Network Ninja

Hot Standby Router Protocol (HSRP) is the protocol mentioned in the previous post that rolls gateways, Proxy ARP and redundancy into one “protocol”.

HSRP defines a group of standby routers, with one active router. The protocol (HSRP) provides gateway redundancy by sharing an IP and MAC Address between the redundant gateways; this is all done transparently to the end-devices.

A HSRP group comprises of these “entities”:

1. One Active Router – the router that is currently forwarding packets for the virtual router
2. One Standby Router – The primary backup router for the virtual router
3. One Virtual Router – The set of routers participating in HSRP that jointly emulate a virtual router
4. Other Routers

An HSRP group is not a virtual router look carefully at the table, one of the HSRP elements that makes up the group is a virtual router.

HSRP Operation – Virtual Router

The virtual router is what the end-devices use for communicating with the “gateway”. This is the IP and MAC Address configured on the end-devices. NB The virtual router processes no physical frames.

HSRP Operation – Active Router

An HSRP group has one elected active router that physically forwards packets sent to the virtual router MAC address. This means that this active router responds to traffic.

If an end-device sends an ARP request to the virtual router IP Address, the active router replies with the virtual router MAC Address.

The HSRP active and standby routers send hello messages to the multicast address 224.0.0.2 User Datagram Protocol (UDP) port 1985

HSRP Operation – Standby Router

The function of the standby router is to monitor the operation of the HSRP group and quickly assume the packer-forwarding responsibility if the active router goes down.

The HSRP active and standby routers send hello messages to the multicast address 224.0.0.2 User Datagram Protocol (UDP) port 1985.

HSRP Operation – Other Router

There are or could be other routers in the HSRP group that are neither active nor in standby, these routers monitor the hello messages and ensure that an active and standby route exist. These “other” routers issue speak messages at every hello from the active and standby router. These routers forward packets addressed to their own IP Addresses but they do not forward packets for the virtual router.

HSRP Operation – Active and Standby

Because an HSRP group has at least two routers there is at least an active and standby router in the group at any one time.

When the Active Router fails the other routers stop seeing hello messages from the Active Router. The standby router will then assume the active role in this case. If there are other routers in the HSRP group they will then contend to become the new standby router.

In the unlikely event that both the active and standby router fails, all routers in the group will contend for the active and standby roles.

The settings that can be set for message intervals and delays as outlined below:

1. Hello Message Interval – Interval between successive HERP hello messages from a router is default 3 seconds.
2. Hold interval time – interval between receipt of hello and presumption that sending router has failed is default 10 second.

HSRP and ARP

The IP and MAC Address of the virtual router is maintained in each of the HSRP groups ARP tables. The command used to view the ARP cache on a Cisco Catalyst multilayer switch is:
switch#show ip arp
The output as I mentioned will show the ARP cache in a table output; the MAC Address will be in the following format, notice that end-devices have the starting digits normally 01 while the virtual router has a starting digit of 00.

HSRP States

• Initial – This is the state at the start, this state indicates that HSRP does not run. This state is entered through a configuration change or when an interface first comes up.
• Learn – The router is neither active or standby, nor does it have enough information to claim the active or standby role.
• Listen – The router knows the virtual router IP Address but is not active or standy. It listens to the hello messages.
• Speak – The router sends periodic hello messages and actively participates in the election of active or standby router. A router cannot enter this state unless the router has the Virtual IP address.
• Standby – The router is a candidate to become the net active router and sends periodic hello messages. There is at most one router in this state (except for transition periods).
• Active – The router that forwards packets for the virtual router MAC Address (also replies to ARP requests to virtual routers IP Address). The router sends periodic hello messages. There must be one route in the active state in the group (except for transition periods).

HSRP State Transition

All routers begin in the initial state, this starting state indicates that HSRP is not running on the router, this state is entered into via configuration changes (when HSRP is first brought up, when no shutdown is used). The listen state is there for routers to determine if there are already active or standby routers in the HSRP group. In the peak state, routers actively participate in the election of active routers or standby routers.

1. Active Timer – Used to monitor the active router, resets any time a router in standby group receives a hello packet from the active router. This timer expires the same as the hold time value set in the HSRP hello message.
2. Standby Timer – Used to monitor the standby router, resets any time a router in standby group receives a hello packet from from the standby router. This timer expires the same as the hold time value set in the respective packet.
3. Hello Timer – Used to clock hello packets, all HSRP routers in any HSRP state generate a hello packet when this timer expires.

Configuration

I created a fictional network because I work better when I can “see” what is going on, in the example you have a “distribution” and access portion of the network.

From top down you have two distribution multilayer switches connected to the single layer-2 switch that feeds out three end-devices (workstations in this case). Now the task is to configure HSRP on the MLSs at the distribution level. This will enable the end-devices to be configured with a single IP Address for a gateway and transparent failover should something go wrong.

