1 / 80

CIS 187 Multilayer Switched Networks CCNP version 7 Rick Graziani Spring 2016

CIS 187 Multilayer Switched Networks CCNP version 7 Rick Graziani Spring 2016. Ch. 6 FHRP and HSRP. Implementing High Availability. To achieve high network availability, the following network components are required:

dnieves
Télécharger la présentation

CIS 187 Multilayer Switched Networks CCNP version 7 Rick Graziani Spring 2016

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. CIS 187 Multilayer Switched NetworksCCNP version 7Rick GrazianiSpring 2016 Ch. 6 FHRP and HSRP

  2. Implementing High Availability • To achieve high network availability, the following network components are required: • Reliable, fault-tolerant network devices— Hardware and software reliability to automatically identify and overcome failures. • Device and link redundancy— • Devices • Devices modules • Links • Resilient network technologies— Fast recovery for devices or links. • Optimized network design— Well-defined network topologies and configurations to ensure no single point of failure. • Best practices— Documented procedures for deploying and maintaining a robust e-commerce network infrastructure. • Change control— Better control over changes made to network devices and maintenance of documentation regarding those changes.

  3. High Availability

  4. Single Forwarding Path vs Redundancy Single Forwarding Path Adding Redundancy

  5. Implementing High Availability • Redundancy does not mean co-located in the same physical location. • Power outage • Paraphrasing Jim Warner, Network Engineer at UCSC, ‘When adding redundancy, know what you are trying to protect yourself from. It doesn’t help to have redundant devices when there is a power failure, or redundant links when the cables are in the same conduit.’

  6. Implementing Default Gateway Router Redundancy in Multilayer Switched Networks

  7. Implementing Default Gateway Router Redundancy in Multilayer Switched Networks • Examples of (non-redundant) dynamic router discovery are as follows: • Static/DHCP • Host is statically configured or uses DHCP. • Proxy ARP • The host uses Address Resolution Protocol (ARP) to determine the next-hop MAC address for off-network destinations. • Local routers respond to the ARP request with their own MAC address. • Routing protocol • The host listens to dynamic routing protocol updates (for example, EIGRP and forms its own routing table. • ICMP Router Discovery Protocol (IRDP) client • The host runs an Internet Control Message Protocol (ICMP) router discovery client.

  8. Static or DHCP • The most common method of providing a host with a default gateway address is: • Static configuration • DHCP • Advantage of DHCP: • Simplifies end-device configuration • Disadvantage of DHCP: • Creates a single point of failure. • If the default gateway fails, the end device is limited to communicating only on the local IP network segment and is cut off from the rest of the network.

  9. Proxy ARP

  10. I am on the 172.16.0.0/16 network so I can reach 172.16.20.200! Proxy ARP • Router has Proxy ARP enabled on all interfaces. • Host A has a /16 subnet mask. • Host A believes that it is directly connected to all of network 172.16.0.0/16. • Host A is really on the 172.16.10.0/24 network, as segmented by the router, but Host A does not know that. • Host A has a packet to send to Host D • Host A believes that Host D is directly connected. • Host A sends an ARP request to Host D.

  11. ARP Request: “Hey everyone on my network, whoever is 172.16.20.200, send me your Ethernet MAC Address! Proxy ARP • To reach Host D (172.16.20.200), Host A needs the MAC address of Host D. • Layer 2, Ethernet broadcast (FFFF.FFFF.FFFF). • The ARP request reaches all nodes in the Subnet A. • The broadcast will not reach Host D.

  12. Host A’s ARP Table Proxy ARP ARP Request/Reply: “I can reach 172.16.20.200 on another network, so I will Reply to the Host A with my MAC address.” Proxy ARP Reply from Router to Host A • Since the router knows that the target address (172.16.20.200) is on another subnet and can reach Host D, it will reply with its own MAC address to Host A.

