- [Instructor] In this video we want to review HSRP,
the Hot Standby Router Protocol.
You learned about this initially in your CCNA studies,
but we want to dig a little bit deeper
into the configuration in this video
and show you some additional options,
but just as a quick review
HSRP is a first hop redundancy protocol,
meaning that we can have a PC, like we have on screen.
We have PC one and it points to a default gateway
that's really a virtual router.
We're pointing to, not a physical router,
we're pointing to a virtual router with an IP address
of 10.1.1.1, that's our default gateway on PC one.
Notice that's not the IP address of either R1 or R2.
However, R1 can actively service packets destined
for 10.1.1.1, but if something were to happen to R1,
we've got R2 that's a standby router
and it's going to notice that R1 is no longer available
and R2 is going to take over and it's going to be able
to service packets that are destined for 10.1.1.1.
Otherwise, we've got a single point of failure
that would prevent the PC from getting out to the internet,
but now we're getting some redundancy thanks to HSRP.
If you're wondering how R2 knows that R1
is no longer available.
Well, R1's going to periodically send Hello messages
over to R2.
By default it's going to send a Hello message
every three seconds, and if R2 has not heard from R1 within,
what's called the hold time, which defaults to 10 seconds,
R2 assumes that R1 is no longer available
and R2's going to take over.
By the way, the hold time,
must be at least three times the Hello time
and, again, by default, the Hello time,
the interval at which we send Hello packets
is every three seconds.
The default hold time is a little bit more
than three times that, it's 10 seconds,
but 10 seconds might be a little bit slow
to converge by our standards.
We could speed things up by adjusting the timers,
but under normal operation,
we're going to be going out through R1
to get out to the internet, but let's say that something
happens to R1. (glass shattering)
Here we're saying that R1 goes down
and R2, after the hold time has expired,
R2 is going to take over as the active router
and now packets going out to the internet
are going to go through R2.
Now, let's review some of the characteristics of HSRP.
First of all,
it's a Cisco proprietary first hop redundancy protocol,
meaning that if you're in a mixed vendor environment,
you might not want to go with HSRP.
But if you're an old Cisco shop, yeah, HSRP might
be your first hop redundancy protocol of choice.
It is defined by RFC 2281
and the terminology for the two routers that we have here
are the active and standby routers,
and we've got a couple of versions of HSRP
that we want to talk about.
Version one is going to assign a MAC address
to the virtual router in this format.
It's going to begin with a vendor code of five zeros and a C,
followed by zero seven, ac, the last two hexadecimal digits
in the virtual router's MAC address,
that's going to be the hexadecimal representation
of the HSRP group number,
and we'll see that when we get into the live configuration
here in a moment.
There is a second version of HSRP you might want to configure.
It uses the three rightmost hexadecimal digits
to represent the HSRP group numbers,
so we can have more group numbers if we wanted to.
By the way, one of the advantages of version two
versus version one is that we could have sub second timers.
We could have Hello timers in the milliseconds,
and we could have, for example,
300 millisecond Hello timers,
and we could have a hold time of 900 milliseconds.
So on a really fast network that's typically very reliable,
yeah, we can have verify switchover.
Something that's not obvious though is if R1, in this case,
had been the active router and went down
and whatever caused it to go down, let's say, we fixed it
and it came back up.
At that point, you might expect that it would take back over
the active role, but, by default, it doesn't do that.
If it goes down and comes back up,
even if it has a higher priority,
which is what determines who becomes the active router
in the first place, even if it has a higher priority,
it's not going to regain its previous role
as the active router,
unless we enable a feature called preemption.
I want you to know that with HSRP,
preemption is disabled by default.
We said the default Hello time was three seconds
and the default hold time was 10 seconds
and when we're sending the Hellos out,
those are destined for a multicast address,
meaning that the active router doesn't have to know
the IP address of the standby router.
It's not pointing to the standby router's IP address,
it's pointing to a multicast address
and the standby router has joined that multicast group
and it's listening to that address
and with version one here is that multicast address.
It's 224.0.0.2, but with version two they changed that
to 224.0.0.102, and something else I want you to be aware of
is with HSRP, the virtual router's IP address,
in this case, it was 10.1.1.1,
that cannot be the same IP address assigned
to one of our router interfaces.
R1 or R2, they couldn't have 10.1.1.1
as the physical interface's IP address.
We're going to see that's different with our next
first hop redundancy protocol, VRRP,
which is why I bring it up here.
But we cannot have an interface's IP address equal
the virtual IP address.
Now, let's go ahead and take a look at configuring HSRP
and some of its features.
