Study guide
3.4 High-Availability Gateways: VRRP and VSX Active-Gateway
HPE Aruba Networking Certified Associate - Campus Access HPE6-A85
Track your progress as you read
Finished sections get a check mark.
1 Introduction: HPE6-A85 Exam Overview
HPE6-A85 Exam Facts and Current Blueprint
2 Chapter 1: Network Stack Fundamentals
1.1 OSI Reference Model and Encapsulation 1.2 TCP/IP Protocol Suite and IP Headers 1.3 Layer 2 Operation, ARP, and 802.1Q Tagging
3 Chapter 2: Physical Connectivity and Host Addressing
2.1 Ethernet Media and Transceiver Standards 2.2 Power over Ethernet (PoE, PoE+, PoE++) Standards and Budgeting 2.3 LLDP, LLDP-MED, and Voice VLAN Configuration 2.4 Host IP Addressing and DHCP Relay Operations
4 Chapter 3: Network Resiliency and Virtualization
3.1 Virtual Switching Framework (VSF) Architecture and Topologies 3.2 VSF Split Detection, Failover, and Auto-Stacking 3.3 Virtual Switching Extension (VSX) Architecture and Operations 3.4 High-Availability Gateways: VRRP and VSX Active-Gateway
5 Chapter 4: AOS-CX Architecture and Switch Operation
4.1 AOS-CX Hardware Portfolio and State Database Architecture 4.2 Network Analytics Engine (NAE) and Automated Telemetry 4.3 AOS-CX Interface Configuration and Port Control 4.4 Link Aggregation (LAG) and LACP Configuration
6 Chapter 5: Layer 2 Protocols and Spanning Tree
5.1 AOS-CX VLAN Configuration and Native VLAN Handling 5.2 Spanning Tree Protocols: STP, RSTP, and MSTP 5.3 Spanning Tree Protections and Loop Prevention 5.4 MAC Address Table Learning, Aging, and Forwarding
7 Chapter 6: Wireless Fundamentals, Standards, and RF
6.1 IEEE 802.11 Standards and Wi-Fi Generations 6.2 RF Fundamentals, Signal Propagation, and Channel Design 6.3 Aruba Access Point Hardware Portfolio and Suffix Conventions 6.4 WLAN Topologies, BSSID/ESSID, and Roaming Standards
8 Chapter 7: Aruba Wireless Architecture and Management
7.1 AOS 10 Architecture and Aruba Central Integration 7.2 Wireless Forwarding Modes: Bridge vs Tunnel Mode 7.3 Automated RF and Client Optimization: AirMatch and ClientMatch 7.4 Secure Wireless Access: WPA3, SAE, and MPSK Implementation
9 Chapter 8: IP Routing Fundamentals and OSPF
8.1 IP Routing Principles and Packet Forwarding 8.2 OSPFv2 Protocol Mechanics and Adjacency Formation 8.3 OSPF Designated Routers and Multi-Area Deployments 8.4 ECMP, Static Routing, and VRF Isolation
10 Chapter 9: Campus Network Security and Segmentation
9.1 DHCP Snooping and Dynamic ARP Inspection 9.2 Port Security and MAC Address Limiting 9.3 ClearPass Policy Management and RADIUS Change of Authorization 9.4 Dynamic Segmentation, User-Based Tunneling, and Policy Enforcement
11 Chapter 10: Authentication, Authorization, and Accounting
10.1 The AAA Framework and Architecture 10.2 802.1X Authentication and EAP Methods 10.3 MAC Authentication and Captive Portal Onboarding 10.4 Administrative Access Control: RADIUS vs TACACS+
12 Chapter 11: Network Management and Telemetry
11.1 Aruba Central Cloud Architecture and Group Configuration 11.2 Zero-Touch Provisioning (ZTP) and Aruba Activate 11.3 AI Insights and Aruba User Experience Insight (UXI) 11.4 Network Telemetry, Streaming APIs, and SNMP/Syslog
13 Chapter 12: Troubleshooting the Solution
12.1 Structured Troubleshooting Methodologies and Scope Isolation 12.2 AOS-CX Layer 2 and Interface Diagnostic Commands 12.3 Layer 3, IP Services, and End-to-End Diagnostics 12.4 Physical-Layer Troubleshooting 12.5 Troubleshooting Wireless Clients and Network Access
14 Chapter 13: Optimizing Performance: QoS, Baselines, and Comparisons
13.1 Quality of Service (QoS) Classification and Marking 13.2 Queuing Algorithms and Congestion Management 13.3 Traffic Policing, Shaping, and Broadcast Rate Limiting 13.4 Establishing a Performance Baseline 13.5 Comparing Results to the Baseline
15 Chapter 14: Plan the Solution
14.1 Analyzing the Current Environment 14.2 Interpreting an Architect's High-Level Design 14.3 Creating a Low-Level Design 14.4 Preparing for Implementation
16 Chapter 15: Validate and Operate the Solution
15.1 Validating the Solution 15.2 Performing Firmware Updates 15.3 Making Basic Ongoing Configuration Changes 15.4 Maintaining Network Documentation
3.4 High-Availability Gateways: VRRP and VSX Active-Gateway
Key Takeaways Explain This Topic AI
Virtual Router Redundancy Protocol (VRRP) provides standard active/standby first-hop gateway redundancy using a shared virtual IP and RFC-defined virtual MAC (00:00:5E:00:01:XX).