We start off with configuring HSRP on an interface (this includes the group number). The IP Address is that of the virtual gateway (default group number is 0). To disable add no to the front of the command.

switch>enable
switch#config term
switch(config)#interface gigabitethernet 0/1
switch(config-if)#standby 0 ip 192.168.0.1

To verify configuration of HSRP there is two commands. The first will show the configuration for everything so you can check all config.

switch#show run

The second command is standby (HSRP) specific, add commands (use ? to minimize on the amount of output)

switch#show standby

Note: While running HSRP, the standby routers IP address must not be visible (discovered or discoverable) to the end-devices. Any protocol that informs end-devices of routers actual IP Addresses must be disabled. When enabling HSRP on Cisco Catalyst Routers the interface auto disables Internet Control Message Protocol (ICMP) redirects (This causes problems later on).

HSRP Optimization

On Cisco Catalyst Layer-3 switches there are options available (optimization features) to take the guess work out of HSRP configuration and operations. HSRP options available:

• Standby priority - Allows the network admin to control the order in which active routers for a group is selected.
• Standby preempt - allows a router to regain its role of active router even if there is an existing active router on a segment.
• Hellow message timer adjustment - configure the time between hello packets and the time before other routers declare active routers are down
• HSRP Interface Tracking - interface configuration command ties the router hot standby priority to the availability of its interface and is useful for tracking interfaces that are not configured for HSRP.

Standby Priority

As explained each HSRP group has its own active and standby routers. A Network Admin can assign a priority to each router in the group allowing the admin to actively control in which order what router will assume active router status.

The router with the highest priority will become the HSRP group active router. In cases of a tie, the router with the highest configured IP address will become the HSRP group active router.

The command for this is (to reset to default no standby priority):
switch(config-if)#standby 1 priority priority-value

As with life there are exceptions and problems. In a network environment where as an example over time new equipment was added, lets say the old equipment is being used as failover standby kit. So lets say an 877 Series Router is standby for a 2851 Series. The speed difference between the routers would determine the HSRP Active router (the one that boots up first) and not the priority value UNLESS preempt is configured.

The command for this is:
switch(config-if)#standby 1 preempt

Standby Preempt

As explained in the paragraph above the command standby group-number preempt allows the network admin (you, me or whoever) to configure a HSRP group to respect the standby group-number priority.

Using my above example of our mixed router network (routers purchased over time as the business grew with demand), lets say that the 2851 router is configured to be our Active router (highest priority, highest IP address combination), with the 877 as standby.

If something were to happen or go wrong with the 2851, the natural progression would be 877 becomes the Active Router. When the 2851 comes back online unless something happens to the stability of the network again causing the 877 to fail the 2851 won’t become the active router (EVEN if it has a higher priority and IP address).

This is where standby group-number preempt comes in where the former active router is configured to resume the forwarding (active router) position role by preempting a router with a lower priority.

Now that we have a predictable failover and “recovery” what happens when maintenance occurs? In the boot process some interfaces and processes take longer than others. Optimally we want all interfaces and all processes stable before rejoining the HSRP group and becoming the Active Router.

To do this, measure the boot time (stopwatch) and set the HSRP preempt delay to a value 50 percent greater than the boot time. This ensures that the primary distribution switch establishes full connectivity to the network before HSRP communication occurs.

switch(config-if)#standby 1 preempt
switch(config-if)#standby 1 delay minimum 180

HSRP Message Timers

The hello message contains the priority of the router and also the hellotime and holdtime parameter values.

1. hellotime holds the interval between the hello messages that the router sends.
2. holdtime holds the amount of time that the current hello message is considered valid.

The standby timer includes an msec parameter to allow for subsecond failover. Lowering the hello timer results in increased traffic for hello messages and should be used with caution.

The procedure is that when a router sends a hello message( every 3s), a receiving router considers that hello message to be valid for one hold time(every 10s). The holdimte value should be at least three times (x3) the value of the hellotime. the holdimte value must be greater than the value of the hellotime.

default HSRP hellotime 3 seconds

default HSRP holdtime 10 seconds

This means that failover could be as much as 10 seconds before communication is restored and end-devices begin communicating with a new gateway. The hellotime and holdtime intervals must be identical for ALL DEVICES in a HSRP group.

The configuration is with the 1 being the group-number, hellotime in seconds, holdtime in seconds both from 1 to 255 (to disable no standby group-number timers):
switch(config-if)#standby 1 timers [msec] hellotime holdtime

As said the HSRP hellotime and holdimte can be set in millisecond values so that HSRP failover occurs in less than 1 second.

switch(config-if)#standby 1 timers msec 250 msec 940

HSRP Interface Tracking

In some cases the status of an interface will directly affect which router needs to be the active router. This is true when each router in an HSRP group has a different path to different resources within a campus. Especially considering that some resources are more important than others in some topologies.

The network diagram depicts two distribution areas connected via links A and B.

If the HSRP Active Router link between the buildings (A) were to KONK then a Internet Control Message Protocol (ICMP) redirect would be sent to the standby router to notify it of the problem; problem being that in HSRP ICMP is disabled.

So neither Active Router nor the Virtual Router sends a ICMP redirect. Added to that the Active Router link A remains down and is not able to send/receive packets yet the active router still communicates hello messages out link AA because, the router is still functioning fine, the link AA stil works (connection to Standby Router); i.e. there is no problem right?

