HSRP(Hot Standby Router Protocol)
a Cisco-proprietary protocol
developed to allow several layer 3 device to appear as a single gateway IP address
ps:
RFC 2281 describes this protocol in more detail<\/p>\n\n\n\n
\u512a\u9ede<\/strong> HSRP group <\/strong> HSRP role<\/strong> HSRP election<\/strong> HSRP status <\/strong> hello messages<\/strong> virtual router address<\/strong> ……………………………………………………………………………………………………<\/p>\n\n\n\n To set the priority ex: ……………………………..<\/p>\n\n\n\n HSRP\u5176\u4ed6\u8a2d\u5b9a<\/p>\n\n\n\n …..<\/p>\n\n\n\n interface tracking<\/strong> To configure interface tracking …<\/p>\n\n\n\n TIMER To set the timer …<\/p>\n\n\n\n authentication method<\/strong> Plain-Text HSRP Authentication MD5 Authentication ps: ………………………………………..<\/p>\n\n\n\n Load Balancing with HSRP<\/strong> clients configure(Manual)<\/strong> ex: ……………………………………………………<\/p>\n\n\n\n \u555f\u7528debug\u6a21\u5f0f ps: HSRP(Hot Standby Router Protoc …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[33],"tags":[],"class_list":["post-940","post","type-post","status-publish","format-standard","hentry","category-cisco-layer3"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/940","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=940"}],"version-history":[{"count":0,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/940\/revisions"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=940"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=940"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=940"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
provides redundancy and load balancing
allows one router to automatically assume the function of the second router if the second router fails<\/p>\n\n\n\n
each of the routers that provides redundancy for a given gateway address(standby ip) is assigned to a common HSRP group
ps:
An HSRP group can be assigned an arbitrary group number, from 0-255
however,most Catalyst switches support only up to 16 unique HSRP group numbers.<\/p>\n\n\n\n
One router is elected as the primary, or active, HSRP router(the highest priority)
another is elected as the standby HSRP router(the second-highest priority)
and all the others remain in the listen HSRP state<\/p>\n\n\n\n
1. based on a priority value (0-255) that is configured on each router in the group.
2. By default, the priority is 100.
ps:
If priority is equal , the router with the highest IP address on the HSRP interface becomes the active router.
ps:
priority=0\u6642\u4e0d\u53c3\u52a0election<\/p>\n\n\n\n
Devices participating in HSRP must progress their interfaces through the following state sequence:
1. Disabled<\/strong>
2. Init<\/strong>
This is the state from which the routers begin the HSRP process.
This state indicates that HSRP is not running.
It is entered via a configuration change or when an interface first comes up.
3. Listen<\/strong>
The router knows the virtual IP address, but is neither the active router nor the standby router.
It listens for hello messages from those routers.
Routers other than the active and standby router remain in the listen state.
4. Speak<\/strong>
The state sends periodic hello messages
the state is actively participating in the election of the active or standby router.
A router cannot enter Speak state unless it has the virtual IP address.
5. Standby<\/strong>
The state sends periodic hello messages
The state is a candidate to become the next active router
Only the standby router monitors the hello messages from the active router
6. Active<\/strong>
The router sends periodic hello messages.
The router becomes the active router for the group
The router is currently forwarding packets that are sent to the group virtual MAC address.
<\/p>\n\n\n\n
1
Only the standby router monitors the hello messages from the active router. By default
2.
The routers exchange HSRP hello messages at regular intervals so that they can remain aware of each other’s existence and that of the active router
ps:
By default, hellos are sent every 3 seconds.
3.