  13. Host A’s ARP Table Proxy ARP • From now on Host A will forward all the packets that it wants to reach 172.16.20.200 (Host D) to the MAC address 00-00-0c-94-36-ab (router). • All packets destined to Subnet B are sent to the router including this packet for Host B. • The router forwards the packets to Host B and also for other hosts in Subnet B.

  14. Host A’s ARP Table Non-Proxy ARP

  15. Host A’s ARP Table Non Proxy ARP 172.16.20.200 00-00-0c-94-36-bb ARP Request 172.16.20.200/24 0000.0c94.36bb Different Situation and Addresses: Host A pings Host B • Host B has the IP address 172.16.20.200/24 ARP Request/Reply • What if Host A has a packet to send Host B? • In this case, both the Router and Host B will receive the ARP Request (MAC broadcast). • Switch floods the broadcast. • Host B will send an ARP Reply.

  16. Proxy ARP Router(config)# ip arp proxy disable Router(config)# interface Fa 0/0 Router(config-if)# no ip proxy-arp Disables Proxy ARP globally Disables Proxy ARP per interface • Proxy ARP is enabled by default. • Proxy ARP can be disabled globally or on a per interface basis. • Proxy ARP should be used on the network where IP hosts are not configured with default gateway. • Disadvantages of Proxy ARP • It increases the amount of ARP traffic on your segment (instead of one default gateway, ARPing for several hosts). • Security may be undermined. A machine can claim to be another in order to intercept packets, an act called "spoofing."

  17. Proxy ARP Packets Packets dropped • Limited redundancy with Proxy ARP. • If the responsible router fails, the host continues to send packets for the destination to the MAC address of that router. • Those packets subsequently are discarded.

  18. Proxy ARP Packets Router down, but Host ARP entry is still Router A, packets continue to get dropped. • Once the ARP flushes the entry due to flush timer expiry, the host recovers the default gateway MAC address. • Nevertheless, Cisco does not recommend the use of proxy ARP, because it makes troubleshooting very difficult. Once ARP entry times out on host, it will send another ARP Request Router B will send a Proxy ARP Reply with its MAC address Host now sends packets to Router B for File Server A.

  19. IRDP – ICMP Router Discovery Message Protocol

  20. Need for First Hop Redundancy Protocols • If the default gateway fails, a host will be unable to send packets to another subnet. • Even if a redundant router exists that could serve as a default gateway for that subnet, there is no dynamic method by which these devices can determine the address of a new default gateway. • With first-hop router redundancy, a set of routers or Layer 3 switches work together to present the illusion of a single virtual router to the hosts on the LAN. • By sharing an IP address and a MAC (Layer 2) address, two or more routers can act as a single “virtual” router.

  21. Redundancy Protocols • Cisco IOS offers several features to provide a redundant default gateway to end devices. • The following are the default gateway redundancy features supported by Cisco IOS routers and switches: • Hot Standby Routing Protocol (HSRP) • Virtual Router Redundancy Protocol (VRRP) • Gateway Load Balancing Protocol (GLBP)

  22. HSRPHot Standby Router Protocol

  23. HSRP (Hot Standby Routing Protocol) • Cisco proprietary protocol • RFC 2281 • Method of providing IP address sharing and redundancy for default gateways. • The protocol consists of a: • Virtual MAC address • IP address • Shared between two routers: • Active Router • Standby Router • Routers exchange HSRP hello messages at regular intervals

  24. One virtual router • The virtual router is not an actual router. • Represents the HSRP group acting as one virtual router. • It is the default gateway as far as hosts on the subnet are concerned. One active router • The active router forwards traffic destined to the virtual IP address. One standby router • The backup router in case the active router fails for the subnet. • It will then forward traffic destined to the virtual IP address.

