This article addresses an issue encountered by customers who upgrade to JunOS version 20.3R3 and later, where VRRP (Virtual Router Redundancy Protocol) may fail to function correctly. The problem arises specifically when VRRP is configured with authentication keys longer than 8 characters for simple authentication and 16 characters for MD5.

After upgrading to 20.3R3 or a later version, customers may observe the following symptoms:

- Attempting to show any VRRP output results in the error: "error: the vrrp subsystem is not running."

- When trying to commit changes to the configuration, the error: "error: configuration check-out failed" is encountered.

The root cause of this issue is related to the length of authentication keys in the VRRP configuration. The allowed lengths are up to 8 characters for simple authentication and 16 characters for MD5.

If you have the following configuration:

set interfaces <*> unit <*> family inet address <*> vrrp-group <*> authentication-type simple authentication-key Juniper12345

• authentication-key key;
• You can include this statement at the following hierarchy levels:

  • [edit interfaces interface-name unit logical-unit-number family inet address address vrrp-group group-id]

  • [edit logical-systems logical-system-name interfaces interface-name unit logical-unit-number family inet address address vrrp-group group-id]

Ensure that the authentication key does not exceed the specified lengths.

•  For simple authentication, it can be from 1 through 8 characters long.
•  For MD5 authentication, it can be from 1 through 16 characters long.

Refer to the Configuring VRRP Authentication (IPv4 Only) for more details on VRRP authentication.

• Simulation from Upgrade to 23.2R1-S1.6:

After upgrading, if the VRRP configuration contains keys longer than the allowed lengths, the vrrpd process may not start properly. Relevant log messages might include entries like:

root@switch:RE:0% cli

{master:0}
root@switch> show version
localre:
--------------------------------------------------------------------------
Hostname: switch
Model: qfx5110-48s-4c
Junos: 23.2R1-S1.6
 

{master:0}
root@switch# run show log messages | match vrrp | last 50 | no-more
Dec 24 16:20:28.373 switch kernel: %KERN-7: rts_ifstate_client_close_job_handler: PHASE 2 completed!, client close start ticks:2147022227, cur ticks :2147022227, client:0xfffff80004db4170, cl num:53, cl name:vrrpd, next_state:0 ticks time spent 0 ifstate loop len 638
Dec 24 16:20:28.373 switch kernel: %KERN-7: rts_ifstate_client_close_job_handler: client:0xfffff80004db4170 client close job done, cl name:vrrpd, cl num:53
Dec 24 16:20:28.373 switch kernel: %KERN-7: rts_ifstate_client_close_job_handler: Client-closing completed! vrrpd(53):0xfffff80004db4170 num:0 ticks 2147022227 start_ticks 2147022227
Dec 24 16:20:28.373 switch kernel: %KERN-7: Cleanup of dead ifstate client: vrrpd done Total dead ifstate client : 0
Dec 24 16:20:28.374 switch jlaunchd[11308]: %AUTH-6: vrrp (PID 13228) exited with status=255
Dec 24 16:20:28.375 switch jlaunchd[11308]: %AUTH-6: Registered PID 13253(vrrp): exec_command
Dec 24 16:20:28.375 switch jlaunchd[11308]: %AUTH-6: vrrp (PID 13253) started
Dec 24 16:20:28.375 switch jlaunchd[11308]: %AUTH-6: Registered PID 13253(vrrp): new process
Dec 24 16:20:33.454 switch vrrpd[13253]: %DAEMON-5-LIBJSNMP_SA_IPC_REG_ROWS: ns_subagent_register_mibs: registering 8 rows
Dec 24 16:20:33.457 switch vrrpd[13253]: %DAEMON-3-UI_CONFIGURATION_ERROR: Process: vrrpd, path: [edit groups VRRP-GROUP interfaces <*> unit <*> family inet address <*> vrrp-group <*> authentication-key], statement: authentication-key "XXXXXXXXXX", vrrp authentication-key "Juniper12345"(12) longer than 8 characters <<<<<<<<<<<<<<<<<
Dec 24 16:20:33.459 switch kernel: %KERN-7: ifstate client : vrrpd closing down Total dead ifstate clients : 1
Dec 24 16:20:33.459 switch kernel: %KERN-7: rts_ifstate_client_close_job_handler: PHASE 1 entered, client:0xfffff80004989cf0, cl num:53, cl name:vrrpd, next_state:0 ticks 2147027312 start_ticks 2147027312
Dec 24 16:20:33.459 switch kernel: %KERN-7: rts_ifstate_client_close_job_handler: PHASE 2 entered, client:0xfffff80004989cf0, cl num:53, cl name:vrrpd, next_state:0xfffff8000443c620, ifs_head:0xfffff8000443c620 ticks 2147027312 start_ticks 2147027312
Dec 24 16:20:33.459 switch kernel: %KERN-7: rts_ifstate_client_close_job_handler: PHASE 2 completed!, client close start ticks:2147027312, cur ticks :2147027313, client:0xfffff80004989cf0, cl num:53, cl name:vrrpd, next_state:0 ticks time spent 1 ifstate loop len 639
Dec 24 16:20:33.459 switch kernel: %KERN-7: rts_ifstate_client_close_job_handler: client:0xfffff80004989cf0 client close job done, cl name:vrrpd, cl num:53
Dec 24 16:20:33.459 switch kernel: %KERN-7: rts_ifstate_client_close_job_handler: Client-closing completed! vrrpd(53):0xfffff80004989cf0 num:0 ticks 2147027313 start_ticks 2147027312
Dec 24 16:20:33.459 switch kernel: %KERN-7: Cleanup of dead ifstate client: vrrpd done Total dead ifstate client : 0

{master:0}
root@switch> show vrrp brief
error: the vrrp subsystem is not running

 

{master:0}
root@switch# commit check
[edit groups VRRP-GROUP interfaces <*> unit <*> family inet address <*> vrrp-group <*> authentication-key]
'authentication-key "XXXXXXXXXX"'
  vrrp authentication-key "Juniper12345"(12) longer than 8 characters
error: configuration check-out failed

To resolve the issue:

root@switch# set interfaces <*> unit <*> family inet address <*> vrrp-group <*> authentication-type simple authentication-key Juniper1

root@switch# run restart vrrp soft

error: Virtual Router Redundancy Protocol process is not running

Virtual Router Redundancy Protocol process started, pid 12345

4. Confirm that the VRRP subsystem is running:

{master:0}[edit]

root@switch# run show vrrp brief

Interface   State    Group  VR state VR Mode  Timer  Type  Address

irb.7     down            2  bringup Active   N 0.000 lcl  192.168.0.204

                                                      vip  192.168.0.206

irb.6     down            2  bringup Active   N 0.000 lcl  192.168.0.228

                                                      vip  192.168.0.230

irb.2     down            2  bringup Active   N 0.000 lcl  192.168.0.220

                                                      vip  192.168.0.222

xe-0/0/4.1  not present   2  bringup Active   N 0.000 lcl  10.0.0.12

                                                      vip  10.0.0.14

xe-0/0/4.2  not present   2  bringup Active   N 0.000 lcl  192.168.0.156

                                                      vip  192.168.0.158

xe-0/0/4.1  not present   2  bringup Active   N 0.000 lcl  10.0.0.20

                                                      vip  10.0.0.22

xe-0/0/4.2  not present   2  bringup Active   N 0.000 lcl  192.168.0.188

                                                      vip  192.168.0.190

{master:0}[edit]

root@switch# run show system processes extensive | match 12345

12345 root     20  0  466M  14M select  0  0:00  0.00% vrrpd

This issue is documented in PR1683871, where VRRP returns an error if the authentication key exceeds the specified lengths. To avoid this problem, ensure that the authentication-key adheres to the length requirements before upgrading. If the issue persists after upgrading, correct the configuration and restart the VRRP process.

For further assistance or inquiries, please contact https://support.juniper.net/support/requesting-support/

2024-01-07 : Article Created.
2024-04-22 : Changed highlighted colors to Bold.

2024-11-12: Added SRX to the affected devices

• https://prsearch.juniper.net/problemreport/PR1683871

https://supportportal.juniper.net/s/article/20-3R3-S5-Software-Release-Notification?language=en_US

• https://prsearch.juniper.net/problemreport/PR1683871

https://supportportal.juniper.net/s/article/21-4R3-S4-EVO-SRN?language=en_US

https://supportportal.juniper.net/s/article/20-3R3-S6-SRN?language=en_US