the standard prefix associated with the
corresponding YANG module, as shown in .
Prefixes and Corresponding YANG Modules
Prefix
YANG module
Reference
yang
ietf-yang-types
inet
ietf-inet-types
if
ietf-interfaces
ip
ietf-ip
The model covers VRRP version 2 and VRRP
version 3 . The model is designed to be implemented
on a device where VRRP version 2 or 3 is implemented. With the
help of a proper management protocol, the defined model can be
used to:
Configure VRRP version 2 or 3.
Manage the protocol operational behavior.
Retrieve the protocol operational status.
Receive the protocol notifications.
This model augments the interface data model "ietf-interfaces"
and the IP management model "ietf-ip"
. The augmentation relationships are shown
as follows:
In , a tree node without a prefix is from the model
"ietf-interfaces". A tree node with prefix "ip" is from the model
"ietf-ip". A tree node with prefix "vrrp" is from the VRRP model
specified in this document.
The "vrrp" container contains a list of "vrrp-instance" nodes,
which are instantiated under an interface for a specified address
family (IPv4 or IPv6).
Each "vrrp-instance" node represents a VRRP router state machine, as
described in Section 6.4 of , providing
the configuration and state information for the election process of a
virtual router. The IP addresses on the augmented interface are
the real addresses through which the VRRP router operates. The
IPv4 or IPv6 address or addresses associated with a virtual router
(described in Section 1 of ) are modeled
as a list of IPv4 or IPv6 addresses under the "vrrp-instance".
The model structure for the protocol configuration is depicted in
.
The model allows the following protocol entities to be managed:
VRRP instance (version 2 or 3), representing a VRRP router.
Virtual IPv4 or IPv6 address associated with a virtual router.
Tracking interface, to detect interface connectivity failures.
Tracking network, to detect network connectivity failures.
The model structure for the protocol states is depicted
in .
This model conforms to the Network Management Datastore
Architecture (NMDA) .
The operational state data is combined with the associated
configuration data in the same hierarchy
. When protocol states
are retrieved from the NMDA operational state datastore, the
returned states cover all "config true" (rw) and "config false"
(ro) nodes defined in the schema.
The model allows the retrieval of protocol states at the following levels:
VRRP instance (version 2 or 3), representing a VRRP router.
Virtual IPv4 or IPv6 address associated with a virtual router.
Tracking interface, to detect interface connectivity failures.
Tracking network, to detect network connectivity failures.
Global states and statistics summarizing all instances.
This model defines the following VRRP-specific notifications ():
Each notification type is used to indicate a type of VRRP state
change or error occurrence:
"vrrp-new-active-event"
VRRP new active event, indicating that a new active virtual router has been elected.
"vrrp-protocol-error-event"
VRRP protocol error event for a message that fails to reach a VRRP
instance to be processed.
"vrrp-virtual-router-error-event"
VRRP virtual router error event for a message processed on a VRRP
instance.
In addition to the notifications specified above, the mechanisms
defined in and
can be used for other general notifications.
These mechanisms currently allow the user to:
Subscribe notifications on a per-client basis.
Specify subtree filters or XML Path Language (XPath) filters
so that only contents of interest will be sent.
Specify either periodic or on-demand notifications.
The VRRP YANG data model defined in this document has the
following tree structure ():
This module references
,
, and
.
file "ietf-vrrp@2026-02-13.yang"
module ietf-vrrp {
yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-vrrp";
prefix vrrp;
import ietf-inet-types {
prefix inet;
reference
"RFC 9911: Common YANG Data Types, Section 4";
}
import ietf-yang-types {
prefix yang;
reference
"RFC 9911: Common YANG Data Types, Section 3";
}
import ietf-interfaces {
prefix if;
reference
"RFC 8343: A YANG Data Model for Interface Management";
}
import ietf-ip {
prefix ip;
reference
"RFC 8344: A YANG Data Model for IP Management";
}
organization
"IETF Routing Area Working Group (RTGWG)";
contact
"WG Web:
WG List:
Editor: Acee Lindem
Editor: Xufeng Liu
Editor: Athanasios Kyparlis
Editor: Ravi Parikh
Editor: Mingui Zhang
";
description
"This YANG module defines a model for managing Virtual Router
Redundancy Protocol (VRRP) versions 2 and 3.
Copyright (c) 2026 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject to
the license terms contained in, the Revised BSD License set
forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(https://trustee.ietf.org/license-info).