In this topology, RPC is pointing to a default gateway
of 10.1.1.1 and the PC is actually a router,
but it's configured as a PC,
where it's not running a routing protocol,
it points to a default gateway to get off
of its local subnet.
Let's see if we can ping this IP address
that I'm saying lives on our internet.
Let's ping 1.1.1.1 and it's going to fail.
It's going to fail because we don't currently have
a virtual router that is set up.
Let's change that.
Let's go over to R1.
We want this to be our active router
for our HSRP configuration
and we'll go into global configuration mode
and we'll go into interface gigabit 0/1
that's the interface
on the same subnet as our PC, that's important.
And, we want to configure an HSRP virtual IP address
of 10.1.1.1 and the syntax
is a little bit, non-intuitive here.
You might expect that since we're configuring HSRP
then the acronym of HSRP is going to be part of the command.
Actually, it's not.
We're going to use a series of standby commands,
using the word standby instead of HSRP,
specifically, I'm going to say, standby
and I'm going to give an HSRP group number.
We could have more than one group on a router.
We could be participating in different HSRP groups
off of different interfaces, perhaps.
So I'm going to say this is group number 10,
and the IP address that we're going to be servicing
is 10.1.1.1 and I want this router to regain
its active role if it goes down and comes back up.
Remember, we call that the preempt option
and we said it was not enabled by default.
To enable the preempt option,
we'll say standby give the group number of 10
and say, preempt.
Oh, notice that just by enabling HSRP,
we're suddenly active for group 10.
Now, we've turned on preemption.
Let's say standby 10 priority,
and I'm going to set the priority higher
than the priority that we're going to have on R2
because the higher priority wins the election
to be the active router and I'd like you to know
that the default priority is 100.
I just want to be greater than that,
so I'll say priority 110.
That's going to make me greater than 100 and we'll say, end.
I've now configured R1.
Let's go over to R2 and configure that side.
It's a similar configuration.
I'm going to go into interface gigabit 0/1
and I'll say standby group 10, that needs to match.
The IP address that we're servicing is 10.1.1.1
and I do want to enable preemption on all of my routers,
standby 10 preempt,
but I'm not going to set the priority value.
I'm going to leave the priority value at the default of 100
because I want R2 to be the standby router
and I want R1 to be the active router.
Now, let's see how things look right.
Let's do a show.
Standby brief command, that's my favorite command
for verifying HSRP operation, by the way,
you see that we just went to standby,
because we learned there's an active router for this group.
And, here we see that for interface gigabit 0/1
for group number 10, we've got a priority of 100,
the P in this column means that preemption is configured.
Our current state is standby.
The current active router is 10.1.1.2, that's R1.
The standby router, it's us, it's local
and the virtual IP address that we're servicing is 10.1.1.1.
Let's take a look at this from the perspective of R1.
Let's go there and do a show, standby brief command.
Here the big difference is the priority is 110,
and, as a result, we're active.
We can see that's our state.
We can see the active router is us, it's local.
Now, notice, I gave the command show standby brief
and that gives me, usually, all the information that I need,
but I can get more information if I want
by just doing a show standby without the brief option.
This will show me, for example, MAC address information.
The active virtual MAC address,
because we're using HSRP version one right now,
here's the MAC address.
Because, when the PC wants to send a packet out
to the internet, not only does it need
to go to the IP address of its default gateway,
it needs to know the MAC address of its default gateway
in order to properly form a frame and what does it do?
It sends out an ARP broadcast to say,
hey, can somebody tell me the MAC address of 10.1.1.1?
Well, our active HSRP router is going to respond and say,
yeah, that MAC address is this MAC address
that we have right here.
We see our timers.
They're at their defaults,
so three seconds for the Hello time
and 10 seconds for the hold time.
We see that preemption is enabled, just like we configured.
It says that the active router is local
and the standby router is 10.1.1.3, that is R2,
and its priority is 100 we see
and our priority is configured to be 110.
Now, let's test this out.
And, let's see if I can do a continual ping over on my PC.
First of all, let's just confirm that I can get to 1.1.1.1.
Now, the first time, I thought we might have an ARP timeout.
We didn't, if we did, we lost that first packet,
no big deal.
But here, it looks like we're successfully talking
to the internet.
Now, what I'm going to do is start a continual ping
that's going to go on for a long, long time
and I'll go over to router R1.
I'm going to shut down that gigabit 0/1 interface
and we'll see it switch over and start using R2 to get out
to the internet and we'll see how many packet drops we have.
All right, let's try this ping command.
