HSRP (Hot Standby Routing Protocol)

Hi Rene

I have a question with the objects that can be created in a track like this:

Switch (config) # track 1 list threshold weight
Switch (config-track) # object 1 weight 15
Switch (config-track) # object 2 weight 20
Switch (config-track) # object 3 weight 30
Switch (config-track) # threshold weight up 30 down 10

How do you associate these objects to certain interfaces or certain IP sla?

Hello Jorge

Object tracking allows you to create specific objects to track, and based on their state, respond in some way. Object tracking separates the creation and definition of an object from the actual tracking of the object.

In the above configuration, you have created a track list. This track list tracks multiple objects at the same time. In any case, once an object or a track list is defined, it can then be referenced when tracking.

For example, once your tracked list is created, you would then go to the interface for which you would like to use this tracked object, and configure something like this:

Switch(config)# interface gigabitethernet 0/1
Switch(config-if)# standby 15 track 1 decrement 10

In this case, the “1” in the command references the track list that you created. This is the object to be tracked.

If you wanted to reference it using an IP SLA, you would once again reference the object using its object number, in this case, “1”.

More info about these commands can be found here:

I hope this has been helpful!

Laz

Hi,

Can someone confirm please if HSRP requires the use of the same router models? Also is it possible to use the track function on one router too track an ethernet connection and on the standby router a serial connection?

Thanks again.

Hello Lee

HSRP, like all first-hop redundancy protocols, is platform-independent. You can even run it between an ASR router and an L3 switch if you like. Additionally, you can track whatever interface you like on one device, while tracking another on another device. There is no restriction on the type of tracking you apply to each device.

I hope this has been helpful!

Laz

Hi Laz,

Do you know by any chance why would the hsrp configured on a vlan from time to time change its own configurations ?

so we have 2 5k nexus switches with vpc configured and hsrp for some reason between them, and I have noticed that from time to time in the vlan where we have all these hsrp configurations it appears that “mtu 9216” and “no shutdown” command would appear and disappear. state change does not change, everything seems to be working fine.

Also, Another question.

What is the point of using hsrp with nexus VPC, isnt it a whole point of using vpc for redundancy ?
I have tried finding a purpose of that , but the only thing I could find is an explanation of how it all works. here is a good article about it https://networkdirection.net/articles/virtual-port-channels-vpc/vpcwithhsrpvrrp/

but what is the purpose of using hsrp with vpc ?

myabe the reason is just to have a gateway ?

thank you

Regards,

Max

Hello Maksym

So from my understanding, your topology, as well as your HSRP configuration, are working fine. There are no state changes in your HSRP configuration. When you say that the “mtu 9216” and “no shutdown” commands would appear and disappear, where do you see that? In the configuration of the VLAN interface itself? So when you do a show run interface vlan 100 one time, you see these commands, and the next time you don’t? Please clarify, or give us some output of your show commands to confirm.

For your second question…

HSRP and vPC do two different things.

vPC allows you to interconnect two Nexus switches making them appear as a single logical node to other devices. vPC essentially doubles the available bandwidth (by simply adding a second device through which traffic can pass) while maintaining a layer 2 loop-free topology (no STP needs to function). So vPC primarily scales up the size of the Layer 2 network.

HSRP however, is a gateway redundancy protocol, meaning it operates on L3.

Now having said that, HSRP and vPC do work well together. When configured together, you have the following advantages:

  • HSRP operates in an active/active arrangement. That means that both devices forward traffic (unlike HSRP on an IOS device). They actually perform gateway load balancing much like GLBP on IOS.
  • vPC will help “tune” HSRP so that is why Cisco recommends configuring HSRP with the default settings when using vPC. In a regular HSRP configuration, you as the administrator will tune the timers to enable fast failover. When used with vPC, it is vPC that will handle the failover.

I hope this has been helpful!

