HSRP Interface Tracking
HSRP allows administrators to track the status of interfaces on the current active gateway so that when that interface fails, the gateway decrements its priority by a specified value, the default being 10, allowing another gateway to assume the role of active gateway for the HSRP group. This concept is illustrated in Figure 8-14.
Figure 8-14: HSRP Interface Tracking
Referencing Figure 8-14, HSRP has been enabled on Switch 1 and Switch 2 for VLAN 150. Based on the current priority configuration, Switch 1, with a priority value of 105, has been elected as primary switch for this VLAN. Both Switch 1 and Switch 2 are connected to two routers via their GigabitEthernet5/1 interfaces. It is assumed that these two routers peer with other external networks, such as the Internet.
Without HSRP interface tracking, if the GigabitEthernet0/1 interface between Switch 1 and R1 failed, Switch 1 would still retain its primary gateway status. It would then have to forward any received packets destined for the Internet, for example, over to Switch 2 using the connection between itself and Switch 2. The packets would be forwarded out via R2 towards their intended destination. This results in a suboptimal traffic path within the network.
HSRP interface tracking allows the administrators to configure HSRP to track the status of an interface and decrement the active gateway priority by either a default value of 10, or a value specified by the administrators. Referencing Figure 8-14, if HSRP interface tracking was configured using the default values on Switch 1, allowing it to track the status of interface GigabitEthernet5/1 and that interface failed; Switch 1 would decrement its priority for the HSRP group by 10, resulting in a priority of 95.
Assuming that Switch 2 was configured to preempt, which is mandatory in this situation, it would realize that it had the higher priority (100 versus 95) and perform a coup and assume role of active gateway for this HSRP group.
Real World Implementation
FHRPs, such as HSRP, can be configured to track these enhanced objects, allowing for greater flexibility when implementing FHRP failover situations. For example, using Enhanced Object Tracking, the active HSRP router could be configured to decrement its priority value by a certain amount if a network or host route was not reachable (i.e. present in the routing table). EOT is beyond the scope of the SWITCH exam and will not be illustrated in the examples. |
HSRP Load Balancing
HSRP allows administrators to configure multiple HSRP groups on physical interfaces to allow for load balancing. By default, when HSRP is configured between two gateways, only one gateway actively forwards traffic for that group at any given time. This can result in wasted bandwidth for the standby gateway link. This is illustrated in Figure 8-15.
Figure 8-15: A Network without HSRP Load Balancing
In Figure 8-14, two HSRP groups are configured between Switch 1 and Switch 2. Switch 1 has been configured as the active (primary) gateway for both groups – based on the higher priority. Switch 1 and Switch 2 are connected to R1 and R2, respectively. These routers are both connected to the Internet via T3/E3 dedicated lines. Because Switch 1 is the active gateway for both groups, it will forward traffic for both groups until such time that it fails and Switch 2 assumes the role of active (primary) gateway.
While this does satisfy the redundancy needs of the network, it also results in the expensive T3/E3 link on R2 remaining idle until Switch 2 becomes active gateway and begins to forward traffic through it. Naturally, this represents a wasted amount of bandwidth.
By configuring multiple HSRP groups, each using a different active gateway, administrators can effectively prevent the unnecessary waste of resources and load balance between Switch 1 and Switch 2. This is illustrated in Figure 8-16.
Figure 8-16: A Network using HSRP for Load Balancing
By configuring Switch 1 as active gateway for HSRP Group 1 and Switch 2 as active Gateway for HSRP Group 2, administrators can allow traffic from these two groups to be load balanced between Switch 1 and Switch 2, and ultimately across the two dedicated T3/E3 WAN connections. Each switch then backs up the others group. For example, Switch 1 will assume role of active gateway for Group 2 is Switch 2 fails, and vice versa.