I'm going to say ping 1.1.1.1,
but I'll say I want to repeat for a count
of some really large number,
I don't know what that number is, but we're pinging a lot
and see all these are successful pings.
Now, let's go over to R1 and let's do a shutdown
on that interface.
I'm going to go into interface gigabit 0/1
and I'm going to say shut, short for shutdown.
All right, let's quickly bounce back over to the PC
and see how many packets we've lost.
Looks like we've dropped a couple, three, four,
giving it a few more seconds,
I'm expecting about a 10 second delay.
Now, by the way, here's the disclaimer
because I'm doing this with a virtualized set of routers,
I'm using Cisco VIRL for this.
The timer's don't work like they might work
in the real world with real gear, oddly enough,
because, in the real world, with real routers,
when I shut down that bottom interface on R1,
it would have seen
that I was taking down this interface that was,
oh, by the way you see that everything is resumed now.
That was really too long of a delay.
That's longer than we would have with actual gear,
but it's because again I'm using VIRL.
Let me see if I can stop this.
R1 would have seen that we were shutting down the interface,
and we would send out a resign message.
If we were doing a packet capture,
we would see an HSRP message that said resign
and that router would say, all right, you don't need
to wait for me to stop sending Hello messages
for the hold time interval.
I'm proactively resigning
because I know this interface is going down.
The other side would have seen it
and it would have gone active almost immediately,
so it would have been a very fast switchover.
If the router had literally been unplugged
or something like that, then there would have been
that 10 second delay.
We had longer than 10 seconds it felt like just now.
Again, that's because the timer's don't work perfectly
with the Cisco VIRL router emulator.
So, it'll work a little bit different in the real world.
All right, let's get back to the action
and let's bring the interface back up.
Let's go back over to R1 and let's say no shut.
We're always doin' no shut here.
Now, again, in the real world, we might want
to make the timers shorter to make failover happen quicker
and even though context-sensitive help suggests
that the default version of HSRP version one
it makes it look like we can set Hello timers
to the milliseconds, and it'll actually take the command,
but it doesn't work right.
If we want to really use subsecond timers,
we need to be running HSRP version two,
and also HSRP uses an IP multicast address
of 224.0.0.102 we mentioned, instead of 224.0.0.2.
That's what was used by HSRP version one.
The reason that Cisco changed that is that 224.0.0.2
could conflict with some CGMP messages,
that older Cisco catalyst switches
might have used in a multicast environment.
Let's see how we can adjust
the version and the timers.
So here on router R1, let's say, standby
and let's get some context-sensitive help.
By the way, notice that we're active once again.
If I wanted to specify the MAC address,
instead of having one automatically generated,
I could do it with this command.
I could adjust my timers with the timers command
and I could set the version with the version command.
What I want to do right now is set the version
to version two, so I'll say standby version two
and I'll say standby timers
and we'll get some context-sensitive help.
If I want to use milliseconds I'm going to say insec
and I can give milliseconds for my Hello interval
and I'll say I want to send a Hello every 100 milliseconds
and for my hold timer, I'll say,
I want to use milliseconds there as well
and I want that to be, remember, it has to be
at least three times the Hello timer,
so I'm going to make it like exactly three times,
I'll say my hold time interval
is going to be 300 milliseconds.
Now, I need to make this match on R2
because right now we have mismatched HSRP versions
and that's just not going to work.
So, let's fix that.
Let's go into router R2 interface gigabit 0/1
and I'll say standby version two.
I'll set the timers the same,
I'll say standby timers,
insec 100 milliseconds for the Hello timer,
insec 300 milliseconds for the hold time.
All right, we're all match now.
Now, here are a few debugging commands we could use.
If we want to see what's going on,
if we want to troubleshoot HSRP.
We could do a debug standby.
Let's use some context-sensitive help
and we could look at all the errors
or the events or the packets,
but Cisco has curated a collection of some
of the most important debug output though,
and they put it in this option.
This is my favorite.
We can do debug standby terse.
Again, that's going to give us a little bit of the errors,
a little bit of the events, a little bit of the packets,
it's Cisco's curated collection of debug features.
Let's say debug standby terse
and let's make something happen by going over to router R1
and shutting down that gigabit 0/1 interface again.
Let's go back to R1
and let's go back into interface gigabit 0/1
and let's shut it down again.
All right, let's press enter
and then we'll quickly jump back to R2
and let's see what kind of output we got there.
It looks like this router is no longer active
and here's that resigned message I said
that we would receive in the real world.
We received it here,
but the timer's just didn't behave as expected,
but here's that resign message
that router R1 proactively sent us,
telling us that it was about to go down.