To solve this problem interface tracking enables the priority of a router to be automatically adjusted dependant on a tracked interface of that router. So when a tracked interface on that router becomes unavailable (like in the example), the priority is adjusted (plus x or minus x depending on whether an interface comes online or goes offline).

So to restate the example with interface tracking if link A were to down (tracked interface) then the router automatically decreases the priority on that router and stops transmitting hello messages on AA. The standby Router assumes the Active Router role when no hello messages are detected (i.e. Standby Router assumes a failure) and takes over the building link.

Problem Solved.

To implement this use the following command string, standby group-number track interface 0/0 priority. This can be configured on a VLAN or a interface. Shown below is the application to an interface VLAN change the VLAN for a interface gigabitethernet 0/1

To disable this command use no standby group-number track:
switch(config)#interface vlan10
switch(config-if)#standby 1 track gigabitethernet 0/1 30

NB: preempt must be configured on all interfaces within this HSRP group.

The priority command is the value that HSRP will be decrements (minus) when disabled and incremented (plus) if enabled. The default is 10.

HSRP Load Sharing

All examples up until now have been a single HSRP group with a single “network”. This will allow for a single router (Active Router) in the HSRP group to forward packets for the virtual router for the entire network.

To facilitate load sharing where both routers participate in a HSRP group (see network diagram). In the example diagram a single router could be a member of both Groups. There can be up to 255 standby groups on a LAN but the needed groups should not be more than the number of needed Active Routers (in this case 2).

If a Router has to participate in more than one group, it increases the load on the router and thus decreases performance. If you want to be funny and use 255 groups then expect heavy performance impact.

The config for this would look something like this:
switchA(config)interface VLAN 10
switchA(config-if)ip address 192.168.0.32 255.255.255.0
switchA(config-if)no ip redirects
switchA(config-if)standby 1 priority 150
switchA(config-if)standby 1 ip 192.168.0.100
switchA(config-if)standby 2 priority 50
switchA(config-if)standby 2 ip 192.168.0.110

Then on the other router:
switchB(config)interface VLAN 10
switchB(config-if)ip address 192.168.0.33 255.255.255.0
switchB(config-if)no ip redirects
switchB(config-if)standby 1 priority 150
switchB(config-if)standby 1 ip 192.168.0.100
switchB(config-if)standby 2 priority 50
switchB(config-if)standby 2 ip 192.168.0.110

HSRP Accross Trunk Links
To start getting more practical (this is basically how Ive setup my network) with a distribution area feeding to an access area with multiple VLANs; I have each end-device in a separate VLAN (meaning each workstation in a VLAN in a range, each IP Phone in a VLAN in a range, printers, server and so on) this is heavy overkill but I wanted practice when I did the setup and needed to do some repetitive config work to make it stick in my head.

By configuring HSRP over trunk (802.1Q or ISL), we can eliminate situations where a single point of failure causes traffic interruptions. This inherently provides improvements in overall networking resilience by providing load balancing and redundancy capabilities between subnets and VLANs should one of the Distribution layer links or routers fail.

What was said in the previous section still applies; For each VLAN, a standby group, an IP Address, and a single well-known MAC address with a unique group ID is allocated (but as mentioned keep the groups to a minimum for performance reasons).
To configure this:
switchA(config)interface VLAN 2
switchA(config-if)ip address 192.168.20.1 255.255.255.0
switchA(config-if)no ip redirects
switchA(config-if)standby 1 priority 150
switchA(config-if)standby 1 ip 192.168.0.102
switchA(config)interface VLAN 3
switchA(config-if)ip address 192.168.30.1 255.255.255.0
switchA(config-if)no ip redirects
switchA(config-if)standby 2 priority 50
switchA(config-if)standby 2 ip 192.168.0.103

Then on the other router:
switchB(config)interface VLAN 2
switchB(config-if)ip address 192.168.20.2 255.255.255.0
switchB(config-if)no ip redirects
switchB(config-if)standby 1 priority 150
switchB(config-if)standby 1 ip 192.168.0.102
switchB(config)interface VLAN 3
switchB(config-if)ip address 192.168.20.2 255.255.255.0
switchB(config-if)no ip redirects
switchB(config-if)standby 1 priority 50
switchB(config-if)standby 1 ip 192.168.0.103

HSRP Debug

The commands used to debug HSRP are as follows:
switch#debug standby [errors] [events] [packets]
switch#debug standby terse
To kill debug output
switch#no debug standby
switch#no debug all

Be aware that debug processes are assigned a high CPU priority and any command that will cause LOTS of output, like all HSRP messages display WILL render the system unusable and mean you will need to reboot the router. (If you didn’t save changes you will wish you did)

Notes and Notices:

This is a part of my personal BCMSN notes and research to assist myself in learning and understanding the concepts and theory for the BCMSN exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BCMSN Certification.

References I want to remember

Hucaby, D. (2007). CCNP Self-Study: CCNP BCMSN Official Exam Certification Guide, Fourth Ed, Router Redundancy in Multilayer Switching (page. 318-347). Indianapolis: Cisco Press.