Hot Standby Router Protocol and Virtual Router Redundancy Protocol

This feature module describes the HOT Standby Router Protocol(HSRP) and Virtual Router Redundancy Protocol(VRRP) features. The Hot Standby Router Protocol (HSRP) is a First Hop Redundancy Protocol (FHRP) designed to allow transparent fail-over of the first-hop IP router. HSRP provides high network availability by providing first-hop routing redundancy for IP hosts on Ethernet, Fiber Distributed Data Interface (FDDI), Bridge-Group Virtual Interface (BVI), LAN Emulation (LANE), or Token Ring networks configured with a default gateway IP address. HSRP is used in a group of routers for selecting an active router and a standby router.

The Virtual Router Redundancy Protocol (VRRP) eliminates the single point of failure inherent in the static default routed environment . VRRP is not an election protocol in itself; rather it specifies an election protocol that dynamically assigns responsibility for a virtual router.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn . An account on Cisco.com is not required.

Information About HSRP and VRRP

Overview of HSRP and VRRP

Hot Standby Router Protocol (HSRP) provides network redundancy for IP networks, which helps maximum network uptime. By sharing an IP address and a MAC (Layer 2) address, two or more routers can act as a single virtual router. The members of the virtual router group continuously exchange status messages. This way, one router can assume the routing responsibility of another, should the first one go out of commission for either planned or unplanned reasons. Hosts continue to forward IP packets to a consistent IP and MAC address, and the changeover of devices that route is transparent.

A Virtual Router Redundancy Protocol (VRRP) router is configured to run the VRRP protocol in conjunction with one or more other routers attached to a LAN. In a VRRP configuration, one router is elected as the virtual router master, with the other routers acting as backups in case the virtual router master fails. VRRP enables you to configure multiple routers as the default gateway router, which reduces the possibility of a single point of failure in a network. You can configure VRRP in such a way that traffic to and from LAN clients can be shared by multiple routers, to balance the load on available routers.

Text Authentication

HSRP and VRRP ignore unauthenticated protocol messages. The default authentication type is text authentication. HSRP or VRRP authentication protects against false hello packets causing a denial-of-service attack. For example, suppose Router A has a priority of 120 and is the active router. If a host sends spoof hello packets with a priority of 130, then Router A stops being the active router. If Router A has authentication configured such that the spoof hello packets are ignored, Router A remains the active router. Packets are rejected in any of the following cases:

  • The authentication schemes differ on the router and in the incoming packets.
  • Text authentication strings differ on the router and in the incoming packets.

Preemption

Preemption occurs when a virtual router backup with a higher priority takes over another virtual router backup that was elected to become a virtual router master, and a preemptive scheme is enabled automatically. When a newly reloaded router becomes active, despite an active router already existent on the network, it may appear that preemption is not functioning but that is not true. The newly active router did not receive any hello packets from the current active router, and the preemption configuration was not factored into the new routers decision making.

In general, we recommend that all HSRP routers have the following configuration: 


standby delay minimum 30 reload 60

The standby delay minimum reload interface configuration command delays HSRP groups from initializing for the specified time after the interface comes up.

This command is different from the standby preempt delay interface configuration command, which enables HSRP preemption delay. You can disable the preemptive scheme by using the no vrrp preempt command. If preemption is disabled, the virtual router backup that is elected to become virtual router master remains the master until the original virtual router master recovers and becomes the master again.

How to Configure HSRP

This section contains the following procedures:

Configuring HSRP

Complete the following steps to configure HSRP:

Restrictions

  • HSRP is supported only on IPv4 devices and not on IPv6 devices.
  • HSRP is supported only on layer 3 SVI interfaces. The configuration is not supported on Gigabit Ethernet or Fast Ethernet interfaces.
  • Bidirectional Forwarding Detection (BFD) protocol is not supported.

Procedure

  Command or Action Purpose

Step 1

enable

Example:


Router> enable

Enables privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:


Router# configure terminal

Enters global configuration mode.

Step 3

interface type number

Example:


Router(config)# interface vlan 10

Configures an interface type and enters interface configuration mode.

Step 4

ip address ip-address mask [secondary]

Example:


Router(config-if)# ip address 
10.0.0.1 255.255.255.0

Specifies an primary or secondary IP address for an interface.

