Active-active layer 3 default gateway

VSX aggregation switches can be configured with a shared virtual IP (VIP) and a shared virtual MAC address (VMAC) on the layer 3 VLAN interface.

The VIP/VMAC serves as the default gateway for the access layer. The two switches then share the router MAC and function as an active-active gateway for the IP subnet. The first VSX device that receives traffic from the access layer (based on the hashing algorithm over the LAG interface) routes it across to the other subnets.

If you have enabled active gateway, VRRP is not required. Active gateway is similar to VRRP in that routed traffic from the VSX node is sourced from the switch interface MAC and not the VMAC. Each active gateway sends a periodic broadcast hello packet to avoid VMAC aging on the access switches.

Active gateway is preferable over VRRP because with VRRP traffic is still pushed over the ISL link, resulting in latency in the network.


  • The VIP and VMAC must be the same on both VSX switches.

  • A maximum of 4,040 active-gateways (IPv4 and IPv6) SVIs are supported on the 832x series switches. A maximum of 4,094 active-gateways (IPv4 and IPv6) SVIs are supported on the 8400 series switches.

  • There can be up to 16 different VMACs per VSX pair, not shareable between IPv4 and IPv6. For example: You can have a maximum of eight VMACs for IPv4, simultaneously having a maximum of eight VMACs for IPv6.