So we received a resigned message coming in from 10.1.1.2.
Now, if I want to turn off debugging,
I'll do a u all, to say undebug all.
And now, let's fix router R1 again.
Let's go back into that interface.
We'll say no shut.
All right, we'll no shut that.
We'll say end and, now, let's talk about a feature called,
well, it's an older feature called interface tracking.
If you take a look at that topology,
imagine that something happened on the link
between router R1 and the internet.
So, in other words, that we could see
that no, that link is down.
We should not be going through R1 to get to the internet.
That's a bad way to go.
But, how would R2 know that?
I mean, from the perspective of R2,
it's still receiving Hello messages coming from R1.
How does it know that R1 is not the best choice
to go out to the internet?
Well, it wouldn't by default,
but there used to be a feature called interface tracking
that would allow us to say on R1,
hey, keep an eye on this top interface and if it goes down,
then I want you to decrement your priority
to similar value so it would lose its active role.
Well, interface tracking by itself
is no longer a separate feature in Cisco IOS.
It's now grouped
into something called enhanced object tracking.
And, what I want to do is on R1 configure things
such that if that link goes down,
it's specifically gigabit 0/2 that goes out to the internet,
if that goes down, I want to decrement my priority by 20.
That's going to take my priority from 110
and bring it down to 90.
Suddenly, 90 is going to be less than the priority on R2 of 100
and R2's going to take over.
Here's how we set it up today with modern Cisco IOS.
Again, it used to be an interface tracking configuration,
now, it's enhanced object tracking
and here's the way we set it up.
Let's go into global configuration mode
and into interface gigabit 0/1
and I'm going to say standby group 10.
I want to track object number one.
Now, we've not defined object number one yet,
but we will in a moment.
I'm going to say, let's track object number one
and if object number one is in the down state,
then I want to decrement my priority value by 20.
Now, let's define tracking object number one.
I'm going to say track one
and let's use some context-sensitive help.
Actually, I need to be in global configuration mode
for that, so let's back out
and I'll say track one and I want to track the interface
of gigabit 0/2, specifically,
I want to track the line protocol of gigabit 0/2
and if that interface goes down,
this tracking object is going to go down
and that will cause us to decrement our priority by 20.
So, let's take a look right now at the output
of the show standby brief command on R1.
I'll do a show standby brief command.
This is like we saw earlier.
Currently, our priority is 110
and as a result our state is active.
Now, I'm going to shut down, not the bottom interface
going down to our switch and the PC and over to R2,
no, I want to shut down the top interface.
That's gigabit 0/2, which gets us out to the internet.
So, let's go back into global configuration mode
and then into interface gigabit 0/2
and I'm going to shut down this interface.
We press enter.
Notice, immediately it tells us that the state is down
on our tracking object and we've transitioned out of active
and we're in speak,
and that means we're on our way to standby.
So, let's take a look now at the output
of the show standby brief command.
Look at this.
It says, now, our priority is 90, what happened?
Well, the reason it's 90 is because that tracking object
went to a down state and we had a configuration
that said we want to reduce our HSRP priority
for route 10 by 20, so it did.
Now, let's bring it back up.
In fact, let's do this first.
Let's do a show standby command without the brief
and it's going to show us that we are configured for 110,
but, currently, the priority is 90 and that's because
the tracking object decremented our priority about 20.
All right, let's fix it.
Let's go back into interface gigabit 0/2
and I'll do a no shutdown, all right.
We see everything's coming back up now.
Let's take a look at another HSRP configuration
while we're into this discussion
of the enhanced object tracking.
Let's say that we want
to monitor router R1's IP routing table.
Maybe we're looking for a certain IP route via R1
and if it's not available, then we don't want to use R1.
We could say I want to decrement the priority
if this route disappears from my routing table.
Now, to do that I want to create a static route
for some non-existent network.
We'll say it's network 2.2.2.0/24
and I'll point to an interface of null zero,
which doesn't go anywhere
and then I'll say I want to track that network.
Here's how to do that.
I'm going to say IP route 2.2.2.0, with a 24 bit subnet mask.
It's just a static route I'm creating.
I'm going to point it to null zero,
which is like a bit bucket, it doesn't go anywhere.
If I do a show IP route, we're going to see
that we've got a static route for 2.2.2.0,
and I'm going to say that I want to track that route.
We're going to see if it's in our routing table.
I'm going to create tracking object number two to do that.
So, let's go into global configuration mode
and I'll say track object number two,
we're going to be looking for an IP route of 2.2.2.0/24
and what are we specifically checking for?