In VRRP, only the Master router actively routes client traffic, forcing traffic arriving at the Backup router across inter-switch links in suboptimal triangular routing paths.
VSX Active-Gateway provides native active/active Layer 3 first-hop redundancy where both VSX peers route default gateway traffic simultaneously at wire speed.
Active-Gateway assigns identical virtual IP and virtual MAC addresses to Switched Virtual Interfaces (SVIs) on both VSX peers, eliminating failover convergence delays.
While VRRP is an open standard suited for multivendor environments, VSX Active-Gateway is the recommended design for Aruba campus core/aggregation deployments.
Last updated: October 2026
3.4 High-Availability Gateways: VRRP and VSX Active-Gateway
In enterprise campus networks, end-user devices such as PCs, IP phones, wireless access points, and printers rely on a default gateway to communicate beyond their local Layer 2 broadcast domain. Standard client network stacks can only be configured with a single default gateway IP address (typically assigned via DHCP). If the physical switch or router hosting this gateway address fails, all connected endpoints on that subnet lose off-subnet and Internet connectivity.
To eliminate this single point of failure, network architects deploy First-Hop Redundancy Protocols (FHRP) . In ArubaOS-CX environments, two primary gateway redundancy mechanisms are available: the industry-standard Virtual Router Redundancy Protocol (VRRP) and Aruba's native VSX Active-Gateway .
Virtual Router Redundancy Protocol (VRRP)
VRRP is an open-standard protocol defined by the IETF (RFC 3768 for IPv4, RFC 5798 for IPv4/IPv6). It dynamically elects an active/standby router pair to represent a shared Virtual IP (VIP) address.
VRRP Mechanics and Roles
Master (Active) Router: The router that actively forwards packets addressed to the Virtual IP address. AOS-CX documentation calls this role Active . It responds to client ARP requests with a standardized Virtual MAC address.
Backup (Standby) Router: One or more standby routers that monitor the health of the Master. The Backup does not actively forward traffic sent to the virtual gateway while the Master is operational.
Virtual MAC Address: VRRP generates a deterministic Layer 2 MAC address based on the Virtual Router ID (VRID):
00:00:5E:00:01:[VRID in Hex] \text{00:00:5E:00:01:}\text{[VRID in Hex]} 00:00:5E:00:01: [VRID in Hex]
For example, VRID 10 yields Virtual MAC 00:00:5E:00:01:0A .
Priority and Preemption
Priority Range: Configured from 1 to 254 (default is 100 ). The router with the highest priority is elected Master.
Owner Priority (255): Priority 255 is automatically assigned if the Virtual IP matches the real physical IP configured on the interface.
Preemption: By default, preemption is enabled in AOS-CX ( preempt in the VRRP group context). A higher-priority Standby takes over the Active role; no preempt stops that, but never prevents the address owner from resuming the Active role.
Heartbeat Timers and Convergence
The Master transmits VRRP Advertisement multicasts to 224.0.0.18 every 1 second (default advertisement interval).
The Backup router maintains a Master Down Timer calculated as:
Master Down Interval = ( 3 × Advertisement Interval ) + Skew Time \text{Master Down Interval} = (3 \times \text{Advertisement Interval}) + \text{Skew Time} Master Down Interval = ( 3 × Advertisement Interval ) + Skew Time
With default 1-second timers, the Backup waits approximately 3.6 seconds without receiving an advertisement before assuming the Master role. During this 3.6-second failover window, client traffic destined for the default gateway is dropped.
The Suboptimal Triangular Routing Penalty of VRRP
When VRRP is deployed in modern aggregation topologies utilizing Multi-Chassis Link Aggregation (VSX-LAG), a significant data-plane inefficiency emerges: triangular routing . +-------------------------------------------------------------------------+
- | VRRP ASYMMETRIC / TRIANGULAR ROUTING |
- | |
- | +-----------------------+ +-----------------------+ |
- | | VRRP MASTER (Switch A)| ISL (LAG) | VRRP BACKUP (Switch B)| |
- | | Routes to Core / WAN |<============>| Cannot Route to VMAC | |
- | +-----------+-----------+ TRANSIT +-----------+-----------+ |
- | ^ | TRAFFIC ^ |
- | | | | |
- | | | | 50% Ingress |
- | | +------------------+ +-----------------+ Traffic |
- | | | | | |
- | 50% Direct +======+=+======+ | |
- | Local Routing | VSX-LAG | ---------+ |
- | +=======+=======+ (Suboptimal hop over ISL) |
- | | |
- | +-----------------+ |
- | | Access Switch | |
- | +-----------------+ |
- +-------------------------------------------------------------------------+
Downstream access switches distribute outbound client frames across both uplinks of the VSX-LAG using standard LACP load-balancing hash algorithms (roughly 50% per link).