Laz

Hello Laz, thank you for the response.
Yeh looks like the HSRP and VPC was just for the gateway purpose.

in regards of the other issue. yes this is pretty much what happens. I have created a script to monitor any changes on the switches, and I have noticed that a few switches in VPC mode would do it for a few vlans, the funny thing there is another vlan that is compeltelly shutdown on these nexus switches and they have the same thing happening on them even thou they are in administratively shutdown state
So I started to look into it.
I have followed with my management and they have advised that there is nothing automated to do such a thing.

Please see below

this is what it looks like at one point

interface Vlan207
  no ip redirects
  ip address x.x.x.x/x
  hsrp version 2
  hsrp 207
    authentication md5 key-chain x
    preempt
    priority 105
    timers  1  3
    ip x.x.x.x
  no shutdown
  mtu 9216

also what it looks like "sh run int vlan 207 all"

interface Vlan207
  no ip redirects
  ip address x.x.x.x/x
  ip port-unreachable
  ipv6 nd hop-limit 64
  ipv6 nd mtu 1500
  ipv6 nd ns-interval 1000
  ipv6 nd ra-interval 600
  ipv6 nd reachable-time 0
  ipv6 nd retrans-timer 0
  ipv6 redirects
  ipv6 mld version 2
  ipv6 mld robustness-variable 2
  ipv6 mld query-interval 125
  ip arp timeout 1500
  ip arp gratuitous update
  ip arp gratuitous request
  no hsrp bfd
  hsrp version 2
  hsrp delay minimum 0 reload 0
  no hsrp use-bia
  hsrp 207
    authentication md5 key-chain x
    name hsrp-Vlan207-207
    mac-address xxxx.xxxx.xxxx
    preempt
    priority 105
    timers  1  3
    ip x.x.x.x
  no shutdown
  mtu 9216
  bandwidth 1000000
  delay 1
  medium broadcast
  snmp trap link-status
  no description
  carrier-delay msec 100
  load-interval counter 1 60
  load-interval counter 2 300
  no load-interval counter 3
  mac-address xxx.xxxx.xxxx

and this is what it looks like the other second

interface Vlan207
  no ip redirects
  ip address x.x.x.x/x
  hsrp version 2
  hsrp 207
    authentication md5 key-chain x
    preempt
    priority 105
    timers  1  3
    ip x.x.x.x

also what it looks like "sh run int vlan 207 all"


interface Vlan207
  no ip redirects
  ip address x.x.x.x/x
  ip port-unreachable
  ipv6 nd hop-limit 64
  ipv6 nd mtu 1500
  ipv6 nd ns-interval 1000
  ipv6 nd ra-interval 600
  ipv6 nd reachable-time 0
  ipv6 nd retrans-timer 0
  ipv6 redirects
  ipv6 mld version 2
  ipv6 mld robustness-variable 2
  ipv6 mld query-interval 125
  ip arp timeout 1500
  ip arp gratuitous update
  ip arp gratuitous request
  no hsrp bfd
  hsrp version 2
  hsrp delay minimum 0 reload 0
  no hsrp use-bia
  hsrp 207
   authentication md5 key-chain x
    name hsrp-Vlan207-207
    mac-address xxxx.xxxx.xxxx
    preempt
    priority 105
    timers  1  3
    ip x.x.x.x

thank you Laz.

Hello Maksym

Hmm, that is indeed strange. I haven’t come across something like this before. There are two things to address here: the statements found within the config, and the actual operation of the device.

For the no shutdown command, when an interface is up and running, of course, the no shutdown command is valid for such an interface, whether it appears in the configuration or not. So whether it appears or not doesn’t actually affect its operation. Some IOS and NX-OS versions display it in the config while others do not. I haven’t come across a situation where it is intermittently displayed, however.