All revisions of IETF and IANA published modules can be found
at the YANG Parameters registry group
(https://www.iana.org/assignments/yang-parameters).
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
'MAY', and 'OPTIONAL' in this document are to be interpreted as
described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
they appear in all capitals, as shown here.
This version of this YANG module is part of RFC XXXX; see
the RFC itself for full legal notices.";
revision 2026-02-13 {
description
"This revision includes the following changes:
- Update some identifiers and descriptions to conform
to the changes in RFC 9586
- Add a new effective-priority leaf
- Update some reference statements";
reference
"RFC XXXX: A YANG Data Model for the Virtual Router Redundancy
Protocol (VRRP)";
}
revision 2018-03-13 {
description
"Initial revision.";
reference
"RFC 8347: A YANG Data Model for the Virtual Router Redundancy
Protocol (VRRP)";
}
/*
* Features
*/
feature validate-interval-errors {
description
"This feature indicates that the system validates that the
advertisement interval from advertisement packets received
is the same as the interval configured for the local
VRRP router.";
}
feature validate-address-list-errors {
description
"This feature indicates that the system validates that
the address list from received packets matches the
locally configured list for the VRRP router.";
}
/*
* Typedefs
*/
typedef new-active-reason-type {
type enumeration {
enum not-active {
description
"The virtual router has never transitioned to active
state.";
}
enum priority {
description
"Priority was higher.";
}
enum preempted {
description
"The active virtual router was preempted.";
}
enum no-response {
description
"Previous active virtual router did not respond.";
}
}
description
"Indicates why the virtual router has transitioned to
active state.
The identifier of this typedef is changed to reflect
the updated terminology used in RFC 9568.";
} // new-active-reason-type
/*
* Identities
*/
/* vrrp-event-type identity and its derivatives. */
identity vrrp-event-type {
description
"Indicates the type of a VRRP protocol event.";
}
identity vrrp-event-none {
base vrrp-event-type;
description
"Indicates a non-meaningful event.";
}
identity vrrp-event-startup {
base vrrp-event-type;
description
"Indicates that a VRRP router has initiated the protocol.";
}
identity vrrp-event-shutdown {
base vrrp-event-type;
description
"Indicates that a VRRP router has closed down the protocol.";
}
identity vrrp-event-higher-priority-backup {
base vrrp-event-type;
description
"Indicates that a backup router has a higher priority than
the current active.";
}
identity vrrp-event-active-timeout {
base vrrp-event-type;
description
"Indicates that the current active virtual router has not sent
an advertisement within the limit of active-down-interval.
The identity is changed to reflect the updated terminology
used in RFC 9568.";
}
identity vrrp-event-interface-up {
base vrrp-event-type;
description
"Indicates that the VRRP-enabled interface has become
'operational up'.";
}
identity vrrp-event-interface-down {
base vrrp-event-type;
description
"Indicates that the VRRP-enabled interface has become
'operational down'.";
}
identity vrrp-event-no-primary-ip-address {
base vrrp-event-type;
description
"Indicates that the primary IP address on the VRRP-enabled
interface has become unavailable.";
}
identity vrrp-event-primary-ip-address {
base vrrp-event-type;
description
"Indicates that the primary IP address on the VRRP-enabled
interface has become available.";
}
identity vrrp-event-no-virtual-ip-addresses {
base vrrp-event-type;
description
"Indicates that there are no virtual IP addresses on the
virtual router.";
}
identity vrrp-event-virtual-ip-addresses {
base vrrp-event-type;
description
"Indicates that there are virtual IP addresses on the
virtual router.";
}
identity vrrp-event-preempt-hold-timeout {
base vrrp-event-type;
description
"Indicates that the configured preemption hold time has
passed.";
}
identity vrrp-event-lower-priority-active {
base vrrp-event-type;
description
"Indicates that there is a lower-priority VRRP active router.