Step 5

standby [group-number] timers [msec] hellotime [msec] holdtime

Example:


Router(config-if)# standby 1 timers 14

Configures the interval at which packets are sent to refresh the MAC cache when HSRP is running.

Step 6

standby [group-number] preempt [delay {minimum delay | reload delay | sync delay}]

Example:


Router(config-if)# standby 1 preempt 
delay minimum 380

Configures preemption and preemption delay.

Step 7

standby [group-number] priority priority

Example:


Router(config-if)# standby 1 priority 110

Configures HSRP priority.

Step 8

standby [group-number] authentication text string

Example:


Router(config-if)# standby 1 
authentication text authentication 1

Configures an authentication string for HSRP text authentication.

Step 9

standby [group-number] track object-number [decrement priority-decrement]

Example:


Router(config-if)# standby 1 
track 100 decrement 20

Configures HSRP to track an object and change the Hot Standby priority on the basis of the state of the object.

Step 10

end

Example:


Router(config-if)# end

Returns to privileged EXEC mode.

Configuration Examples for HSRP

This section provides the following configuration examples:

Example: Configuring HSRP Active Router


Router# configure terminal
Router(config)# interface GigabitEthernet0/1
Router(config-if)# service instance 1 ethernet 
Router(config-if-srv)# encapsulation dot1q 10
Router(config-if-srv)# rewrite ingress tag pop 1 symmetric
Router(config-if-srv)# bridge-domain 10
Router(config-if-srv)# end

Router# configure terminal
Router(config)# interface Vlan10 
Router(config-if)# ip address 10.10.10.21 255.255.255.0
Router(config-if)# standby 1 ip 10.10.10.20
Router(config-if)# standby 1 timers 1 4
Router(config-if)# standby 1 priority 105
Router(config-if)# standby 1 preempt delay minimum 10
Router(config-if)# standby 1 authentication cisco6 
Router(config-if)# standby 1 track 1 decrement 20
Router(config-if)# end

Example: Configuring HSRP Backup Router


Router# configure terminal
Router(config)# interface GigabitEthernet0/1
Router(config-if)# service instance 1 ethernet
Router(config-if-srv)# encapsulation dot1q 10
Router(config-if-srv)# rewrite ingress tag pop 1 symmetric
Router(config-if-srv)# bridge-domain 10
Router(config-if-srv)# end
Router# configure terminal
Router(config)# interface Vlan10
Router(config-if)# ip address 10.10.10.22 255.255.255.0
Router(config-if)# standby 1 ip 10.10.10.20
Router(config-if)# standby 1 timers 1 4
Router(config-if)# standby 1 priority 90
Router(config-if)# standby 1 preempt delay minimum 10
Router(config-if)# standby 1 authentication cisco6
Router(config-if)# standby 1 track 1 decrement 20
Router(config-if)# end

Example: HSRP Text Authentication

The following example shows how to configure HSRP text authentication using a text string: 


Router# configure terminal
Router(config)# interface Ethernet0/1
Router(config-if)# standby 1 priority 110
Router(config-if)# standby 1 preempt
Router(config-if)# standby 1 authentication text company2
Router(config-if)# standby 1 ip 10.21.0.10

Information About HSRP Version 2

HSRP Version 2 Design

HSRP version 2 is designed to address the following restrictions in HSRP version 1:

  • In HSRP version 1, millisecond timer values are not advertised or learned. HSRP version 2 advertises and learns millisecond timer values. This change ensures stability of the HSRP groups in all cases.

  • In HSRP version 1, group numbers are restricted to the range that is from 0 to 255. HSRP version 2 expands the group number range from 0 to 4095.

  • HSRP version 2 provides improved management and troubleshooting. With HSRP version 1, you cannot use HSRP active hello messages to identify the physical device that sends the message because the source MAC address is the HSRP virtual MAC address. The HSRP version 2 packet format includes a 6-byte identifier field that is used to uniquely identify the sender of the message. Typically, this field is populated with the interface MAC address.

  • The multicast address 224.0.0.2 is used to send HSRP hello messages. This address can conflict with Cisco Group Management Protocol (CGMP) leave processing.

Version 1 is the default version of HSRP.