  25. ARP Table172.16.10.1 = 0000.0c07.ac01 My default gateway is 172.16.10.1 172.16.10.202 0010.0b79.5800 172.16.10.1 0000.0c07.ac01 172.16.10.2010010.f6b3.d000 • The host connected to the switch sends the packet destined for the virtual router, but in reality the active router does the packet forwarding. • Note: Additional HSRP member routers— Other routers are neither active nor standby, but they are configured to participate in the same HSRP group. • They monitor the current active and standby routers and transition into one of those roles if the current router fails for the subnet.

  26. ARP Table172.16.10.1 = 0000.0c07.ac01 My default gateway is 172.16.10.1 172.16.10.1 0000.0c07.ac01 172.16.10.202 0010.0b79.5800 172.16.10.2010010.f6b3.d000 HSRP Hello’s: Standby HSRP Hello’s: Active • The active router assumes and maintains its active role through the transmission of hello messages (default every 3 seconds). • Sent by active and standby routers. • Multicast 224.0.0.2 (“all routers”) using UDP port 1985 • The router with the highest standby priority - active router. • 0 to 255 • Default = 100 (configurable) • Otherwise, the router with the highest IP address • When the preempt option is not configured, the first router to initialize HSRP becomes the active router. (May not be what you want!)

  27. ARP Table172.16.10.1 = 0000.0c07.ac01 My default gateway is 172.16.10.1 172.16.10.1 0000.0c07.ac01 172.16.10.202 0010.0b79.5800 172.16.10.2010010.f6b3.d000 HSRP Hello’s: Standby • The second router in the HSRP group to initialize or second highest priority is elected as the standby router. • Monitor the operational status of the HSRP group • Quickly assumes packet-forwarding responsibility if the active router becomes inoperable. • The standby router also transmits hello messages to inform all other routers in the group of its standby router role and status.

  28. ARP Table172.16.10.1 = 0000.0c07.ac01 My default gateway is 172.16.10.1 I receive and forward packet sent to the virtual router. 172.16.10.1 0000.0c07.ac01 172.16.10.202 0010.0b79.5800 172.16.10.2010010.f6b3.d000 • The virtual router presents a consistent available router (default gateway) to the hosts. • Assigned its: • Own IP address • Own virtual MAC address • The active router acting as the virtual router actually forwards the packets. • Additional HSRP member routers: These routers in listen state monitor the hello messages but do not respond. • Do forward any packets addressed to the routers' IP addresses. • Do not forward packets destined for the virtual router because they are not the active router.

  29. ARP Table172.16.10.1 = 0000.0c07.ac01 My default gateway is 172.16.10.1 I don’t see Hellos from Active (10 secs), so I will receive and forward packets sent to the virtual router. New Active Router 172.16.10.1 0000.0c07.ac01 172.16.10.2020010.0b79.5800 172.16.10.2010010.f6b3.d000 HSRP Hello’s HSRP Hello’s: Active • When the active router fails, the other HSRP routers stop receiving hello messages and the standby router assumes the role of the active router. • When the holdtime expires (default 10 seconds). • Because the new active routerassumes both the IP address and virtual MAC address of the virtual router, the end stations see no disruption in service.

  30. ARP Table172.16.10.1 = 0000.0c07.ac01 My default gateway is 172.16.10.1 172.16.10.202 0010.0b79.5800 172.16.10.1 0000.0c07.ac01 172.16.10.2010010.f6b3.d000 • When the only the active router fails: • Standby takes over. • If there are other routers participating in the group, those routers then contend to be the new standby router. • The new active routerremains the forwarding router even when the former active router with the higher priority regains service in the network unless preempt is configured (coming). • If both the active and standby routers fail: • All routers in the HSRP group contend for the active and standby router roles.