|
Real World Implementation In the previous section, we learned that HSRP allows for the configuration of multiple groups on a single gateway interface. The primary issue with running many different HSRP groups on the gateway interface is that it increases CPU utilization on the gateway, and may potentially also increase the amount of network traffic, given the 3-second Hello interval used by HSRP. To address this potential issue, HSRP also allows for the configuration of client or slave groups. These are simply HSRP groups that are configured to follow a master HSRP group and do not participate in the HSRP election. These client or slave groups follow the operation and HSRP status of the master group, and therefore do not need to exchange periodic Hello packets themselves. This reduces CPU and network utilization when using multiple HSRP groups. However, it should be noted that client groups send periodic messages in order to refresh their virtual MAC addresses in switches. The refresh message may be sent at a much lower frequency compared with the protocol election messages sent by the master group. While the configuration of client groups is beyond the scope of the SWITCH exam requirements, Example 8-6 illustrates the configuration of two client groups, which are configured to follow master group HSRP group 1, also named the SWITCH-HSRP group. Example 8-6: Configuring HSRP Client Groups
In the configuration in Example 8-6, group 1 is configured as the master HSRP group and groups 2 and 3 are configured as client or slave HSRP groups. |
Configuring HSRP on the Gateway
The following steps are required to configure HSRP on the gateway:
- Configure the correct IP address and mask for the gateway interface using the ip address [address] [mask] [secondary] interface configuration command
- Create an HSRP group on the gateway interface and assign the group the virtual IP address via thestandby [number] ip [virtual address][secondary] interface configuration command. The [secondary]keyword specifies the IP address as a secondary gateway IP address for the specified group
- Optionally, assign the HSRP group a name using the standby [number] name [name] interface configuration command
- Optionally, if you want to control the election of the active gateway, configure the group priority via thestandby [number] priority [value] interface configuration command
The HSRP configuration example in this section will be based on the network in Figure 8-17.
Figure 8-17: HSRP Configuration Examples Topology
NOTE: It is assumed that the VLAN and trunking configuration between VTP-Server-1 and VTP-Server-2 is already in place and the switches are successfully able to ping each other across VLAN 172. For brevity, this configuration will be omitted from the configuration examples.
Example 8-7: Configuring HSRP Groups
| VTP-Server-1(config)#interface vlan 172 VTP-Server-1(config-if)#ip address 172.16.31.1 255.255.255.0 VTP-Server-1(config-if)#standby 1 ip 172.16.31.254 VTP-Server-1(config-if)#standby 1 priority 105 VTP-Server-1(config-if)#exit |
| VTP-Server-2(config)#interface vlan 172 VTP-Server-2(config-if)#ip address 172.16.31.2 255.255.255.0 VTP-Server-2(config-if)#standby 1 ip 172.16.31.254 VTP-Server-2(config-if)#exit |
NOTE: No priority value is manually assigned for the HSRP configuration applied to VTP-Server-2. By default, HSRP will use a priority value of 100, allowing VTP-Server-1, with a priority value of 105, to win the election and be elected primary gateway for the HSRP group.
Once implemented, HSRP configuration may be validated using the show standby [interface brief] commands. The output of the show standby brief command is shown in Example 8-8.
Example 8-8: Verifying HSRP Configuration
| VTP-Server-1#show standby brief P indicates configured to preempt. | Interface Grp Pri P State Active Standby Virtual IP Vl172 1 105 Active local 172.16.31.2 172.16.31.254 |
| VTP-Server-2#show standby brief P indicates configured to preempt. | Interface Grp Pri P State Active Standby Virtual IP Vl172 1 100 Standby 172.16.31.1 local 172.16.31.254 |
Based on this configuration, VTP-Server-2 will only become the active gateway for this group if VTP-Server-1 fails. Additionally, because preemption is not configured, when VTP-Server-1 comes back online, it will not be able to forcefully assume role of active gateway even though it has a higher priority for the HSRP group than that being used on VTP-Server-2.
Configuring HSRP Preemption
Preemption allows a gateway to forcefully assume the role of active gateway if it has a higher priority than the current active gateway. HSRP preemption is configured using the standby [number] preempt command. This configuration is illustrated on VTP-Server-1 in Example 8-9.
Example 8-9: Configuring HSRP Preemption
| VTP-Server-1(config)#interface vlan 172 VTP-Server-1(config-if)#standby 1 preempt |
The show standby [interface [name]|brief] commands is also used to verify that preemption has been configured on a gateway. This is illustrated by the P shown in the output of the show standby brief command, as illustrated in Example 6-10.
