Advantages of Anycast Gateway

[EF]

Hi Team,

I was reading about this new feature introduced in release 9.1 that can be used to replace VRRP (which is currently my preferred option for L3 redundancy).

I have some doubts because I think I'm missing something.

What are the real advantages of Anycast Gateway? In which scenarios is it a better option than VRRP? What kind of topology is the best fit for this feature?

Thanks in advance!!!

EF

[Jave]

Hi @EF 

With classic VRRP, a single router (the Master) handles all traffic for a given virtual IP; the other routers sit passively on standby (Backup). With Anycast IP Gateway since VOSS 9.1, every BEB (Backbone Edge Bridge) associated with the same L2 VSN configures the same gateway IP and MAC address locally, and becomes active simultaneously for that IP — there's no Master election, all nodes route at the same time. The gateway MAC uses the VRRP MAC address format with the VRID in the last byte (00:00:5e:00:01:xx), and must be identical across the different routers associated with the same L2 VSN.

Concrete advantages over VRRP

Active-active routing instead of active-passive: with VRRP, all inter-VLAN traffic is forced through the Master node; you can spread the Master role across multiple nodes, but that's only a band-aid since traffic leaving that VLAN is still limited to the throughput of a single switch. With Anycast Gateway, each BEB routes locally the traffic it receives — no bottleneck on a single node.
No traffic tromboning: without anycast, even east-west traffic between hosts on the same switch can end up having to travel to the Master switch to be routed, then back down. Anycast Gateway removes this detour since each switch routes directly.
Transparent host/VM mobility: VMs and other workloads can be moved across the fabric without changing their IP address — the new local switch simply becomes the new gateway and traffic flow is automatically optimized.
Improved resilience without convergence delay: with multiple active gateways, if one goes down, traffic is automatically redirected to another, avoiding a single point of failure — and without the failover/convergence delay inherent to VRRP (election, advertisement timers, etc.)

Regards.

[Ludovico · Accepted solution]

If your access switches are running SwitchEngine as FA Proxies, and you have VRRP with backup-master on the FabricEngine FA Server MLAG pair, then VRRP with Backup-Master is still perfect as you will get active-active load balancing of routed traffic on both VRRP routers (Anycast Gateway - ACGW - will also work fine).

Where ACGW shines is when the access switches are running FabricEngine. If you run VRRP here, the backup-master function becomes ineffective as the the fabric access switch will have to MAC-in-MAC encapsulate all VRRP gateway MAC destined traffic towards the real owner of the VRRP MAC i.e. only the VRRP Master router will be routing that traffic onwards, so you get no load balancing; also in certain fabric  topologies the VRRP Master router might not be the nearest, so the forwarding path might be sub-optimal.

With ACGW, the fabric access switch can see if there are more ACGW gateways for the L2 I-SID (VLAN) and will deliver the traffic to the nearest gateway. If both/all gateways are equally near, then traffic from the different I-SIDs will be balances among them.

But ACGW requires some intelligence from the FabricEngine access switch which is a L2 switch. You need all FabricEngine devices to be on VOSS 9.1.0.0 or later.