  31. 200 100 Virtual IP • To configure a router as a member of an HSRP standby group, enter this command in interface configuration mode: (Physical interface or VLAN interface if VLANs are used) Switch(config-if)#standby group-number ip virtual-ip-address • group-number refers to the HSRP standby group number. • The group number can range from 0 to 255. • virtual-ip-address indicates the virtual IP address of the HSRP group. DLS1 interface vlan 10 ip add 172.16.10.201 255.255.255.0 standby 1 priority 200 standby 1 ip 172.16.10.1 standby 1 preempt DLS2 interface vlan 10 ip add 172.16.10.202 255.255.255.0 standby 1 priority 100 standby 1 ip 172.16.10.1 standby 1 preempt

  32. 200 210 220 100 Virtual IP Switch(config-if)#standby group-number ip virtual-ip-address • group-number refers to the HSRP standby group number. • The group number can range from 0 to 255. • 0 is the default • Most Cisco switches support only up 16 groups. • Each VLAN does NOT have to have it’s own group number. • Group numbers are locally significant to that VLAN or interface. DLS1 interface vlan 10 ip add 172.16.10.201 255.255.255.0 standby 1 priority 200 standby 1 ip 172.16.10.1 standby 1 preempt interface vlan 20 ip add 172.16.20.202 255.255.255.0 standby 1 priority 210 standby 1 ip 172.16.20.1 standby 1 preempt interface vlan 30 ip add 172.16.30.202 255.255.255.0 standby 1 priority 220 standby 1 ip 172.16.30.1 standby 1 preempt

  33. 200 100 Priority • To set the priority value of a router, enter this command in interface configuration mode: Switch(config-if)#standby group-number priority priority-value • The priority-value indicates the number that prioritizes a potential standby router. • The range is 0 to 255; the default is 100. • Some documentation states 1 to 255. • During the election process, the router in an HSRP group with the highest priority becomes the forwarding router. • If several routers have the same priority, the physical IP address of the router's interface is used as a tiebreaker. • The router with the numerically highest IP address wins. • In reality the router that boots up first will most likely become the active router. • Best to use the preempt command (coming) DLS1 interface vlan 10 ip add 172.16.10.201 255.255.255.0 standby 1 priority 200 standby 1 ip 172.16.10.1 standby 1 preempt DLS2 interface vlan 10 ip add 172.16.10.202 255.255.255.0 standby 1 priority 100 standby 1 ip 172.16.10.1 standby 1 preempt

  34. Timers Both the hellotime and the holdtime parameters are configurable. Switch(config-ig)#standby group timers [msec] hellotime[msec] holdtime • Hellotime • Default = 3 seconds • Value varies from 1 to 255. • Holdtime • Default = 10 seconds • Value varies from 1 to 255. • Timers will be in milliseconds (1/1,000th) of the msec keyword precedes a value. • To reinstate the default standby timer values, enter the following command: no standby group-number timers

  35. 200 100 HSRP Group Identifier DLS1 interface vlan 10 ip add 172.16.10.201 255.255.255.0 standby 1 priority 200 standby 1 ip 172.16.10.1 standby 1 preempt DLS2 interface vlan 10 ip add 172.16.10.202 255.255.255.0 standby 1 priority 100 standby 1 ip 172.16.10.1 standby 1 preempt • DLS1 has a priority of 200 • DLS2 has a default priority of 100. • Who is the active router? • DLS1 assumes the active router role and forwards all frames addressed to the well-known MAC address of: 0000.0c07.acxx where xx is the HSRP group identifier.

  36. 201 202 1 • If the HSRP group number of router A is 01, the MAC address that corresponds to the virtual IP address is 0000.0c07.ac01. • If the HSRP group number of router A is 47, the MAC address that corresponds to the virtual IP address is 0000.0c07.ac2f. • Group number (47) converted to hexadecimal (2f).