The identity is changed to reflect the updated terminology
used in RFC 9568.";
}
identity vrrp-event-owner-preempt {
base vrrp-event-type;
description
"Indicates that the owner has preempted another virtual router
to become the active virtual router.";
}
/* vrrp-error-global identity and its derivatives. */
identity vrrp-error-global {
description
"Indicates the type of a VRRP error that occurred
for a packet before it reaches a VRRP router.";
}
identity checksum-error {
base vrrp-error-global;
description
"A packet has been received with an invalid VRRP checksum
value.";
}
identity ip-ttl-error {
base vrrp-error-global;
description
"A packet has been received with IP TTL (Time-To-Live)
not equal to 255.";
}
identity version-error {
base vrrp-error-global;
description
"A packet has been received with an unknown or unsupported
version number.";
}
identity vrid-error {
base vrrp-error-global;
description
"A packet has been received with a Virtual Router Identifier
(VRID) that is not valid for any virtual router on this
router.";
}
/* vrrp-error-virtual-router identity and its derivatives. */
identity vrrp-error-virtual-router {
description
"Indicates the type of a VRRP error that occurred
after a packet reaches a VRRP router.";
}
identity address-list-error {
base vrrp-error-virtual-router;
description
"A packet has been received with an address list that
does not match the locally configured address list for
the virtual router.";
}
identity interval-error {
base vrrp-error-virtual-router;
description
"A packet has been received with an advertisement interval
different than the interval configured for the local
virtual router.";
}
identity packet-length-error {
base vrrp-error-virtual-router;
description
"A packet has been received with a packet length less
than the length of the VRRP header.";
}
/* vrrp-state-type identity and its derivatives. */
identity vrrp-state-type {
description
"Indicates the state of a virtual router.";
}
identity initialize {
base vrrp-state-type;
description
"Indicates that the virtual router is waiting
for a startup event.";
}
identity backup {
base vrrp-state-type;
description
"Indicates that the virtual router is monitoring the
availability of the active virtual router.";
}
identity active {
base vrrp-state-type;
description
"Indicates that the virtual router is forwarding
packets for IP addresses that are associated with
this virtual router.
The identity is changed to reflect the updated terminology
used in RFC 9568.";
}
/* vrrp-version identity and its derivatives. */
identity vrrp-version {
description
"The version of VRRP.";
}
identity vrrp-v2 {
base vrrp-version;
description
"Indicates version 2 of VRRP.";
}
identity vrrp-v3 {
base vrrp-version;
description
"Indicates version 3 of VRRP.";
}
/*
* Groupings
*/
grouping vrrp-common-attributes {
description
"Group of VRRP attributes common to versions 2 and 3.";
leaf vrid {
type uint8 {
range "1..255";
}
description
"Virtual Router ID (i.e., VRID).";
}
leaf version {
type identityref {
base vrrp:vrrp-version;
}
mandatory true;
description
"Version 2 or 3 of VRRP.";
}
leaf log-state-change {
type boolean;
default "false";
description
"Generates VRRP state change messages each time the
VRRP instance changes state (from 'up' to 'down'
or 'down' to 'up').";
}
container preempt {
description
"Enables a higher-priority VRRP backup router to preempt a
lower-priority VRRP active router.";
leaf enabled {
type boolean;
default "true";
description
"'true' if preemption is enabled.";
}
leaf hold-time {
type uint16;
units "seconds";
default "0";
description
"Hold time, in seconds, for which a higher-priority VRRP
backup router must wait before preempting a lower-priority
VRRP active router.";
}
}
leaf priority {
type uint8 {
range "1..254";
}
default "100";
description
"Configures the VRRP election priority for the backup
virtual router.";
}
leaf accept-mode {
when "derived-from-or-self(current()/../version,
'vrrp:vrrp-v3')" {
description
"Applicable only to version 3.";
}
type boolean;
default "false";
description
"Controls whether a virtual router in active state will
accept packets addressed to the address owner's IPvX address
as its own if it is not the IPvX address owner. The default
is 'false'. Deployments that rely on, for example, pinging
the address owner's IPvX address may wish to configure
accept-mode to 'true'.
