HSRP with secondarys?

I'm curious about how to set up HSRP when I have secondary addresses assigned to a Vlan. This is what we currently have.

6509 running 7.6(3), MSFC1 running 12.1(26)E3, and here are the relevant configs:

interface Vlan1 ip address 10.0.122.254 255.255.255.128 secondary ip address 10.0.122.124 255.255.255.128 secondary ip address 10.0.121.124 255.255.255.0 no ip redirects

Now that we have a second 6509, we want to set up HSRP for redundancy to our WAN. Do I need to change it to this:

interface Vlan1.1 ip address 10.0.121.253 255.255.255.0 no ip redirects standby 1 ip 10.0.121.124 standby 1 preempt standby 1 priority 110

interface Vlan1.2 ip address 10.0.122.123 255.255.255.128 no ip redirects standby 1 ip 10.0.122.124 standby 1 preempt standby 1 priority 110

interface Vlan1.3 ip address 10.0.122.253 255.255.255.128 no ip redirects standby 1 ip 10.0.122.254 standby 1 preempt standby 1 priority 110

Or something else? Thanks for your help!

Reply to
Who knows?
Loading thread data ...

Yes, something else.

You should try to remove the secondary addressing. It is Ok as a workaround but it looks unprofessional. It is harder to understand that might be necessary and will make dynamic routing challanging.

Router 1 interface Vlan1 ip address 10.0.122.254 255.255.255.128 secondary ip address 10.0.122.124 255.255.255.128 secondary ip address 10.0.121.124 255.255.255.0 no ip redirects

Router2 ip address 10.0.122.253 255.255.255.128 secondary ip address 10.0.122.123 255.255.255.128 secondary ip address 10.0.121.123 255.255.255.0 no ip redirects

!! ON BOTH routers with the priority set as you choose

standby 1 ip 10.0.121.122 !

Reply to
anybody43

I don't think you need three standby groups, you can do it with the secondary option to "standby ip":

standby 1 ip 10.0.121.122 standby 1 ip 10.0.122.252 secondary standby 1 ip 10.0.122.122 secondary standby 1 preempt standby 1 priority xxx

Reply to
Barry Margolin

Thanks.

Not noticed that one:-) Maybe one day I will look it up. I guess I will have to I ever get round to CCIE.

Following has turned into a ramble, hope you all don't mind too much.

To me though this is adding complexity where none is needed. Is it exactly the same operationally i.e. as far as the traffic is concerned.

Interesting though.

What does it mean? OK, are you going to tell us what it means or do I have to try it out?

With >2 group members with the same address only one group member is active, what happens here?

To the OP, Barry's solution may indeed do what you want however it is I feel unusual and just for that reason I would discourage it.

Yours, puzzled!

Maybe it was added as a workaround for not having sufficient groups (~255)?

Reply to
anybody43

Not all router models support multiple standby groups for the same NIC. The reason is that a separate virtual MAC address is created for each standby group, and some Cisco NICs have a limit on the number of MACs that can be assigned (you could do it, but you had to use the "standby use-bia" option to prevent use of the virtual MAC, which makes failover less transparent). IIRC, this was a problem for 2501's, but maybe it's not an issue for the router models made in the last 5 years.

Multiple standby groups should be used when you need different routers to be active for different groups. For instance, if you want to load balance between two routers, but have failover when one of them dies, you would set up two standby groups, and set the priorities different in them, so that one of them is primary for group 1 and the other is primary for group 2.

But if the only difference between the standby groups is the IP, you might as well just use secondary IPs so that you don't have to repeat all the standby settings.

The secondary standby IP's are just like secondary interface IP's. When the router becomes active for that group, it takes on all the standby IP's.

Multiple

Reply to
Barry Margolin

Thanks it was late and I was a bit tired after battling with Checkpoint licensing.

Reply to
anybody43

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.