  37. 200 100 Preempt • The standby router automatically assumes the active router role when the active router fails or is removed from service. • This new active router remains the forwarding router even when the former active router with the higher priority regains service in the network. • The former active router can be configured to resume the forwarding router role from a router with a lower priority. • To enable a router to resume the active state after a state change, enter the following command in interface configuration mode: Switch(config-if)#standby group-number preempt [delay [minimum seconds] [reload seconds]] • To remove the interface from preemptive status, enter the following command: Switch(config-if)#no standby group-numberpreempt DLS1 interface vlan 10 ip add 172.16.10.201 255.255.255.0 standby 1 priority 200 standby 1 ip 172.16.10.1 standby 1 preempt DLS2 interface vlan 10 ip add 172.16.10.202 255.255.255.0 standby 1 priority 100 standby 1 ip 172.16.10.1 standby 1 preempt

  38. 200 100 Delay Switch(config-if)#standby group-number preempt [delay [minimum seconds] [reload seconds]] • Default: Router will immediately preempt another router that has an active role. • minimum: Router will wait for (0 to 3600 seconds) before attempting to overthrow the active router with a lower priority • This time begins as soon as the router is capable of assuming the the active role. • Interface comes up • HSRP is configured • reload: Router will wait for (0 to 3600 seconds) after it has been reloaded or restarted before attempting to overthrow the active router with a lower priority. • This is helpful when you need time for the routing protocol to converge. DLS1 interface vlan 10 ip add 172.16.10.201 255.255.255.0 standby 1 priority 200 standby 1 ip 172.16.10.1 standby 1 preempt DLS2 interface vlan 10 ip add 172.16.10.202 255.255.255.0 standby 1 priority 100 standby 1 ip 172.16.10.1 standby 1 preempt

  39. 200 100 Plain Text Authentication Switch(config-if)# standby group-number authenticationstring • Sent in plain text to authenticate HSRP peers. • Can be easily intercepted and used to impersonate a legitimate peer. • Intended only to prevent peers with a default configuration (no authentication) from participating in HSRP. DLS1 interface vlan 10 ip add 172.16.10.201 255.255.255.0 standby 1 priority 200 standby 1 ip 172.16.10.1 standby 1 preempt standby 1 authentication nosecret DLS2 interface vlan 10 ip add 172.16.10.202 255.255.255.0 standby 1 priority 100 standby 1 ip 172.16.10.1 standby 1 preempt standby 1 authentication nosecret

  40. 200 100 MD5 Authentication Switch(config-if)# standby group-number authentication md5 key-string [0|7]string • Message Digest 5 (MD5) hash is computed on a portion of each HSRP message. • More secure than plain text authentication. • Can use key chains when using multiple keys: Switch(config-if)# standby group authentication md5 key-chain hsrp1 Switch(config)# key chain hsrp1 Switch(config-keychain)# key 1 Switch(config-keychain-key)# key-string secretkey • MD5 and HSRP: • http://www.cisco.com/en/US/docs/ios/12_3t/12_3t2/feature/guide/gthsrpau.html DLS1 interface vlan 10 ip add 172.16.10.201 255.255.255.0 standby 1 priority 200 standby 1 ip 172.16.10.1 standby 1 preempt standby 1 authentication md5 key-string nosecret DLS2 interface vlan 10 ip add 172.16.10.202 255.255.255.0 standby 1 priority 100 standby 1 ip 172.16.10.1 standby 1 preempt standby 1 authentication md5 key-string nosecret

  41. Speak state— HSRP routers in the speak state send periodic hello messages and actively participate in the election of the active or standby router. The router remains in the speak state unless it becomes an active or standby router. Listen state— The router knows the virtual IP address, butis neither the active router nor the standby router. All other routers participating in the HSRP group besides the active or standby routers reside in this state. Standby state— In the standby state, the HSRP router is a candidate to become the next active router and sends periodic hello messages. There must be at least one standby router in the HSRP group. Learn state— The router has not determined the virtual IP address, and has not yet seen a hello message from the active router. In this state, the router is still waiting to hear from the active router. Initial state— All routers begin in the initial state. This state is entered via a configuration change or when an interface is initiated. Active state— In the active state, the router is currently forwarding packets that are sent to the virtual MAC and IP address of the HSRP group. The active router also sends periodic hello messages. HSRP States HSRP Standby Group 1 Router A Priority 100 Router B Priority 50 Initial Initial Learn Learn All other routers remain in this state. Listen Listen Router A does not hear any higher priority than itself, so promotes itself to standby. Speak Speak Router B hears that router A has a higher priority, so router B returns to the listen state. Standby Listen Router A does not hear an active router, so promotes itself to active. Active Speak Standby