If hellos are missed for the duration of the holdtime timer(default 10 seconds, or 3 times the hello timer), the active router is presumed to be down.The standby router is then clear to assume the active role.
ps:
HSRP sends its hello messages to the multicast destination 224.0.0.2 (“all routers”) using UDP port 1985.<\/p>\n\n\n\n
HSRP group interface IP address<\/strong>
1. Each router in an HSRP group has its own unique IP address assigned to an interface
2. This address is used for all routing protocol and management traffic initiated by or destined to the router<\/p>\n\n\n\n
1. each router has a “common gateway IP address”,which is kept alive by HSRP,
This address also is referred to as the virtual router address\/HSRP address\/standby address
2. Clients can point to that “virtual router address” as their default gateway,knowing that a router always keeps that address active
3. For the “virtual router address”, HSRP defines a special MAC address of the form 0000.0c07.acxx, where xx represents the HSRP group number as a two-digit hex value
ex:HSRP Group 1 appears as 0000.0c07.ac01, HSRP Group 16 appears as 0000.0c07.ac10, and so on
ex:
0000.0c07.ac11 = HSRP group 17 , because 11(16)=17(10)
ps:
the actual interface address and the virtual (standby) address must be configured to be in the
same IP subnet.<\/p>\n\n\n\n
assign the HSRP address
(config)#interafcae < interface >
interface\u53ef\u4ee5\u6307\u5b9aSVI,etherchannel,routed port
(config-if)# standby < group> ip < ip-address [secondary]><\/strong>
[secondary] provide a redundant secondary gateway address by HSRP
ps:\u4e00\u500b\u4ecb\u9762\u53ef\u4ee5\u8a2d\u5b9a\u591a\u500bgroup<\/p>\n\n\n\n
(config-if)# standby < group> priority < 0-255><\/strong>
ps:(config-if)#no standby priority ,assigns a priority of 100 to the router
ex:
set the HSRP priority to 200:
Switch(config-if)# standby 1 priority 200<\/p>\n\n\n\n
\u5047\u8a2d\u67091\u500bswitch\u9023\u63a5l3device_a\u548cl3device_b,
\u5728vlan50\u4e0b,l3device_a\u6709\u4e00VIP\u70ba192.168.1.11,l3device_b\u6709\u4e00VIP\u70ba192.168.1.12
\u8a72\u7db2\u8def\u4e0b\u8a2d\u5099\u4f7f\u7528HSRP\u7684\u865b\u64ec\u9598\u9053,ip\u70ba192.168.1.1
\u76f8\u95dc\u8a2d\u5b9a\u5982\u4e0b
l3device_a\u7684\u8a2d\u5b9a\u5982\u4e0b
l3device_a(config)# interface vlan 50
l3device_a(config-if)# ip address 192.168.1.11 255.255.255.0
l3device_a(config-if)# standby 1 ip 192.168.1.1
l3device_a(config-if)# standby 1 priority 200
l3device_b\u7684\u8a2d\u5b9a\u5982\u4e0b
l3device_b(config)# interface vlan 50
l3device_b(config-if)# ip address 192.168.1.12 255.255.255.0
l3device_b(config-if)# standby 1 ip 192.168.1.1
\u7531\u65bcl3device_b\u7684priority\u9810\u8a2d\u70ba100,\u6bd4l3device_a\u7684\u4f4e,
\u56e0\u6b64l3device_a\u70baactive router,\u800cl3device_b\u70bastandby router<\/p>\n\n\n\n
preempt
<\/strong>\u7acb\u5373\u5c07priority\u9ad8\u7684router\u8b8a\u6210active\u3000
ps:\u5efa\u8b70\u8a2d\u5b9a
ps:
the active router fails and the standby router becomes active,
if it is restored,default
1. the original active router cannot immediately become active
2. it cannot become active again until the current active router fails. even if its priority is higher than that of the active router<\/p>\n\n\n\n
to configure a router to preempt or immediately take over the active role
(config-if)# standby < group> preempt [delay [minimum < sec >] [reload < sec>]]<\/strong>
By default, the local router immediately can preempt another router that has the active role.