I want to just see if it's there.
Can I reach it or not?
Is it in my IP routing table?
Or, I could say, is the metric of a certain value,
if the metric gets bad based on changing network conditions,
I could decrement my priority based on that.
But, here, I'm just going to say, is it reachable or not?
We'll say reachability.
Now, let's go back into interface gigabit 0/1
and let's decrement our priority by 20
if this tracking object number two goes down.
I'll say standby 10, track two, decrement 20
and let's do a show standby for interface gigabit 0/1,
just to remind ourselves of how we're configured right now.
Notice, we've got a couple of tracking objects.
We're saying, if our interface of gigabit 0/2 goes down,
that's going to be tracked by tracking object number one
and we're going to decrement our priority by 20
or tracking object number two, if it goes down,
we're going to decrement our priority by 20
and that's what we just set up.
We're monitoring to see if 2.2.2.0/24
is in the routing table or not.
All right, let's go back into global configuration mode
and let's say no IP route 2.2.2.0, 255.255.255.0.
All right, let's end and, you see, we've already gone down.
We've transitioned from an active role to a speak role.
Let's take a look at our interface.
Let's do a show standby gigabit 0/1,
and, once again, we see that our priority is 90,
even though we're configured for 110
and the reason is tracking object number two is down.
All right, let's fix that now.
I'll just put that static route back in.
I'll say IP route 2.2.2.0, 255.255.255.0 pointing
to null zero.
All right, we see that we came back up.
We're once again active, awesome.
Now, as a final HSRP configuration,
let's consider a security question.
What's to prevent someone from adding a rogue HSRP router
to our network, setting the priority really high
and then taking over the active role?
That will be forcing traffic to flow through their router
and they could be capturing that traffic.
Well, to prevent that, we can configure authentication.
HSRP supports both plain text and the MD5 authentication.
You probably don't want to use plain text credentials
across our network, that's not secure in and of itself.
So let's use MD5, message-digest five authentication.
We'll configure it on R1 and then we'll go over
and we'll configure it on R2.
And, we're going to use a key string.
That's an interface configuration mode string of characters.
We're going to do that instead of a key chain.
A key chain is a global configuration
where we can set time periods
during which different keys are valid,
some key user valid during working hours, maybe,
and some keys expire on Thursday
and we can be really creative for that.
We're going to keep it simple though
and we're just going to set up a matching key string
on each router.
First, on router R1, let's go into interface gigabit 0/1,
and I'm going to say for standby group 10.
I want to enable authentication again.
We could say MD5 or plain text.
I'm going to say MD5 and I'm going to use not a key chain,
but a key string, so I'll say key string.
And, I'm going to make that key string, let's say,
I'll cryptically write the word secret,
so instead of the s, I'll use a dollar sign.
Instead of the e, I'll use a three.
C, R, three and then I'll do a capital T.
Not super secure, but you get the idea.
I'm trying to be a little sneaky with my naming here,
so I'll spell that secret using some interesting characters
and we'll make that match over on R2.
So, let's go over to router R2
and set up a matching configuration.
Let's say interface gigabit 0/1,
standby group 10, authentication MD5, key string
is going to be dollar sign, three, c, r, three, capital T.
Hopefully, those match and let's do a show,
standby for interface gigabit 0/1.
Oh, and we just went to standby,
so let's issue that command again.
It says we're using MD5 key string authentication
and our current state is standby,
and that's what we want on R2 right now.
So, everything is working as expected.
Now, although we're done with our HSRP configuration,
Cisco does have a couple of design best practices for us
to consider that I want to make you aware of.
The first recommendation Cisco has
is make the layer three switch that's acting
as the VLAN's active HSRP router
the Spanning Tree Root bridge for that VLAN.
So, here I'm using routers, R1 and R2,
but if those had been multi-layer switches
and let's say that our PC was on VLAN 100,
and we said that R1 or maybe it's multi-layer switch one
was our active HSRP router,
make that the root bridge for Spanning Tree Protocol,
so that's the direction we're following anyway
and Cisco's other recommendation is
when two HSRP layer three switches are servicing
more than one VLAN, maybe we've got multiple interfaces
and we're participating in multiple HSRP groups,
Cisco recommends that we do some load balancing.
If we have R1 and R2 both servicing 10 different VLANs,
for example, well, let's make R1 active,
maybe for five of those VLANs and R2 active for five VLANs,
so we don't have one router that's overwhelmed with the role
of being the active router.
We get to do a little bit of manual load balancing that way.
And, that's a look at HSRP, the Hot Standby Router Protocol.