Example 8-10: Verifying HSRP Preemption
| VTP-Server-1#show standby brief P indicates configured to preempt. | Interface Grp Pri P State Active Standby Virtual IP Vl172 1 105 P Active local 172.16.31.2 172.16.31.254 |
Based on this modification, if VTP-Server-1 did fail and VTP-Server-2 assumed the role of active gateway for VLAN 172, VTP-Server-1 could forcibly reassume that role once it reinitializes. When configuring preemption, Cisco IOS software allows you to specify the duration the switch must wait for before it preempts and forcibly reassumes the role of active gateway.
By default, this happens immediately. However, it may be adjusted using the standby [number] preempt delay [minimum|reload|sync] interface configuration command. The [minimum] keyword is used to specify the minimum amount of time to wait (seconds) before preemption. Example 8-11 shows how to configure the gateway to wait 30 seconds before preemption.
Example 8-11: Configuring the HSRP Preemption Time
| VTP-Server-1(config)#interface vlan 172 VTP-Server-1(config-if)#standby 1 preempt delay minimum 30 |
This configuration may be validated using the show standby [interface] command. This is illustrated in Example 8-12.
Example 8-12: Verifying the HSRP Preemption Time
| VTP-Server-1#show standby vlan 172 Vlan172 – Group 1 State is Active 5 state changes, last state change 00:00:32 Virtual IP address is 172.16.31.254 Active virtual MAC address is 0000.0c07.ac01 Local virtual MAC address is 0000.0c07.ac01 (v1 default) Hello time 3 sec, hold time 10 sec Next hello sent in 0.636 secs Preemption enabled, delay min 30 secs Active router is local Standby router is 172.16.31.2, priority 100 (expires in 8.629 sec) Priority 105 (configured 105) IP redundancy name is “hsrp-Vl172-1” (default) |
The [reload] keyword is used to specify the amount of time the gateway should wait after it initializes following a reload. The [sync] keyword is used in conjunction with IP redundancy clients. This configuration is beyond the scope of the SWITCH exam.
Configuring HSRP Interface Tracking
HSRP interface tracking allows administrators to configure HSRP to track the state of interfaces and decrement the current priority value by the default value (10) or a preconfigured value, allowing another gateway to assume the role of primary gateway for the specified HSRP group.
In Example 8-13, VTP-Server-1 is configured to track the state of interfaces GigabitEthernet5/1, which is connected to an imaginary WAN router. In the event that the state of that interface transitions to ‘down’, the gateway will decrement its priority value by 10 (which is the default).
Example 8-13: Configuring HSRP Interface Tracking
| VTP-Server-1(config)#interface vlan 172 VTP-Server-1(config-if)#standby 1 track gigabitethernet 5/1 |
This configuration may be validated using the show standby [interface] command. This is illustrated in Example 8-14.
Example 8-14: Verifying the HSRP Preemption Time
| VTP-Server-1#show standby vlan 172 Vlan172 – Group 1 State is Active 5 state changes, last state change 00:33:22 Virtual IP address is 172.16.31.254 Active virtual MAC address is 0000.0c07.ac01 Local virtual MAC address is 0000.0c07.ac01 (v1 default) Hello time 3 sec, hold time 10 sec Next hello sent in 1.085 secs Preemption enabled Active router is local Standby router is 172.16.31.2, priority 100 (expires in 7.616 sec) Priority 105 (configured 105) IP redundancy name is “hsrp-Vl172-1” (default) Priority tracking 1 interfaces or objects, 1 up: Interface or object Decrement State GigabitEthernet5/1 10 Up |
To configure the gateway to decrement its priority value by 50, for example, the standby [name] track [interface] [decrement value] command can be issued as shown in Example 8-15.
Example 8-15: Configuring HSRP Interface Tracking and Decrement
| VTP-Server-1(config)#interface vlan 172 VTP-Server-1(config-if)#standby 1 track gigabitethernet 5/1 50 |
This configuration may be validated using the show standby [interface] command. This is illustrated in Example 8-16.
