First-Hop Redundancy

Implementing Cisco IP Switched

Networks (SWITCH) Foundation
Learning Guide

SWITCH Chapter 6 Overview

Overview of First Hop or Defaultgateway Redundancy
Configure and verify HSRP
Configure and verify VRRP
Configure and verify GLBP

Overview of FHRP and HSRP

HSRP overview
HSRP state transitions
Aligning HSRP with STP topology
Configuring and tuning HSRP
Load sharing with HSRP
Options for HSRP
Configuring HSRP interface tracking
Configuring object tracking in combination with
HSRP
Configuring HSRP authentication
Tuning HSRP timers
The differences between HSRPv1 and HSRPv2

Overview of default gateway

redundancy
Hosts and servers in a subnet need a
gateway to reach devices that are not in
the same subnet
Hosts either use default-gateway or proxyarp to reach devices on the other subnets
With proxy-arp technique, a layer 3 device
offers its own MAC address in response to
an ARP query to a MAC address that exist
outside the source subnet and handling the
communication

The need for First-Hop

Redundancy

First-Hop Redundancy
Overview

HSRP Overview

Virtual router
Active router
Standby router
Other routers

HSRP Active Router

Operation

HSRP State Transition

Standby ____ ip _______ default group is 0

Default priority is 100
Default is NO preempt

HSRP State Transition

Aligning HSRP with STP

Topology

Layer 2 adjacency requirs hello exchange

HSRP v1 destination address 224.0.0.2 > udp/1985
HSRP v1 MAC: 0000.0c07.ACxx > xx is the group id
HSRP v2 MAC: 0000.0c9F.Fxxx > xxx is the group id
HSRP v2 destination address 224.0.0.102 > udp/1985
IPv6 MAC: 00:05:73:a0:0X:XX FF02::66 > udp/2029

Configuring and Tuning

HSRP

Detailed Topology with IP addresses

Forwarding through the Active Router

HSRP Operation -R2 Active

HSRP Operation -R2 Failure

HSRP States After R2 Failure

After R2 Recovers

Load Sharing with HSRP

MultiGroup HSRP Config on

SW1

MultiGroup HSRP Config on

SW2

The need for interface tracking with

HSRP
HSRP can track interfaces or objects
Decrement priority based on tracked object status
HSRP tracking feature ensures that a router with
an unavailable key interface will relinquish the
active router role
When the defined conditions remain the same the
router priority remains the same 100 default
When the tracked object status changes, the
router priority is decremented 10 default

HSRP Interface Tracking

HSRP Interface Tracking

Connected interface failure

HSRP Interface Tracking Path

failure

HSRP Authentication
HSRP authentication prevents rogue Layer
3 devices on the network from joining the
HSRP group
A rogue device may claim the active role
and can prevent the hosts from
communicating with the rest of the network
creating a denial-of-service (DoS) attack.
HSRP provides two types of authentication:
Plain text (Eight characters)
MD5

HSRP Timers
A hello message contains the priority
of the router, the hello time, and
hold-time parameters.
Hello time 3s default
Hold-time 10s default
Can be configured sub-seconds with
msec keyword

HSRP Versions
There are two versions available on most
Cisco routers and layer 3 multilayer switches
HSRPv1 - 224.0.0.2 - udp/1985
HSRPv2 = 224.0.0.102 udp/1985
HSRP version 2 has a different packet format
that includes 6-bytes identifier field that
uniquely identifies the sender.
Versions should be changed on all devices in
the same group. Otherwise, you might get
duplicate IP address messages

LAB -8 HSRP (Omit VRRP)

Group work & individual submission
209.165.200.254

VLAN 99:
172.16.99.1
DLS
Fa0/
6

Po
2

Fa0/
11
Fa0/
12

Payr

VLAN 10
oll
172.16.10.100/24

Fa0/
6

Fa0/
11
Fa0/
ALS
12
1VLAN 99:
172.16.99.3

Fa
0/7
Fa
0/8

Fa
0/8
Fa
0/7

Po
1

Hos
tA

VLAN 99:
172.16.99.2
DLS
Fa0/
6
SQL

Fa
0/7
Fa
0/8

VLAN 99
172.16.99.100/24

Fa0/
11
Fa0/
12

Fa
0/8
Fa
0/7

Server

Po
3

Po
3

Fa0/
11
Fa0/
12

Po
1

VLAN 40
Server
172.16.40.100/24

Hos
tB

Fa0/
6
ALS
Engineeri
VLAN
99:
VLAN 20
2
ng
172.16.99.4 172.16.20.100/24

All Switch-to-Switch connections are 802.1q

trunks

HSRPv2 IPv6 support

HSRP for IPv6 address-family does
not play well with IPv4 addressfamily on the same interface
Disable previous IPv4 HSRP config
before proceeding with the IPv6
HSRP config