Secondly, for the MTU value of 9216 appearing and disappearing, I’d like to ask, do you find that the actual value of the MTU fluctuates as well? For example, if you were to try to send a series of pings that traverse this VLAN with an MTU set to 9216, do you find that sometimes they pass through and others they don’t? In other words, is the actual operation of the switch affected by whether or not the MTU value is displayed? I assume not. In any case, this MTU value can be assigned either on a particular Layer 3 interface, or an SVI directly, using one of the following methods:

  1. for a particular interface using the mtu 9216 command in the interface configuration mode
  2. using system jumbomtu 9216 in the global configuration mode to set the value for all interfaces on the whole switch
  3. by setting the MTU using the policy map for the class-default class like so:
switch(config)#policy-map type network-qos jumbo
switch(config-pmap-nq)#class type network-qos class-default
switch(config-pmap-c-nq)#mtu 9216
switch(config-pmap-c-nq)#exit
switch(config-pmap-nq)#exit
switch(config)#system qos
switch(config-sys-qos)#service-policy type network-qos jumbo

Depending on the NX-OS version, some options may not be available. In any case, if the MTU is configured in one of these ways, it may be that it appears and disappears depending upon the way in which it was configured. Since your configuration has a vPC as well, you may want to ensure that the configuration synchronization between the switches is taking place correctly too. I don’t have a Nexus device handy to check it out, but you may want to see how the MTU was set, which may shed some light on this strange behavior.

Finally, you stated that:

Is this the case for the no shutdown command as well? That is highly unusual since this command indicates that the interface is indeed up, even though you state that it has been administratively shutdown. It that is the case, then this is a strange situation indeed!

Looking forward to hearing your responses!

I hope this has been helpful!

Laz

I built the lab in the lesson and paste the config you provided. However, I can not ping from the router to 192.168.1.x network. I did not want to alter the lab to make it work.

Hello David

I took a look at the final configs at the end of the lesson and I didn’t find any readily perceivable problem with the configurations.

I suggest you follow the lesson from the beginning, step by step, and if there is indeed an incorrect configuration, you should be able to discover it along the way. That way it will help you understand each step, and help you identify where the problem may possibly be.

Let us know how you get along, and if you get stuck somewhere, feel free to let us know!

I hope this has been helpful!

Laz

Hi Rene,

How are you able to physically connect the host to two different MLS’s using only 1 interface from the host side ?

Br,
Amr

Hello Amr

I understand your confusion. It is supposed that there is a Layer 2 switch there. As you can see, the Gi0/1 interface of SW1, the Gi0/1 interface of SW2, and the NIC of H1 are all on the same subnet of 192.168.1.0/24. This means that they are on the same Layer 2 segment. Ideally, there should be an icon of a switch there.

I will ask Rene to update the diagram for clarification.

I hope this has been helpful!

Laz

1 Like

Thanks Laz!
It’s clear now.

Br,
Amr

1 Like

Hi Rene

I have a question. In the multilayer switch config, we have not assigned the ip 192.168.1.1 to Gi0/1 . Similalry for Gi0/2
Only under vlan config , the ip is present (192.168.1.1). Can you pls explain how Gi0/1 which is connected to host gets the ip configured?

Hello Anath

When working with multilayer switches, there are two options that you can use for assigning IP addresses to Layer 3 interfaces.

In the example in the lesson, Rene could have configured Gi0/1 on both switches as a routed interface. A routed interface is a Layer 3 interface to which you can assign an IP address. Essentially, such a configuration makes that interface function the same as an interface on a router.

To configure a routed interface, use the following commands:

SW1(config)#interface gi0/1
SW3(config-if)#no switchport
SW3(config-if)#ip address 192.168.1.1 255.255.255.0

The second option is to create what is known as a Switched Virtual Interface, or an SVI. This is a virtual interface created on the specific VLAN (VLAN1 in the case of the lesson), and this is what Rene created in the lesson. All Layer 3 configurations, such as IP address and subnet mask are configured there. In that way, all hosts connected to an access port on VLAN1 on the switch have direct access to that Layer 3 interface as a default gateway. The advantage here is that multiple hosts can connect to multiple access ports on VLAN 1 and have access to that default gateway.