Example 8-16: Verifying the HSRP Preemption Time
| VTP-Server-1#show standby vlan 172 Vlan172 – Group 1 State is Active 5 state changes, last state change 00:33:22 Virtual IP address is 172.16.31.254 Active virtual MAC address is 0000.0c07.ac01 Local virtual MAC address is 0000.0c07.ac01 (v1 default) Hello time 3 sec, hold time 10 sec Next hello sent in 1.085 secs Preemption enabled Active router is local Standby router is 172.16.31.2, priority 100 (expires in 7.616 sec) Priority 105 (configured 105) IP redundancy name is “hsrp-Vl172-1” (default) Priority tracking 1 interfaces or objects, 1 up: Interface or object Decrement State GigabitEthernet5/1 50 Up |
Configuring the HSRP Version
As stated previously in this chapter, by default, when HSRP is enabled, version 1 is enabled. HSRP version 2 can be manually enabled using the standby version [1|2] interface configuration command. HSRP version 2 configuration is illustrated in Example 8-17.
Example 8-17: Configuring HSRP Interface Tracking and Decrement
| VTP-Server-1(config)#interface vlan 172 VTP-Server-1(config-if)#standby version 2 |
This configuration may be validated using the show standby [interface] command. This is illustrated in Example 8-18.
Example 8-18: Verifying the HSRP Preemption Time
| VTP-Server-1#show stand vlan 172 Vlan172 – Group 1 (version 2) State is Active 5 state changes, last state change 00:43:42 Virtual IP address is 172.16.31.254 Active virtual MAC address is 0000.0c9f.f001 Local virtual MAC address is 0000.0c9f.f001 (v2 default) Hello time 3 sec, hold time 10 sec Next hello sent in 2.419 secs Preemption enabled Active router is local Standby router is 172.16.31.2, priority 100 (expires in 4.402 sec) Priority 105 (configured 105) IP redundancy name is “hsrp-Vl172-1” (default) |
Enabling HSRP automatically changes the MAC address range used by HSRP from an address in the 0000.0C07.ACxx range to one in the 0000.0C9F.F000 to 0000.0C9F.FFFF range. It is therefore important to understand that this may cause some packet loss in a production network, as devices must learn the new MAC address of the gateway. Such changes are always recommended during a maintenance window or planned outage window.
Configuring the HSRP Timers
HSRP timers are configuring using the standby [number] timers [[hello-time][hold-time]|msec [hello-time][hold-time]|msec[hold-time]] interface configuration command. The [msec] keyword allows administrators to configure timer values in milliseconds.
If the timer values are not configured using this keyword, they will be configured in seconds. Example 8-19 illustrates how to configure a Hello time of 5 seconds and a Hold time of 15 seconds for HSRP group 1.
Example 8-19: Configuring the HSRP Timer Values
| VTP-Server-1(config)#interface vlan 172 VTP-Server-1(config-if)#standby 1 timers 5 15 |
This configuration may be validated using the show standby [interface] command. This is illustrated in Example 8-20.
Example 8-20: Verifying the HSRP Timer Values
| VTP-Server-1#show standby vlan 172 Vlan172 – Group 1 State is Active 5 state changes, last state change 00:54:12 Virtual IP address is 172.16.31.254 Active virtual MAC address is 0000.0c07.ac01 Local virtual MAC address is 0000.0c07.ac01 (v1 default) Hello time 5 sec, hold time 15 sec Next hello sent in 1.463 secs Preemption enabled Active router is local Standby router is 172.16.31.2, priority 100 (expires in 11.599 sec) Priority 105 (configured 105) IP redundancy name is “hsrp-Vl172-1” (default) |
Example 8-21 illustrates how to configure Hello and Hold timers of 15 and 60 milliseconds (ms) respectively for HSRP group 1.
Example 8-21: Verifying the HSRP Millisecond Timer Values
| VTP-Server-1(config)#interface vlan 172 VTP-Server-1(config-if)#standby 1 timers msec 15 msec 60 |
This configuration may be validated using the show standby [interface] command. The output of this command based on this configuration is illustrated in Example 8-22.
Example 8-22: Verifying the HSRP Millisecond Timer Values
| VTP-Server-1#show standby vlan 172 Vlan172 – Group 1 State is Active 5 state changes, last state change 00:56:34 Virtual IP address is 172.16.31.254 Active virtual MAC address is 0000.0c07.ac01 Local virtual MAC address is 0000.0c07.ac01 (v1 default) Hello time 15 msec, hold time 60 msec Next hello sent in 0.007 secs Preemption enabled Active router is local Standby router is 172.16.31.2, priority 100 (expires in 0.048 sec) Priority 105 (configured 105) IP redundancy name is “hsrp-Vl172-1” (default) |
Configuring HSRP Plain Text Authentication
By default, plain-text authentication is enabled for HSRP using the default password ‘cisco’. Cisco IOS software allows administrators to configure a different plain-text password using the standby authentication text [password] or standby [number] authentication text [password] interface configuration commands.