  42. Configuring HSRP on Routers Virtual Router 10.10.10.10/24 10.10.10.11/24 10.10.10.1/24 R1 interface gig 0/2 ip address 10.10.10.10 255.255.255.0 standby 1 priority 120 standby 1 preempt standby 1 ip 10.10.10.1 R2 interface gig 0/2 ip address 10.10.10.11 255.255.255.0 standby 1 priority 110 standby 1 preempt standby 1 ip 10.10.10.1

  43. HSRP Load Balancing Gateway: 172.16.10.1 Gateway: 172.16.10.1 Gateway: 172.16.10.2 Gateway: 172.16.10.2

  44. HSRP Load Balancing Gateway: 172.16.10.1 Gateway: 172.16.10.1 Gateway: 172.16.10.2 Gateway: 172.16.10.2 • While a router is actively forwarding traffic for one HSRP group, it can be in the standby or listen state for another group. • Each standby group emulates a single virtual router.

  45. HSRP Load Balancing Note: There can be up to 255 standby groups on any VLAN or interface. Increasing the number of groups in which a router participates increases the management load on the router and may affect the performance of the router for very large numbers of HSRP groups. Gateway: 172.16.10.1 Gateway: 172.16.10.1 Gateway: 172.16.10.2 Gateway: 172.16.10.2 • Both DLS1 and DLS2 are members of groups 1 and 2. • DLS1: • Active forwarding router for group 1 • Standby router for group 2. • DLS2: • Active forwarding router for group 2 • Standby router for group 1.

  46. 200 100 100 200 Load balancing HSRP 172.16.10.1 172.16.10.2 Gateway: 172.16.10.1 Gateway: 172.16.10.1 Gateway: 172.16.10.2 Gateway: 172.16.10.2 DLS1 interface vlan 10 ip add 172.16.10.82 255.255.255.0 standby 1 priority 200 standby 1 ip 172.16.10.1 standby 1 preempt standby 2 priority 100 standby 2 ip 172.16.10.2 standby 2 preempt DLS2 interface vlan 10 ip add 172.16.10.169 255.255.255.0 standby 1 priority 100 standby 1 ip 172.16.10.1 standby 1 preempt standby 2 priority 200 standby 2 ip 172.16.10.2 standby 2 preempt

  47. Configuring HSRP Interface Tracking Active Router • In some situations, the status of an interface directly affects which router needs to become the active router. • This is particularly true when each of the routers in an HSRP group has a different path to resources within the campus network. • Routers A and B are exchanging hello messages through their E0 interfaces.

  48. Configuring HSRP Interface Tracking Active Router Router A sends ICMP Redirect to Host, pointing it to Router B. X Host now sends packets to Router B. • Primary T1 link experiences a failure. • Without HSRP enabled, router A would detect the failed link and send an ICMP redirect to router B.

  49. Configuring HSRP Interface Tracking Active Router Router A still sends HSRP Hello’s. X Hosts continue to send packets to Router A. • However, when HSRP is enabled, ICMP redirects are disabled. • Enabling HSRP on a Cisco router interface automatically disables ICMP redirects to ensure that the actual addresses of the participating HSRP routers are not discovered. • Although the S1 interface on router A is no longer functional, router A still sends hello messages out interface E0, indicating that router A is still the active router. • Packets sent to the virtual router for forwarding to headquarters cannot be routed.

  50. Configuring HSRP Interface Tracking Active Router Router A still sends HSRP Hello’s. X Hosts continue to send packets to Router A. • Interface tracking enables the priority of a standby group router to be automatically adjusted based on availability of the other interfaces on that router.

More Related