In the case of the routed port, you would need another physical switch to connect to that port for multiple hosts to access the default gateway.

You can find out more information about SVIs, routed ports, and related issues, take a look at the following lesson:

You may also find the following NetworkLessons notes useful:

I hope this has been helpful!

Laz

Hello network lesson,
I use eve-ng , R1 , SW2, SW3 run RIP, VPC set gateway as 192.168.1.254, R1 can ping 192.168.1.254 but cannot ping VPC (192.168.1.100). I unknown whether it is the reason from eve-ng emulator.

R1

interface Ethernet0/0
 no ip address
 shutdown
!
interface Ethernet0/1
 ip address 192.168.13.3 255.255.255.0
!
interface Ethernet0/2
 ip address 192.168.23.3 255.255.255.0
!
interface Ethernet0/3
 no ip address
 shutdown
!
router rip
 version 2
 network 192.168.13.0
 network 192.168.23.0

SW3

no ip domain-lookup
ip cef
no ipv6 cef
!
!
!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
track 1 interface Ethernet0/2 line-protocol
!
interface Ethernet0/0
!
interface Ethernet0/1
!
interface Ethernet0/2
 no switchport
 ip address 192.168.23.2 255.255.255.0
 duplex auto
!
interface Ethernet0/3
!
interface Vlan1
 ip address 192.168.1.2 255.255.255.0
 standby 1 ip 192.168.1.254
 standby 1 timers msec 100 msec 300
 standby 1 priority 150
 standby 1 preempt delay minimum 60
 standby 1 authentication md5 key-string MY_SECRET_KEY
 standby 1 track 1 decrement 60
!
router rip
 version 2
 network 192.168.1.0
 network 192.168.23.0
 no auto-summary
!
ip forward-protocol nd

SW2

no ip domain-lookup
ip cef
no ipv6 cef
!
!
!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface Ethernet0/0
!
interface Ethernet0/1
!
interface Ethernet0/2
 no switchport
 ip address 192.168.13.1 255.255.255.0
 duplex auto
!
interface Ethernet0/3
!
interface Vlan1
 ip address 192.168.1.1 255.255.255.0
 standby 1 ip 192.168.1.254
 standby 1 timers msec 100 msec 300
 standby 1 preempt delay minimum 60
 standby 1 authentication md5 key-string MY_SECRET_KEY
!         
router rip
 version 2
 network 192.168.1.0
 network 192.168.13.0
 no auto-summary
!
ip forward-protocol nd

Hello Chun

At first glance, I don’t see any problems with your configuration. I suggest you take a look at the routing tables of SW2 and SW3 to ensure that they will forward the packets to the VPC correctly, and that return traffic will be forwarded corectly as well. You can also attempt pings in the other direction, from the VPC to R1, and from the VPC to the e0/2 interfaces of SW2 and SW3. This way you can detect where the communication is breaking down.

Once you determine that, you can then move to resolve the problem. Let us know how you get along and if we can be of further help for you!

I hope this has been helpful!

Laz

Thx replay,
I find if switch use interface not vlan 1 , it will work. It should be problem of eve-ng emulate.
How to move this to resolve the problem

Hello Chun

Hmm, that’s interesting. That would be one solution to the problem. It may be that the EVE-NG emulator is at fault. I’m not sure how you can resolve this issue within the EVE-NG environment. Have you tried emulating the same thing on GNS3 or VIRL? If you have access to those emulators it may be worth testing it out. If you do so, let us know your results.

I hope this has been helpful!

Laz

Hello ,
I have tried to use GSN3 0.87 version. R3 can successfully ping PC, but PC with gateway (192.168.1.254) cannot ping R3. R3 cannot ping hsrp virtual ip(192.168.1.254).
I think it should be GNS3 bug.
I upload gns3 project file, you can try.
HSRP.zip (53.7 KB)