Frames hashing to the VRRP Master (Switch A) are immediately routed upstream at wire speed.
Frames hashing to the VRRP Backup (Switch B) encounter a problem: because Switch B is in Backup status, it is not authorized to route packets addressed to the VRRP Virtual MAC.
Switch B must bridge these frames across the Inter-Switch Link (ISL) to Switch A. Switch A then routes the packets upstream.
This suboptimal detour consumes valuable ISL bandwidth, introduces latency jitter, and effectively halves the routing throughput of the aggregation layer.
Aruba VSX Active-Gateway
To overcome the active/standby limitations of VRRP, Aruba introduced VSX Active-Gateway . Active-Gateway provides native active/active Layer 3 first-hop redundancy tailored specifically for VSX pairs.
Active-Gateway Architecture and Forwarding
Both the Primary and Secondary VSX switches are configured with the exact same Virtual IP address and Virtual MAC address on their corresponding VLAN Switched Virtual Interfaces (SVIs).
Unlike VRRP, there is no active/standby distinction: both switches actively route traffic simultaneously .
When a client transmits a frame to the default gateway's virtual MAC, whichever VSX switch receives the frame routes it locally in hardware at full ASIC wire speed.
No transit routing traffic traverses the Inter-Switch Link (ISL). 100% of aggregation routing capacity is utilized.
ARP Resolution and Instantaneous Failover
When a downstream host sends an ARP request for the default gateway IP, both VSX peers can reply with the configured virtual MAC address.
If one VSX switch or physical uplink fails, the downstream switch's LACP hashing algorithm automatically redirects traffic to the surviving uplink.
Because the surviving VSX peer already has the identical IP, identical virtual MAC, and synchronized routing tables programmed into its ASICs, failover convergence is instantaneous (0 seconds) . No protocol state machine transitions or ARP renegotiations take place.
Comprehensive Architectural Comparison
- Feature / Metric Virtual Router Redundancy Protocol (VRRP) Aruba VSX Active-Gateway
- Forwarding Model Active / Standby (only Master routes) Active / Active (both peers route concurrently)
- Traffic Path Asymmetric / Triangular (50% traverses ISL) Symmetric direct wire-speed local routing
- Failover Convergence 3 to 4 seconds (timer-dependent) Instantaneous sub-second (link-level LACP failover)
- ISL Bandwidth Impact Heavy transit burden for routed traffic Zero ISL consumption for healthy routed flows
Addressing Shared Virtual IP + Algorithmic Virtual MAC (00:00:5E:00:01:VRID) Shared Virtual IP + administrator-defined virtual MAC (same on both peers)
- Standards Basis Open IETF standard (RFC 3768 / 5798) ArubaOS-CX native technology (VSX-optimized)
- Use Case Multivendor routing environments Aruba campus aggregation and core VSX pairs
- Configuration and Implementation
- 1. VRRP Configuration on AOS-CX switch(config)# interface vlan 10
- switch(config-if-vlan)# ip address 10.1.10.2/24
- switch(config-if-vlan)# vrrp 10 address-family ip
- switch(config-if-vrrp)# address 10.1.10.1 primary
- switch(config-if-vrrp)# priority 110
- switch(config-if-vrrp)# no shutdown
- 2. VSX Active-Gateway Configuration on AOS-CX
Active-Gateway requires an IP address on each peer's SVI in the same subnet as the virtual IP, plus matching active-gateway parameters. VRRP and active-gateway cannot be configured on the same SVI, and the virtual MAC must not reuse the VSX system MAC (AOS-CX 10.14 CLI Guide): ! --- VSX Primary Switch (Switch A) ---
- switch-A(config)# interface vlan 10
- switch-A(config-if-vlan)# ip address 10.1.10.2/24
- switch-A(config-if-vlan)# active-gateway ip mac 02:00:0a:01:0a:01
- switch-A(config-if-vlan)# active-gateway ip 10.1.10.1
- ! --- VSX Secondary Switch (Switch B) ---
- switch-B(config)# interface vlan 10
- switch-B(config-if-vlan)# ip address 10.1.10.3/24
- switch-B(config-if-vlan)# active-gateway ip mac 02:00:0a:01:0a:01
- switch-B(config-if-vlan)# active-gateway ip 10.1.10.1
Verification is performed using show active-gateway (active-gateway) or show vrrp (VRRP). An abbreviated example: switch-A# show active-gateway
- VLAN IPv4 Address MAC Address Status
- ------------------------------------------------
- 10 10.1.10.1 02:00:0a:01:0a:01 Active