This topic describes how ICMP redirect messages are filtered through HSRP so that the next-hop IP address is changed to an HSRP virtual IP address, preventing hosts from discovering the real MAC addresses of routers in the HSRP group.
The ICMP redirect for HSRP is a network function that
-
facilitates error reporting through IP processing
-
prevents host discovery of individual router MAC addresses, and
-
maps real IP addresses to virtual IP addresses for traffic redirection.
ICMP provides diagnostic support within the network layer, but it poses risks to network reliability if hosts learn the real MAC addresses of physical routers. If a host relies on a specific physical interface that subsequently fails, the host loses its connection to the network. HSRP addresses this vulnerability by filtering outgoing ICMP redirect messages to ensure that the next-hop address points to an HSRP virtual IP address rather than a physical one.
The router performs these tasks to ensure traffic continuity:
-
The protocol filters outgoing ICMP redirect messages to replace the next-hop address with the HSRP virtual IP address.
-
The router maintains a mapping between real IP addresses and virtual IP addresses to manage filtering effectively.
-
HSRP tracks individual router advertisements to maintain an accurate understanding of the network topology.