Note: IPv6 Neighbor Solicitations and Neighbor
Advertisements MUST NOT be dropped when accept-mode
is 'false'.";
}
} // vrrp-common-attributes
grouping vrrp-ipv4-attributes {
description
"Group of VRRP attributes for IPv4.";
uses vrrp-common-attributes;
choice advertise-interval-choice {
description
"The options for the advertisement interval at which VRRPv2
or VRRPv3 advertisements are sent from the specified
interface.";
case v2 {
when "derived-from-or-self(version, 'vrrp:vrrp-v2')" {
description
"Applicable only to version 2.";
}
leaf advertise-interval-sec {
type uint8 {
range "1..254";
}
units "seconds";
default "1";
description
"Configures the interval that VRRPv2 advertisements
are sent from the specified interface.";
}
}
case v3 {
when "derived-from-or-self(version, 'vrrp:vrrp-v3')" {
description
"Applicable only to version 3.";
}
leaf advertise-interval-centi-sec {
type uint16 {
range "1..4095";
}
units "centiseconds";
default "100";
description
"Configures the interval that VRRPv3 advertisements
are sent from the specified interface.";
}
}
} // advertise-interval-choice
container track {
description
"Enables the specified VRRP instance to track interfaces
or networks.";
container interfaces {
description
"Enables the specified VRRPv2 or VRRPv3 instance to track
interfaces. Interface tracking prevents traffic loss by
detecting the availability of interfaces. The operational
states of other interfaces are associated with the
priority of a VRRP router. When a tracked interface
becomes unavailable (or 'operational down'), the priority
of the VRRP router decrements. When an unavailable
interface becomes available again, the priority of the
VRRP router is incremented by the same amount.";
list interface {
key "interface";
description
"Interface to track.";
leaf interface {
type if:interface-ref;
must '/if:interfaces/if:interface[if:name=current()]/'
+ 'ip:ipv4' {
description
"Interface is IPv4.";
}
description
"Interface to track.";
}
leaf priority-decrement {
type uint8 {
range "1..254";
}
default "10";
description
"Specifies how much to decrement the priority of the
VRRP instance if the interface goes down.";
}
} // interface
} // interfaces
container networks {
description
"Enables the VRRPv2 or VRRPv3 router instance to track the
specified networks through their IPv4 network prefixes.
Network tracking prevents traffic loss by detecting
network connectivity failure. The states of
connectivity to some networks are associated with the
priority of a VRRP router. When connectivity to a
tracked network represented by its prefix is lost, the
priority of the VRRP router decrements. When an
unavailable network is again reachable, the priority of
the VRRP router is incremented by the same amount.";
list network {
key "prefix";
description
"Enables the specified VRRPv2 or VRRPv3 instance to
track an IPv4 network by specifying the prefix of the
IPv4 network.";
leaf prefix {
type inet:ipv4-prefix;
description
"The IPv4 prefix of the network to track.";
}
leaf priority-decrement {
type uint8 {
range "1..254";
}
default "10";
description
"Specifies how much to decrement the priority of the
VRRP router if there is a failure in the IPv4
network.";
}
} // network
} // networks
} // track
container virtual-ipv4-addresses {
description
"Configures the virtual IPv4 address for the
VRRP interface.";
list virtual-ipv4-address {
key "ipv4-address";
max-elements 16;
description
"Virtual IPv4 addresses for a single VRRP instance. For a
VRRP owner router, the virtual address must match one
of the IPv4 addresses configured on the interface
corresponding to the virtual router.";
leaf ipv4-address {
type inet:ipv4-address;
description
"An IPv4 address associated with a virtual router.";
reference
"RFC 9568: Virtual Router Redundancy Protocol (VRRP)
Version 3 for IPv4 and IPv6, Section 1.3";
}
} // virtual-ipv4-address
} // virtual-ipv4-addresses
} // vrrp-ipv4-attributes
grouping vrrp-ipv6-attributes {
description
"Group of VRRP attributes for IPv6.";
uses vrrp-common-attributes;
leaf advertise-interval-centi-sec {
type uint16 {
range "1..4095";
}
units "centiseconds";
default "100";
description
"Includes the interval that VRRPv3 advertisements
are sent from the specified interface.";
}
container track {
description
"Enables the specified VRRP instance to track interfaces
or networks.";
container interfaces {
description
"Enables the specified VRRPv2 or VRRPv3 instance to track
interfaces. Interface tracking prevents traffic loss by
detecting the availability of interfaces. The operational
states of other interfaces are associated with the
priority of a VRRP router. When a tracked interface
becomes unavailable (or 'operational down'), the priority
of the VRRP router decrements. When an unavailable
interface becomes available again, the priority of the
VRRP router is incremented by the same amount.";
list interface {
key "interface";
description
"Interface to track.";
leaf interface {
type if:interface-ref;
must '/if:interfaces/if:interface[if:name=current()]/'
+ 'ip:ipv6' {
description
"Interface is IPv6.";
}
description
"Interface to track.";
}
leaf priority-decrement {
type uint8 {
range "1..254";
}
default "10";
description
"Specifies how much to decrement the priority of the
VRRP instance if the interface goes down.";
}
} // interface
} // interfaces
container networks {
description
"Enables the VRRPv2 or VRRPv3 router instance to track the
specified networks through their IPv6 network prefixes.