To delay the preemption, use the delay keyword
[minimum < sec >]<\/strong> :
to force the router to wait for seconds (0-3600 sec) before attempting to overthrow an active router with a lower priority
[reload < sec >] <\/strong>:
to force the router to wait for seconds (0-3600 seconds) after it has been reloaded or restarted<\/p>\n\n\n\n
When a specific interface is tracked,
HSRP reduces the router’s priority by a configurable amount as soon as the interface goes down
If more than one interface is tracked, the priority is reduced even more with each failed interface
The priority is incremented by the same amount as interfaces come back up<\/p>\n\n\n\n
Switch(config-if)# standby < group> track < interface> [decrementvalue]<\/strong>
[decrementvalue] By default, the decrementvalue for an interface is 10
ps:interface tracking does not involve the state of the HSRP interface itself
ex:
\u7576gi0\/7 down\u5c31\u5c07priority\u6263\u638950
Switch(config)#interface vlan 10
Switch(config-if)#standby 1 track GigabitEthernet 0\/7 50<\/p>\n\n\n\n
<\/strong>\u8abf\u6574\u6536\u6582\u901f\u5ea6<\/p>\n\n\n\n
Switch(config-if)# standby < group> timers [msec] < hello> [msec] < holdtime><\/strong>
\u5404\u53c3\u6578\u8aaa\u660e\u5982\u4e0b
[msec]
\u4f7f\u7528milliseconds\u70ba\u55ae\u4f4d ,by default is in seconds
< hello>
to range from 1 to 254 seconds or from 15 to 999 milliseconds
ps:decreasing the hello time allows a router failure to be detected more quickly
< holdtime>
The holdtime always should be at least three times the hello timer and can range from 1 to 255 seconds or 50 to 3000 milliseconds.
ps:
\u5efa\u8b70Holdtime\u6642\u9593\u70ba3\u500d\u7684Hello
ex:
to set the hello time at 100 milliseconds and the holdtime to 300 milliseconds:
Switch(config-if)# standby 1 timers msec 100 msec 300<\/p>\n\n\n\n
1. to prevent unexpected devices from spoofing or participating in HSRP
2. All routers in the same standby group must have an identical authentication method and key
3. support either plain-text or MD5 authentication<\/p>\n\n\n\n
Switch(config-if)# standby < group> authentication < string><\/strong>
string\u9810\u8a2d\u70bacisco<\/p>\n\n\n\n
Switch(config-if)# standby < group> authentication md5 key-string [0 | 7] < string><\/strong>
By default, the key string (up to 64 characters) is given as plain text ,\u6548\u679c\u5c31\u548c\u6307\u5b9a[0]\u4e00\u6a23
ps:
After the key string is entered, it is shown as an encrypted value in the switch configuration.
You also can copy and paste an encrypted key string value into this command by preceding the string with the 7 keyword.<\/p>\n\n\n\n
define an MD5 key string as a key on a key chain
\u512a\u9ede:more flexible, enabling you to define more than one key on the switch
Switch(config)# key chain < chain-name><\/strong>
< chain-name>\u65b0\u589e\u4e00\u500bkey chain,\u4e26\u547d\u4ee4
Switch(config-keychain)# key < key-number><\/strong>
< key-number> a arbitrary index, but keys are tried in sequential order
Switch(config-keychain-key)# key-string [0 | 7] < string >
Switch(config)# interface < interface >
Switch(config-if)# standby < group > authentication md5 key-chain < chain-name><\/strong><\/p>\n\n\n\n
The trick is to use two HSRP groups:
1
One group: assigns an active router to one switch.
The other group: assigns another active router to the other switch.