NOTE: If you do not issue the HSRP group number, authentication will be configured for all configured HSRP groups on the interface using the password specified. The group number allows you to configure a different text password for each HSRP group.
Example 8-23 illustrates how to configure a plain text password of SWITCH for HSRP group 1.
Example 8-23: Configuring HSRP Plain Text Authentication
| VTP-Server-1(config)#interface vlan 172 VTP-Server-1(config-if)#standby 1 authentication text SWITCH |
| VTP-Server-2(config)#interface vlan 172 VTP-Server-2(config-if)#standby 1 authentication text SWITCH |
This configuration may be validated using the show standby [interface] command. The output of this command based on this configuration is illustrated in Example 8-24.
Example 8-24: Verifying the HSRP Plain Text Authentication
| VTP-Server-1#show standby Vlan172 – Group 1 State is Active 2 state changes, last state change 01:54:48 Virtual IP address is 172.16.31.254 Active virtual MAC address is 0000.0c07.ac01 Local virtual MAC address is 0000.0c07.ac01 (v1 default) Hello time 15 msec, hold time 60 msec Next hello sent in 0.000 secs Authentication text, string “SWITCH” Preemption enabled Active router is local Standby router is 172.16.31.2, priority 100 (expires in 0.052 sec) Priority 105 (configured 105) IP redundancy name is “hsrp-Vl172-1” (default) |
Configuring HSRP MD5 Authentication
Cisco IOS software allows administrators to configure MD5 authentication for HSRP with or without a key chain. The standby authentication md5 key-string [password] or standby [number] authentication md5 key-string [password] interface configuration commands are used to configure HSRP MD5 authentication without configuring a key chain.
NOTE: If you do not issue the HSRP group number, authentication will be configured for all configured HSRP groups on the interface using the password specified. The group number allows you to configure a different text password for each HSRP group.
Example 8-25 illustrates how to configure an MD5 password of SWITCH for HSRP group 1.
Example 8-25: Configuring HSRP MD5 Authentication with no Key Chain
| VTP-Server-1(config)#interface vlan 172 VTP-Server-1(config-if)# standby 1 authentication md5 key-string SWITCH |
| VTP-Server-2(config)#interface vlan 172 VTP-Server-2(config-if)#standby 1 authentication md5 key-string SWITCH |
This configuration may be validated using the show standby [interface] command. The output of this command based on this configuration is illustrated in Example 8-26.
Example 8-26: Verifying the HSRP MD5 Authentication
| VTP-Server-1#show standby Vlan172 – Group 1 State is Active 2 state changes, last state change 01:59:41 Virtual IP address is 192.168.1.254 Active virtual MAC address is 0000.0c07.ac01 Local virtual MAC address is 0000.0c07.ac01 (v1 default) Hello time 15 msec, hold time 60 msec Next hello sent in 0.007 secs Authentication MD5, key-string Preemption enabled Active router is local Standby router is 172.16.31.2, priority 100 (expires in 0.040 sec) Priority 105 (configured 105) IP redundancy name is “hsrp-Vl172-1” (default) |
NOTE: Notice that when MD5 authentication is enabled, the password string is not displayed in the output of theshow standby [interface] command. The only way to view the configured password is to issue the show running-config [interface][name] command on the switch.
The configuration of HSRP using key chains requires the use additional global configuration commands to create the key chain, which are then associated with the HSRP authentication. Key chains contain the keys that are configured with the actual password to be used for authentication. Think of a key chain as a something of an authentication route-map. The route-map itself does nothing, but it is required in order to be able to create match and set clauses that perform the required actions.
Similarly, the key chain is required to be able to configure the keys, which contain the actual passwords that are used for routing protocol authentication. The keys should be the same on the gateways on which authentication is being configured. In addition, the password in the keys (the key-string) must be the same in order for authentication to be successful. The following describes the configuration commands required to configure key chains in Cisco IOS.