Network tracking prevents traffic loss by detecting
network connectivity failure. The states of
connectivity to some networks are associated with the
priority of a VRRP router. When connectivity to a
tracked network represented by its prefix is lost, the
priority of the VRRP router decrements. When an
unavailable network is again reachable, the priority of
the VRRP router is incremented by the same amount.";
list network {
key "prefix";
description
"Enables the specified VRRPv2 or VRRPv3 instance to
track an IPv6 network by specifying the prefix of the
IPv6 network.";
leaf prefix {
type inet:ipv6-prefix;
description
"The IPv6 prefix of the network to track.";
}
leaf priority-decrement {
type uint8 {
range "1..254";
}
default "10";
description
"Specifies how much to decrement the priority of the
VRRP router if there is a failure in the IPv6
network.";
}
} // network
} // networks
} // track
container virtual-ipv6-addresses {
description
"Configures the virtual IPv6 address for the
VRRP interface.";
list virtual-ipv6-address {
key "ipv6-address";
max-elements 2;
description
"Two IPv6 addresses are allowed. The first address must
be a link-local address. The second address can be a
link-local or global address.";
leaf ipv6-address {
type inet:ipv6-address;
description
"An IPv6 address associated with a virtual router.";
reference
"RFC 9568: Virtual Router Redundancy Protocol (VRRP)
Version 3 for IPv4 and IPv6, Section 1.4";
}
} // virtual-ipv6-address
} // virtual-ipv6-addresses
} // vrrp-ipv6-attributes
grouping vrrp-state-attributes {
description
"Group of VRRP state attributes.";
leaf state {
type identityref {
base vrrp:vrrp-state-type;
}
config false;
description
"Operational state.";
}
leaf is-owner {
type boolean;
config false;
description
"Set to 'true' if this virtual router is the owner.";
}
leaf effective-priority {
type uint8 {
range "1..255";
}
config false;
description
"The effect priority of the virtual router taking account
address ownership and any modifications due to
local policy.";
}
leaf last-adv-source {
type inet:ip-address;
config false;
description
"Last advertised IPv4/IPv6 source address.";
}
leaf up-datetime {
type yang:date-and-time;
config false;
description
"The date and time when this virtual router
transitioned out of 'init' state.";
}
leaf active-down-interval {
type uint32;
units "centiseconds";
config false;
description
"Time interval for the backup virtual router to declare
'active down'.
The identifier of this leaf is changed to reflect
the updated terminology used in RFC 9568.";
}
leaf skew-time {
type uint32;
units "microseconds";
config false;
description
"Calculated based on the priority and advertisement
interval configuration command parameters. See RFC 9568.";
}
leaf last-event {
type identityref {
base vrrp:vrrp-event-type;
}
config false;
description
"Last reported event.";
}
leaf new-active-reason {
type new-active-reason-type;
config false;
description
"Indicates why the virtual router has transitioned to
active state.
The identifier of this leaf is changed to reflect
the updated terminology used in RFC 9568.";
}
container statistics {
config false;
description
"VRRP statistics.";
leaf discontinuity-datetime {
type yang:date-and-time;
description
"The time on the most recent occasion at which any one or
more of the VRRP statistics counters suffered a
discontinuity. If no such discontinuities have occurred
since the last re-initialization of the local management
subsystem, then this node contains the time that the
local management subsystem re-initialized itself.";
}
leaf active-transitions {
type yang:counter32;
description
"The total number of times that this virtual router's
state has transitioned to 'Active'.