HSRP version 2 uses the new IP multicast address 224.0.0.102 to send hello packets instead of the multicast address of 224.0.0.2, used by HSRP version 1. This new multicast address allows CGMP leave processing to be enabled at the same time as HSRP.

HSRP version 2 permits an expanded group number range, 0 to 4095, and consequently uses a new MAC address range 0000.0C9F.F000 to 0000.0C9F.FFFF. The increased group number range does not imply that an interface can, or should, support that number of HSRP groups. The expanded group number range was changed to allow the group number to match the VLAN number on subinterfaces.

When the HSRP version is changed, each group will reinitialize because it now has a new virtual MAC address.

HSRP version 2 has a different packet format than HSRP version 1. The packet format uses a type-length-value (TLV) format. HSRP version 2 packets received by an HSRP version 1 device will have the type field mapped to the version field by HSRP version 1 and subsequently ignored.

HSRP version 2 is effective from Cisco IOS Release 15.5(03)s.

How to Configure HSRP Version 2

Changing to HSRP Version 2

HSRP version 2 was introduced to prepare for further enhancements and to expand the capabilities beyond what is possible with HSRP version 1. HSRP version 2 has a different packet format than HSRP version 1.


Note
  • HSRP version 2 is not available for ATM interfaces running LAN emulation.
  • HSRP version 2 does not interoperate with HSRP version 1. An interface cannot operate both version 1 and version 2 because both versions are mutually exclusive. However, the different versions can be run on different physical interfaces of the same device. You cannot change from version 2 to version 1 if you have configured groups above the group number range allowed for version 1 (0 to 255).
  • HSRP version 2 is supported only on IPv4 devices and not on IPv6 devices.

  • HSRP version 2 configuration is supported only on layer 3 SVI interfaces. The configuration is not supported on Gigabit Ethernet or Fast Ethernet interfaces.

Procedure

  Command or Action Purpose

Step 1

enable

Example:


Device> enable

Enables privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 3

interface type number

Example:


Device(config)# interface vlan 350

Configures an interface type and enters interface configuration mode.

Step 4

standby version {1 | 2}

Example:


Device(config-if)# standby version 2

Changes the HSRP version.

Step 5

standby [group-number] priority [priority]

Example:


Device(config-if)# standby 350 priority 100

Configures HSRP priority.

Step 6

standby [group-number] preempt

Example:


Router(config-if)# standby 350 preempt

Configures preemption.

Step 7

standby [group-number] timers [msec]

Example:


Router(config-if)# standby 350 timers 515

Configures timers.

Step 8

standby[group-number] ip address ip-address mask [secondary]

Example:


Router(config-if)# standby 350 ip 172.20.100.10

Specifies an primary or secondary IP address for an interface.

Step 9

end

Example:


Device(config-if)# end

Ends the current configuration session and returns to privileged EXEC mode.

Step 10

show standby

Example:


Device# show standby

(Optional) Displays HSRP information.

  • HSRP version 2 information will be displayed if configured.

Configuration Examples for HSRP Version 2

Example: Configuring HSRP Version 2

The following example shows how to configure HSRP version 2 on an interface with a group number of 350: 


Device(config)# interface vlan 350
Device(config-if)# standby version 2
Device(config-if)# standby 350 priority 110 
Device(config-if)# standby 350 preempt 
Device(config-if)# standby 350 timers 5 15
Device(config-if)# standby 350 ip 172.20.100.10

How to Configure VRRP

This section contains the following procedures:

Configuring VRRP

Complete the following steps to configure VRRP:

Restrictions
  • VRRP is supported only on IPv4 devices and not IPv6 devices.
  • VRRP is supported only on gigabyte etherchannel interfaces of the Layer 3 SVI.
  • Bidirectional Forwarding Detection (BFD) protocol is not supported.
  • MD5 authentication is not supported.

Procedure

  Command or Action Purpose

Step 1

enable

Example:


Router> enable

Enables the privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:


Router# configure terminal

Enters the global configuration mode.

Step 3

interface type number

Example:


Router(config)# interface Vlan10

Configures an interface type and enters interface configuration mode.

Step 4

ip address ip-address mask

Example:


Router(config-if)# ip address 
10.10.10.25 255.255.255.0

Specifies a primary or secondary IP address for an interface.