- Configure and name the key chain to be used for authentication using the key chain [name] global configuration command
- Configure a key for the key chain. Multiple keys may be configured for each key chain. The key is configured using the key [number] key chain configuration command. The valid [number] range is 0-2147483647; though this may vary depending on IOS image or platform.
- Configure a password (secret) for the key using the key-string [password] key chain key configuration command.
- Optionally configure advanced key lifetime parameters using the send-lifetime and accept-lifetime key chain key configuration commands.
NOTE: You are not expected to perform advanced key chain configuration using the send-lifetime and accept-lifetime key chain key configuration commands. More information on these commands can be found in the ROUTE certification guide on www.howtonetwork.net, under the EIGRP configuration section, as well as in the current SWITCH exam labs available online.
Example 8-27 illustrates how to configure an MD5 password of SWITCH for HSRP group 1 using key chains on VTP-Server-1 and VTP-Server-2.
Example 8-27: Configuring HSRP MD5 Authentication with a Key Chain
| VTP-Server-1(config)#key chain VTP-Server-1-HSRP-Key-Chain VTP-Server-1(config-keychain)#key 1 VTP-Server-1(config-keychain-key)#key-string SWITCH VTP-Server-1(config-keychain-key)#exit VTP-Server-1(config-keychain)#exit VTP-Server-1(config)#interface vlan 172 VTP-Server-1(config-if)#standby 1 authentication md5 key-chain VTP-Server-1-HSRP-Key-Chain VTP-Server-1(config-if)#exit |
| VTP-Server-2(config)#key chain VTP-Server-2-HSRP-Key-Chain VTP-Server-2(config-keychain)#key 1 VTP-Server-2(config-keychain-key)#key-string SWITCH VTP-Server-2(config-keychain-key)#exit VTP-Server-2(config-keychain)#exit VTP-Server-2(config)#interface vlan 172 VTP-Server-2(config-if)#standby 1 authentication md5 key-chain VTP-Server-2-HSRP-Key-Chain VTP-Server-2(config-if)#exit |
NOTE: Notice that although the key chain names on both switches are different, both keys are using the same key number and the same key string (password).
This configuration may be validated using the show standby [interface] command. The output of this command based on this configuration is illustrated in Example 8-28.
Example 8-28: Verifying the HSRP MD5 Key Chain Authentication
| VTP-Server-2#show standby Vlan172 – Group 1 State is Standby 79 state changes, last state change 00:02:00 Virtual IP address is 192.168.1.254 Active virtual MAC address is 0000.0c07.ac01 Local virtual MAC address is 0000.0c07.ac01 (v1 default) Hello time 15 msec, hold time 60 msec Next hello sent in 0.000 secs Authentication MD5, key-chain “VTP-Server-2-HSRP-Key-Chain” Preemption enabled, delay min 30 secs Active router is 192.168.1.1, priority 105 (expires in 0.012 sec) Standby router is local Priority 100 (default 100) IP redundancy name is “hsrp-Vl172-1” (default) |
In the output above, on the standby router, we can see that HSRP is using a key chain named for authentication. However, the password in that key chain is not included, for security purposes. To view the configured key or keys use the show key chain [name] command, as illustrated in Example 8-29.
Example 8-29: Verifying Key Chain Configuration
| VTP-Server-2#show key chain Key-chain VTP-Server-2-HSRP-Key-Chain: key 1 — text “SWITCH” accept lifetime (always valid) – (always valid) [valid now] send lifetime (always valid) – (always valid) [valid now] |
NOTE: Once a key chain has been configured and applied, all keys are immediately activated and the passwords used in those keys are used for authentication. This default behavior can be adjusted using the accept lifetimeand send lifetime commands.
Debugging Hot Standby Router Protocol
Although FHRP debugging and troubleshooting will be covered in detail in the TSHOOT guide, the debug standby command can be used to debug HSRP operation. The options that are available with this command are shown in Example 8-30.
Example 8-30: Debugging Hot Standby Router Protocol
| VTP-Server-1#debug standby ? errors HSRP errors events HSRP events packets HSRP packets terse Display limited range of HSRP errors, events and packets <cr> |