2
to make each switch function as the standby router for its partner’s HSRP group
3
each router is active for one group and standby for the other group.
ps:
In this way, two different virtual router or gateway addresses can be used simultaneously
ps:
Load balancing traffic across two uplinks to two HSRP routers with a single HSRP group is not possible<\/p>\n\n\n\n
The clients also must have their default gateway addresses configured as one of the two virtual HSRP group addresses.<\/p>\n\n\n\n
\u5047\u8a2d\u67091\u500bswitch\u9023\u63a5l3device_a\u548cl3device_b,\u4e26\u8b93\u7db2\u8def\u53ef\u4ee5loadbalance\uff0c\u8a2d\u5b9aHSRP\u8a2d\u5b9a\u5982\u4e0b
l3device_a\u7684\u8a2d\u5b9a\u5982\u4e0b
l3device_a(config)# interface vlan 50
l3device_a(config-if)# ip address 192.168.1.10 255.255.255.0
l3device_a(config-if)# standby 1 priority 200
l3device_a(config-if)# standby 1 preempt
l3device_a(config-if)# standby 1 ip 192.168.1.1
l3device_a(config-if)# standby 1 authentication MyKey
l3device_a(config-if)# standby 2 priority 100
l3device_a(config-if)# standby 2 ip 192.168.1.2
l3device_a(config-if)# standby 2 authentication MyKey
l3device_b\u7684\u8a2d\u5b9a\u5982\u4e0b
l3device_b(config)# interface vlan 50
l3device_b(config-if)# ip address 192.168.1.11 255.255.255.0
l3device_b(config-if)# standby 1 priority 100
l3device_b(config-if)# standby 1 ip 192.168.1.1
l3device_b(config-if)# standby 1 authentication MyKey
l3device_b(config-if)# standby 2 priority 200
l3device_b(config-if)# standby 2 preempt
l3device_b(config-if)# standby 2 ip 192.168.1.2
l3device_b(config-if)# standby 2 authentication MyKey
clients\u8a2d\u5b9a\u5982\u4e0b
\u5c07\u4e00\u90e8\u4efdpc\u7684gateway\u8a2d\u6210hsrp group1\u7684ip(192.168.1.1)
\u548c\u53e6\u4e00\u90e8\u4efdpc\u8a2d\u6210hsrp group2\u7684ip(192.168.1.2)<\/p>\n\n\n\n
display information about the status
#show standby [brief] [vlan < vlan-id> | interface ]<\/strong>
ps:
\u4ee5show standby vlan 50 brief\u70ba\u4f8b,\u8f38\u51fa\u756b\u9762\u5982\u4e0b
Interface Grp Prio P State Active addr Standby addr Group addr
Vl50 1 200 P Active local 192.168.1.11 192.168.1.1
Vl50 2 100 Standby 192.168.1.11 local 192.168.1.2
ps:
show standby vlan 50\u70ba\u4f8b,\u8f38\u51fa\u756b\u9762\u5982\u4e0b
Vlan50 – Group 1
\u3000Local state is Active, priority 200, may preempt
\u3000Hellotime 3 sec, holdtime 10 sec
\u3000Next hello sent in 2.248
\u3000Virtual IP address is 192.168.1.1 configured
\u3000Active router is local
\u3000Standby router is 192.168.1.11 expires in 9.860
\u3000Virtual mac address is 0000.0c07.ac01
\u3000Authentication text “MyKey”
\u30002 state changes, last state change 00:11:58
\u3000IP redundancy name is “hsrp-Vl50-1” (default)
Vlan50 – Group 2
\u3000Local state is Standby, priority 100
\u3000Hellotime 3 sec, holdtime 10 sec
\u3000Next hello sent in 1.302
\u3000Virtual IP address is 192.168.1.2 configured
\u3000Active router is 192.168.1.11, priority 200 expires in 7.812
\u3000Standby router is local
\u3000Authentication text “MyKey”
\u30004 state changes, last state change 00:10:04