Step 5

vrrp [group-number] timers advertise [msec]

Example:


Router(config-if)# vrrp 2 timers advertise 2

Configures the interval at which packets are sent to refresh the MAC cache when VRRP is running

Step 6

vrrp [group-number] preempt [delay minimum seconds ]

Example:


Router(config-if)# vrrp 2 preempt delay 
minimum 10

Configures preemption delay.

Step 7

vrrp [group-number] priority priority

Example:


Router(config-if)# vrrp 2 priority 200

Configures VRRP priority.

Step 8

vrrp [group-number] authentication text string

Example:


Router(config-if)# vrrp 2 authentication 
text cisco7

Configures an authentication string for VRRP text authentication.

Step 9

vrrp [group-number] track object-number [decrement priority-decrement]

Example:


Router(config-if)# vrrp 2 track 1 
decrement 20

Configures VRRP to track an object and change the Hot Standby priority on the basis of the state of the object.

Step 10

end

Example:


Router(config-if)# end

Returns to the privileged EXEC mode.

Configuration Examples for VRRP

This section provides the following configuration examples:

Example: Configuring a VRRP Master Router

This example shows how to configure a VRRP Master router. 


Router# configure terminal
Router(config)# interface GigabitEthernet0/1
Router(config-if)# service instance 1 ethernet
Router(config-if-srv)# encapsulation dot1q 10
Router(config-if-srv)# rewrite ingress tag pop 1 symmetric
Router(config-if-srv)# bridge-domain 10
Router(config-if-srv)# end
Router# configure terminal
Router(config)# interface Vlan10
Router(config-if)# ip address 10.10.10.25 255.255.255.0
Router(config-if)# vrrp 2 ip 10.10.10.30
Router(config-if)# vrrp 2 timers advertise 2
Router(config-if)# vrrp 2 preempt delay minimum 10
Router(config-if)# vrrp 2 priority 110
Router(config-if)# vrrp 2 authentication text cisco7
Router(config-if)# vrrp 2 track 1 decrement 20
Router(config-if)# end

Example: Configuring a VRRP Backup Router

This example shows how to configure a VRRP Backup router. 

Router# configure terminal
Router(config)# interface GigabitEthernet0/1
Router(config-if)# service instance 1 ethernet
Router(config-if-srv)# encapsulation dot1q 10
Router(config-if-srv)# rewrite ingress tag pop 1 symmetric
Router(config-if-srv)# bridge-domain 10
Router(config-if-srv)# end
Router# configure terminal
Router(config)# interface Vlan10
Router(config-if)# ip address 10.10.10.26 255.255.255.0
Router(config-if)# vrrp 2 ip 10.10.10.30
Router(config-if)# vrrp 2 timers advertise 2
Router(config-if)# vrrp 2 preempt delay minimum 10
Router(config-if)# vrrp 2 priority 90
Router(config-if)# vrrp 2 authentication text cisco7
Router(config-if)# vrrp 2 track 1 decrement 20

Router(config-if)# end

Example: VRRP Text Authentication

The following example shows how to configure VRRP text authentication using a text string: 


Router# configure terminal
Router(config)# interface GigabitEthernet 0/0/0
Router(config)# ip address 10.21.8.32 255.255.255.0
Router(config-if)# vrrp 10 authentication text stringxyz
Router(config-if)# vrrp 10 ip 10.21.8.10

Where to Go Next

For additional information on configuring HSRP and VRRP, see the documentation listed in the Additional References section.

Additional References

The following sections provide references related to LLDP feature.

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

Cisco ASR 901 Command Reference

Cisco ASR 901 Series Aggregation Services Router Command Reference

Cisco IOS Interface and Hardware Component Commands

Cisco IOS Interface and Hardware Component Command Reference

Standards

Standard

Title

None

—

MIBs

MIB

MIBs Link

None

To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/c/en/us/td/docs/wireless/asr_901/mib/reference/asr_mib.html

RFCs

RFC

Title

No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.

—

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html

Feature Information for HSRP and VRRP

Table 1 lists the release history for this feature and provides links to specific configuration information.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn . An account on Cisco.com is not required.


Note
Table 1 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Table 1. Feature Information for HSRP and VRRP

Feature Name

Releases

Feature Information

HSRP and VRRP

15.2(2)SNG

The following sections provide information about this feature: