How to stop VRRP announcement from reaching clients

[RakanPastore]

Hello, hope you having a good day.

I am using SVIs in Layer 3 switch, and using them as gateways for clients. and i am using vrrp for redundancy, but what i am seeing that vrrp messages are reaching clients that are in the same vlan which is useless, for example i am using int vlan 20 in MLS-5 as master and int vlan 20 in MLS-6 as backup
Is there is any way to stop this ?

[Georg Pauwen · Accepted solution]

Hello,

VRRP uses multicast address 224.0.0.18. Since you try to block intra-Vlan traffic, a VACL would work. In the example below, your VRRP virtual address is 192.168.1.3, the addresses of the physical interfaces are 192.168.1.1 and 192.168.1.2. Your Vlan is 10. Change these according to what you have configured. The VACL needs to be applied to both (or all) switches participating in VRRP:

access-list 100 deny ip host 192.168.1.1 host 224.0.0.18
access-list 100 deny ip host 192.168.1.2 host 224.0.0.18
access-list 100 deny ip host 192.168.1.3 host 224.0.0.18
access-list 100 permit ip any host 224.0.0.18
!
vlan access-map BLOCK_VRRP 10
match ip address 100
action drop
!
vlan access-map BLOCK_VRRP 20
action forward
!
vlan-filter BLOCK_VRRP vlan-list 10

[RakanPastore]

Hello, thank you for replying 
i tried this commands, but it didn't work, but i think because i am using IOU in gns3, i don't think VACL works in emulated switches

[Georg Pauwen]

Hello,

indeed, VACLs don't work in GNS3. Seems to be a bug in these images. I am pretty sure it will work on 'real' switches.