HSRP

Hot standby router protocol is one of those protocols that is Cisco proprietary. Cisco created it for use on their devices, and it allows us to have a virtual IP address that can swap between two different devices, so we can create redundancy within our network.

Roles: active and standby

Just like FHRP, HSRP has a virtual IP address. You would set this up, in this case since these are layer 3 switches, on the SVI interface for whatever VLAN it's associated with. So let's say this laptop is associated with VLAN 10. You would then set this virtual IP address up on VLAN 10, and it would point to a virtual IP address. In this case, let's use 10.1.10.1, and you would set that up on both of these devices.

Now what would happen is there would be some sort of MAC address associated with each one of these. Another thing that would happen is one of these would become the active, meaning that it's responding to that MAC address, and the other would be a standby. So these are the two different roles: active and standby. If it's active, then it's actively responding to that MAC address, versus the standby is just waiting in case the other one goes down.

Now what will happen is that this device right here will reach out to its default gateway and ask it. It does an ARP request and says, I have an IP address of 10.1.10.1, I need the MAC address for that. So it will send that out, and that is a message that gets broadcasted out across the network. Both of these switches receive that, but this one is the active one, so it's going to respond to that ARP request. It's going to reply back to this machine and say, yes, that IP address belongs to me, and here is my MAC address. So now this device has the MAC address; it's a virtual MAC address that's shared between these two devices.

But another thing that happened during this whole process is that this switch associated that MAC address with the port that it came in on, so this port right here. And same thing with this: this switch associated it with this port right here. So it associated the MAC address with a port. Now what will happen is all further communication that happens to that MAC address that goes through these devices will be sent to that layer 3 switch right there.

Now these two devices are communicating back and forth with hello packets. If the other device goes down, this device, the second layer 3, the standby, sees, or doesn't see, this device anymore, and so now it's going to start responding as if it's the default gateway. So the next ARP request that comes through, it will respond back and say this is my MAC address, and it's the same MAC address that was used by this machine right here. But the difference here is that these switches now associate it with a different port. So it now makes a correction and says that MAC address is associated with this port, and starts sending traffic now to this device rather than to this other device that's down.

And so that's how these different roles work. The active one is actively responding to these ARP requests and actively receiving the traffic to this MAC address, versus the standby is just waiting; and if the active goes down, then the standby becomes the active one.

The election process

As we mentioned, when we set this up we set it up with a virtual IP address, and let's say that virtual IP address for this VLAN 10 is a dot one for each one of those. And we also set it up with a regular IP address, so we still need to do some communication to it when it's not the default gateway. So let's say this one's dot two and this one's dot three. They're different, so we can communicate to each one of these specific devices. But one of these becomes an active one and one becomes a standby.

So what is the election process to choose the active one, and what chooses the standby? Well, they communicate back and forth with these packets and decide amongst themselves, and we have to have a tiebreaker. So what they do is they choose which one has the highest priority. You can go onto this SVI interface and set a priority for each one of these. The default is a hundred; the range is anywhere from zero to 255. So if I want this one to be the primary, or the active one, I would get onto it and I'd set the priority level to something like maybe 120, something that's greater than 100, or maybe it's 128, or maybe it's 150, or whatever the case may be. And then this one during the election process will be chosen as the active participant here and be responding, where the other one will be the standby.

Now, if you haven't set a priority, then it chooses the highest IPv4 address. So in this case right here, the highest would be this switch over here, because we set it to dot three.

The preempt command

A thing to note is that once a device becomes active, so this one's active, the other one, once it comes up, is not going to take back that active status. At least not by default. What I mean by that is, if this priority is set to 120, and maybe we've even set it as being the higher IP address to make sure this becomes active, when this one becomes active, goes from standby to active, and this one comes back online, this will become the standby and will not automatically switch over.

But we may want it to fail back as soon as this comes live again, as soon as this comes up. So that's where the preempt command comes in. What we would do is, on whichever one that we wanted to be the standby most of the time, we would get onto it and use the standby preempt command on that switched virtual interface. And then what it would do is it would recognize when this other device came back online. It would allow that one to become active again, and this one could become the standby.

And it bases that off of the priority, and just the priority. So if we had the default on here and they were both set to 100, and this one's dot three and this one's dot two, it would not fail over. But we set this to 120 and we use this preempt command on this device over here, and this layer 3 switch came back online.

Hello packets

These two devices are actively sending hello packets back and forth to each other. It's what's known as a keepalive. This device, if it's the active one, is letting this device know: I'm still available and I'm still responding to that virtual IP address, to that virtual MAC address. And so this device is not going to become active as long as it's continually receiving those hello packets.

Of course, as we've experienced in other protocols, there's a timer on that. It sends hello packets every three seconds, and if this device doesn't hear back within 10 seconds, that's when it's going to take action and take ownership. That's when that one will become active. Of course, just like any other protocols, we can change this differently.

This means that there is a little bit of a hiccup if it needs to fail over, a more than 10 second hiccup during that time. So if we want it to respond faster, we could set it to maybe one second, and it will then fail over at four seconds instead. So then it takes on this active role, of course, much faster, allowing this network to heal much faster. The downside to doing that is that you may have some false positives: if this doesn't receive it in four seconds in time, then maybe it would fail over unnecessarily. So we want to make sure we strike that right balance. We can go as low as one second and four seconds, so we may want to tune that. For the most part, with a lot of these protocols it's fine just using the default.

HSRP states

Of course, we don't want a device, a router or a layer 3 switch, to come up and suddenly start responding as if it's the active one. It needs a little bit of time to make sure that it is going to participate and that no one else is out there that's the active one yet. So it's got to go through these HSRP states. It's very similar to other protocols that we've seen.

It starts out with the initial phase; that means the interface comes up. It gets into the learn mode, where it hasn't heard a hello packet at this point in time and it hasn't determined the virtual IP address yet. It goes into the listen mode as soon as it knows its virtual IP address, but still has not received a hello packet yet. Then it starts to speak: it starts sending periodic hello packets, hello messages, and it actively participates in the election process. Of course, if there's another device that's already been up and running, then it's going to be a standby. And then we get into the standby mode, where the router is a candidate to become the next active router, or that next active device, but is not necessarily the active one.

There you have it, HSRP. So we talked about the different roles, active and passive; about how it is elected, which one's going to become the active, and it's based off of higher priority and then higher IP address, so if the priority is the same then it uses the IP address. We talked about preempt, and without preempt you're not going to actively be switching back and forth: whatever is active is going to stay active unless it goes down. Otherwise, if we use the preempt, then we can actively switch to the higher priority. We also talked about the hello packets.