HSRPv2 IPv6 support

Link-local Address (all interfaces)

R1 FE80::1
DLS1 FE80::D1
R2 FE80::2
DLS2 FE80::D2
R3 FE80::3
ALS1 FE80::A1

Lo0
2001:db8:cafe:201::1/64

Lo0
S0/0/0

.2

R2

.2

LAB 9: HSRP for

IPv6

S0/0/1

2001:db8:cafe:12::/64

S0/0/0
DCE
Lo0
2001:db8:cafe:101::1/64

2001:db8:cafe:23::/64

EIGRP 1
(Routers and
L3 switches)

.1

Lo0

S0/0/1

.3

R3

R3

R1

.1 G0/1
2001:db8:cafe:11::/64

F0/5
DLS1 IPs: 2001:DB8:CAFE:x::D1::/64
X=99,100,110,120,200

.D1

.3 G0/1
2001:db8:cafe:32::/64

802.1Q

DLS1 F0/12

F0/6

F0/11
F0/8

Po10

F0/12

Po1
802.1Q

DLS2
DLS2 IPs: IPs: 2001:DB8:CAFE:x::D2/64
X=99,100,110,120,200

F0/11
F0/9

F0/7
VLAN 99

.D2 F0/5

F0/10
F0/8
F0/7

F0/9

ALS1

F0/10

Po2
802.1Q

VRRP Overview

VRRP Master > HSRP Active

VRRP Backup > HSRP Standby
One Master one or more backups
Using actual address used by a router makes that router master.
Priority 0 to 255 default 100 - 0 has special meaning the
current master is not available
224.0.0.18 protocol 112
Default hello advertisement 1 sec and hold time about 3 seconds.
Only master sends hello
The 3560 switches in the lab DO NOT support VRRP or GLBP

IP addressing the for the VRRP topology

VRRP Authentication

VRRP Object Tracking

GLBP

GLBP Configuration
Topology

IP addresses used in GLBP Configuration

GLBP Final Configuration

GLBP Operation: ARP

Broadcast

GLBP Operation: Virtual MAC

Address Assignment

GLBP Operation: Traffic Path for each

PC

GLBP Operation: Failed R1 new data

path

GLBP and STP

GLBP Object Tracking

GLBP Tracking Detects interface

failure

GLBP Object Tracking sample config

Lab 10: GLBP &

VRRP

Lo0:
10.1.202.1/32

Lo0

R2
S0/0/0

.2

S0/0/1

.5

DCE
10.1.1.0/30

Layer 3

S0/0/0

EIGRP 1
Routers

GLBP AVG
AVF1

10.1.1.4/30

Office VLAN 10: 10.1.10.0/24

Server VLAN 20: 10.1.20.0/24
Mgmt VLAN 99: 10.1.99.0/24

.1

.6

S0/0/1 GLBP
AVF2
R3

R1
R1
F0/1
SRV1

F0/5
VLAN 10

F0/1

Router on a stick

DLS1

F0/6
VLAN 10
IP: 10.1.10.100/24
DGW: 10.1.10.254

R3

F0/12

802.1Q F0/12

F0/11
F0/8

DLS2

Router on a stick
F0/5

F0/18

F0/11
F09

Po10

F0/10

F0/7
F0/8

Po1
802.1Q
F0/7

F0/9

ALS1
F0/18

Po2
802.1Q
F0/10

VLAN 10

PC-B

PCB IP: 10.1.10.101 /24

DGW IP: 10.1.10.254
VLAN 10

VLAN 10
PC-C

PC C IP: 10.1.10.102 /24

DGW IP: 10.1.10.254