The identifier of this leaf is changed to reflect
the updated terminology used in RFC 9568.";
}
leaf advertisement-rcvd {
type yang:counter64;
description
"The total number of VRRP advertisements received by
this virtual router.";
}
leaf advertisement-sent {
type yang:counter64;
description
"The total number of VRRP advertisements sent by
this virtual router.";
}
leaf interval-errors {
if-feature "validate-interval-errors";
type yang:counter64;
description
"The total number of VRRP advertisement packets received
with an advertisement interval different than the
interval configured for the local virtual router.";
}
leaf priority-zero-pkts-rcvd {
type yang:counter64;
description
"The total number of VRRP packets received by the
virtual router with a priority of 0.";
}
leaf priority-zero-pkts-sent {
type yang:counter64;
description
"The total number of VRRP packets sent by the
virtual router with a priority of 0.";
}
leaf invalid-type-pkts-rcvd {
type yang:counter64;
description
"The number of VRRP packets received by the virtual
router with an invalid value in the 'type' field.";
}
leaf address-list-errors {
if-feature "validate-address-list-errors";
type yang:counter64;
description
"The total number of packets received with an
address list that does not match the locally
configured address list for the virtual router.";
}
leaf packet-length-errors {
type yang:counter64;
description
"The total number of packets received with a packet
length less than the length of the VRRP header.";
}
} // statistics
} // vrrp-state-attributes
grouping vrrp-global-state-attributes {
description
"Group of VRRP global state attributes.";
leaf virtual-routers {
type uint32;
description
"Number of configured virtual routers.";
}
leaf interfaces {
type uint32;
description
"Number of interfaces with VRRP configured.";
}
container statistics {
description
"VRRP global statistics.";
leaf discontinuity-datetime {
type yang:date-and-time;
description
"The time on the most recent occasion at which any
one or more of checksum-errors, version-errors,
vrid-errors, or ip-ttl-errors suffered a
discontinuity.
If no such discontinuities have occurred since the last
re-initialization of the local management subsystem,
then this node contains the time that the local management
subsystem re-initialized itself.";
}
leaf checksum-errors {
type yang:counter64;
description
"The total number of VRRP packets received with an invalid
VRRP checksum value.";
reference
"RFC 9568: Virtual Router Redundancy Protocol (VRRP)
Version 3 for IPv4 and IPv6, Section 5.2.8.";
}
leaf version-errors {
type yang:counter64;
description
"The total number of VRRP packets received with an unknown
or unsupported version number.";
reference
"RFC 9568: Virtual Router Redundancy Protocol (VRRP)
Version 3 for IPv4 and IPv6, Section 5.2.1.";
}
leaf vrid-errors {
type yang:counter64;
description
"The total number of VRRP packets received with a VRID that
is not valid for any virtual router on this router.";
reference
"RFC 9568: Virtual Router Redundancy Protocol (VRRP)
Version 3 for IPv4 and IPv6, Section 5.2.3.";
}
leaf ip-ttl-errors {
type yang:counter64;
description
"The total number of VRRP packets received by the
virtual router with IP TTL (IPv4) or Hop Limit (IPv6)
not equal to 255.";
reference
"RFC 9568: Virtual Router Redundancy Protocol (VRRP)
Version 3 for IPv4 and IPv6,
Sections 5.1.1.3 and 5.1.2.3";
}
} // statistics
} // vrrp-global-state-attributes
/*
* Configuration data and operational state data nodes
*/
augment "/if:interfaces/if:interface/ip:ipv4" {
description
"Augments IPv4 interface.";
container vrrp {
description
"Configures VRRP version 2 or 3 for IPv4.";
list vrrp-instance {
key "vrid";
description
"Defines a virtual router, identified by a VRID, within the
IPv4 address space.";
uses vrrp-ipv4-attributes;
uses vrrp-state-attributes;
}
}
} // augments ipv4
augment "/if:interfaces/if:interface/ip:ipv6" {
description
"Augments IPv6 interface.";
container vrrp {
description
"Configures VRRP version 3 for IPv6.";
list vrrp-instance {
must "derived-from-or-self(version, 'vrrp-v3')" {
description
"IPv6 is only supported by version 3.";
}
key "vrid";
description
"Defines a virtual router, identified by a VRID, within the
IPv6 address space.";
uses vrrp-ipv6-attributes;
uses vrrp-state-attributes;
}
}
} // augments ipv6
container vrrp {
config false;
description
"VRRP data at the global level.";
uses vrrp-global-state-attributes;
}
/*
* Notifications
*/
notification vrrp-new-active-event {
description
"Notification event for the election of a new VRRP
active router.
The identifier of the notification is changed to
reflect the updated terminology used in RFC 9568.";
leaf active-ip-address {
type inet:ip-address;
mandatory true;
description
"IPv4 or IPv6 address of the new VRRP active router.
The identifier of the leaf is changed to
reflect the updated terminology used in RFC 9568.";
}
leaf new-active-reason {
type new-active-reason-type;
mandatory true;
description
"Indicates why the virtual router has transitioned to
active state.