\u3000IP redundancy name is “hsrp-Vl50-2” (default)
ps:
\u4ee5show standby\u70ba\u4f8b,\u8f38\u51fa\u756b\u9762\u5982\u4e0b
Ethernet0\/1 – Group 1
State is Active
2 state changes, last state change 00:30:59
Virtual IP address is 10.1.0.20
Secondary virtual IP address 10.1.0.21
Active virtual MAC address is 0004.4d82.7981
Local virtual MAC address is 0004.4d82.7981 (bia)
Hello time 4 sec, hold time 12 sec
Next hello sent in 1.412 secs
Preemption enabled, min delay 50 sec, sync delay 40 sec
Active router is local
Standby router is 10.1.0.6, priority 75 (expires in 9.184 sec)
Priority 95 (configured 120)
Tracking 2 objects, 0 up
Down Interface Ethernet0\/2, pri 15
Down Interface Ethernet0\/3
IP redundancy name is “HSRP1”, advertisement interval is 34 sec<\/p>\n\n\n\n
Switch#debug standby<\/strong>
Hello out ip \u8868\u793a\u8a72ip\u9001\u51fahello\u5c01\u5305
Hello in ip \u8868\u793a\u8a72ip\u63a5\u6536hello\u5c01\u5305
ex:
Vl5 Hello out 172.16.60.250 Active pri 100 ip 172.16.60.254
\u5728vlan5,172.16.60.250\u9001\u51fahello\u5c01\u5305,\u4e26\u5ba3\u544a\u70baactive\u72c0\u614b\u4e14pri=100,\u76ee\u524dstandby ip=172.16.60.254<\/p>\n\n\n\n
\u756b\u9762\u5927\u81f4\u5982\u4e0b
*Mar 8 20:34:10.221: SB11: Vl11 Init: a\/HSRP enabled
*Mar 8 20:34:10.221: SB11: Vl11 Init -> Listen
*Mar 8 20:34:20.221: SB11: Vl11 Listen: c\/Active timer expired (unknown)
*Mar 8 20:34:20.221: SB11: Vl11 Listen -> Speak
*Mar 8 20:34:20.221: SB11: Vl11 Hello out 172.16.11.111 Speak pri 100 ip 172.16.11.115
*Mar 8 20:34:30.221: SB11: Vl11 Speak: d\/Standby timer expired (unknown)
*Mar 8 20:34:30.221: SB11: Vl11 Standby router is local
*Mar 8 20:34:30.221: SB11: Vl11 Speak -> Standby
*Mar 8 20:34:30.221: SB11: Vl11 Hello out 172.16.11.111 Standby pri 100 ip 172.16.11.115
*Mar 8 20:34:30.221: SB11: Vl11 Standby: c\/Active timer expired (unknown)
*Mar 8 20:34:30.221: SB11: Vl11 Active router is local
*Mar 8 20:34:30.221: SB11: Vl11 Standby router is unknown, was local
*Mar 8 20:34:30.221: SB11: Vl11 Standby -> Active
*Mar 8 20:34:30.221: %STANDBY-6-STATECHANGE: Vlan11 Group 11 state Standby -> Active
*Mar 8 20:34:30.221: SB11: Vl11 Hello out 172.16.11.111 Active pri 100 ip 172.16.11.115
\u8aaa\u660e:router with IP address 172.16.1.111 initializes and negotiates for the role of active router.
The final active router is 172.16.11.111,and 172.16.1.115 is the virtual HSRP IP address.
ps:
\u767c\u751f\u932f\u8aa4\u6642\u756b\u9762\u5927\u81f4\u5982\u4e0b
1d18h: SB6: Vl6 Hello out 172.16.63.252 Active pri 100 ip 172.16.63.254
1d18h: SB6: Vl6 Hello out 172.16.11.252 Active pri 110 ip 172.16.11.254
1d18h: SB7: Vl7 Hello out 172.16.12.252 Standby pri 100 ip 172.16.12.254
1d18h: SB8: Vl8 Hello out 172.16.13.252 Active pri 110 ip 172.16.13.254
1d18h: SB14: Vl14 Hello out 172.16.19.252 Active pri 110 ip 172.16.19.254
1d18h: SB2: Vl2 Hello out 172.16.0.2 Active pri 110 ip 172.16.0.254
1d18h: SB62: Vl62 Hello out 172.16.62.252 Active pri 110 ip 172.16.62.254<\/p>\n","protected":false},"excerpt":{"rendered":"