The identifier of the leaf is changed to
reflect the updated terminology used in RFC 9568.";
}
}
notification vrrp-protocol-error-event {
description
"Notification event for a VRRP protocol error.";
leaf protocol-error-reason {
type identityref {
base vrrp:vrrp-error-global;
}
mandatory true;
description
"Indicates the reason for the protocol error.";
}
}
notification vrrp-virtual-router-error-event {
description
"Notification event for an error that happened on a
virtual router.";
leaf interface {
type if:interface-ref;
mandatory true;
description
"Indicates the interface on which the event has occurred.";
}
choice ip-version {
mandatory true;
description
"The error may have happened on either an IPv4 virtual
router or an IPv6 virtual router. The information
related to a specific IP version is provided by one of
the following cases.";
case ipv4 {
description
"IPv4.";
container ipv4 {
description
"Error information for IPv4.";
leaf vrid {
type leafref {
path "/if:interfaces/if:interface"
+ "[if:name = current()/../../vrrp:interface]/"
+ "ip:ipv4/vrrp:vrrp/vrrp:vrrp-instance/vrrp:vrid";
}
mandatory true;
description
"Indicates the virtual router on which the event has
occurred.";
}
}
}
case ipv6 {
description
"IPv6.";
container ipv6 {
description
"Error information for IPv6.";
leaf vrid {
type leafref {
path "/if:interfaces/if:interface"
+ "[if:name = current()/../../vrrp:interface]/"
+ "ip:ipv6/vrrp:vrrp/vrrp:vrrp-instance/vrrp:vrid";
}
mandatory true;
description
"Indicates the virtual router on which the event has
occurred.";
}
}
}
}
leaf virtual-router-error-reason {
type identityref {
base vrrp:vrrp-error-virtual-router;
}
mandatory true;
description
"Indicates the reason for the virtual router error.";
}
}
}
]]>
IANA is requested to update the following registration in the "ns"
registry within the "IETF XML Registry" group [RFC3688] to
reference this document:
IANA is requested to update the following YANG modue in the "YANG
Module Names" registry within the
"YANG Parameters" registry group to reference this document:
This document defines YANG data model
for the VRRP protocol .
Hence, the entire document can be considered devoted to
operations and management.
The changes to use inclusive language () are
non-backward compatibly based on the rules in .
However, there are no existing implementations of the ietf-vrrp YANG module
based on numerous implementation polls. Hence, it was agreed upon to
change the YANG data nodes with non-inclusive language in a single
iteration rather than going through the deprecation, obsoletion, and
removal cycle.
This section is modeled after the template described in Section 3.7
of .
The "ietf-vrrp" YANG module defines a data model that is
designed to be accessed via YANG-based management protocols, such as
NETCONF and RESTCONF .
These YANG-based protocols (1) have to use a secure transport layer
(e.g., SSH , TLS , and
QUIC ) and (2) have to use mutual authentication.
The Network Configuration Access Control Model (NACM)
provides the means to restrict access for particular NETCONF or
RESTCONF users to a preconfigured subset of all available NETCONF or
RESTCONF protocol operations and content.
There are a number of data nodes defined in this YANG module that are
writable/creatable/deletable (i.e., "config true", which is the
default). All writable data nodes are likely to be reasonably
sensitive or vulnerable in some network environments. Write
operations (e.g., edit-config) and delete operations to these data
nodes without proper protection or authentication can have a negative
effect on network operations. The following subtrees and data nodes
have particular sensitivities/vulnerabilities:
/if:interfaces/if:interface/ip:ipv4/vrrp:vrrp/vrrp:vrrp-instance
/if:interfaces/if:interface/ip:ipv6/vrrp:vrrp/vrrp:vrrp-instance
Unauthorized access to any data node of these subtrees can
adversely affect the routing subsystem of both the local device and
the network. This may lead to network malfunctions, delivery of
packets to inappropriate destinations, and other problems.
Some of the readable data nodes in this YANG module may be considered
sensitive or vulnerable in some network environments. It is thus
important to control read access (e.g., via get, get-config, or
notification) to these data nodes. Specifically, the following
subtrees and data nodes have particular sensitivities/
vulnerabilities:
/ietf-vrrp:vrrp
/if:interfaces/if:interface/ip:ipv4/vrrp:vrrp/vrrp:vrrp-instance
/if:interfaces/if:interface/ip:ipv6/vrrp:vrrp/vrrp:vrrp-instance
Unauthorized access to any data node of these subtrees can disclose the
operational state information of VRRP on this device.
Thanks to Nicola Serafini for his suggestion to add effective-priority to
the virtual router operational state.
Thanks to Med Boucadair for an extensive review and suggested edits.
Thanks to Carlos Pignataro for review and comments.
Thanks to Yingzhen Qu for review and comments.
iana-if-types YANG ModuleIANA
This section contains an example of an instance data tree in JSON
encoding , containing both configuration and
state data. (This example includes "iana-if-type", which is
defined in .)
Virtual router IP address: fe80::1
+-----------------+ +-----------------+
| | | |
| Router 1 | | Router 2 |
| | | |
+--------+--------+ +--------+--------+
|eth1 |eth1
|fe80::11 |fe80::12
-------+--------------------------+-------
| |
|fe80::51 |fe80::52
+--------+--------+ +--------+--------+
| Host 1 | | Host 2 |
| Default gateway:| | Default gateway:|
| fe80::1 | | fe80::1 |
+-----------------+ +-----------------+
The configuration instance data for Router 1 in
could be shown in :
{
"ietf-interfaces:interfaces": {
"interface": [
{
"name": "eth1",
"description": "An interface with VRRP enabled.",
"type": "iana-if-type:ethernetCsmacd",
"ietf-ip:ipv6": {
"address": [
{
"ip": "2001:db8:0:1::1",
"prefix-length": 64
},
{
"ip": "fe80::11",
"prefix-length": 64
}
],
"forwarding": true,
"ietf-vrrp:vrrp": {
"vrrp-instance": [
{
"vrid": 1,
"version": "ietf-vrrp:vrrp-v3",
"priority": 200,
"advertise-interval-centi-sec": 50,
"virtual-ipv6-addresses": {
"virtual-ipv6-address": [
"ipv6-address": "fe80::1"
]
}
}
]
}
}
}
]
}
}
The corresponding operational state data for Router 1
could be shown in :
{
"ietf-interfaces:interfaces": {
"interface": [
{
"name": "eth1",
"description": "An interface with VRRP enabled.",
"type": "iana-if-type:ethernetCsmacd",
"phys-address": "00:00:5e:00:53:01",
"oper-status": "up",
"statistics": {
"discontinuity-time": "2016-10-24T17:11:27+02:00"
},
"ietf-ip:ipv6": {
"forwarding": true,
"mtu": 1500,
"address": [
{
"ip": "2001:db8:0:1::1",
"prefix-length": 64,
"origin": "static",
"status": "preferred"
},
{
"ip": "fe80::11",
"prefix-length": 64,
"origin": "static",
"status": "preferred"
}
]
"ietf-vrrp:vrrp": {
"vrrp-instance": [
{
"vrid": 1,
"version": "ietf-vrrp:vrrp-v3",
"log-state-change": false,
"preempt": {
"enabled": true,
"hold-time": 0
}
"priority": 200,
"accept-mode": false,
"advertise-interval-centi-sec": 50,
"virtual-ipv6-addresses": {
"virtual-ipv6-address": [
"ipv6-address": "fe80::1"
]
},
"state": "active",
"is-owner": false,
"effective-priority": 200,
"last-adv-source": "fe80::11",
"up-datetime": "2016-10-24T17:11:27+02:00",
"active-down-interval": 161,
"skew-time": 11,
"last-event": "vrrp-event-interface-up",
"new-active-reason": "priority",
"statistics": {
"discontinuity-datetime":
"2016-10-24T17:11:27+02:00",
"active-transitions": 2,
"advertisement-rcvd": 20,
"advertisement-sent": 12,
"interval-errors": 0,
"priority-zero-pkts-rcvd": 0,
"priority-zero-pkts-sent": 0,
"invalid-type-pkts-rcvd": 0,
"address-list-errors": 0,
"packet-length-errors": 1
}
}
]
}
}
}
]
}
}
{
"ietf-vrrp:vrrp": {
"virtual-routers": 3,
"interfaces": 2,
"statistics": {
"discontinuity-datetime": "2016-10-24T17:11:27+02:00",
"checksum-errors": 2,
"version-errors": 0,
"vrid-errors": 0,
"ip-ttl-errors": 1
}
}
}