FHRP

Agenda

1. What is FHRP? Why do we need to FHRP?
2. Different type of FHRP
3. What is HSRP and how HSRP works?
4. Explanation of HSRP State
5. HSRP Tracking
6. Load Balancing using multiple group
7. VRRP
8. ICMP Redirect
9. GLBP

FHRP

First Hop Redundancy Protocol is designed to allow transparent fail-over at the first-hop IP router. FHRP enable two or more devices to work together in a group, sharing a single Virtual IP address and Virtual MAC address. The virtual IP address is configured in each end user’s as a default gateway address.

There are three first hop redundancy protocols that could be used for this purpose:

1. HSRP
2. VRRP
3. GLBP

HSRP

1. HSRP is a Cisco proprietary protocol. HSRP is used to provide default gateway redundancy for IP network by sharing a virtual IP address and MAC Address between two or more routers participating in a HSRP Group. HSRP Group is identified by group id.

2. In HSRP Group we have below contain:

I. One router is elected as Active router and active router is responsible for traffic forwarding destined to Virtual IP Address.

II. One router is elected as Standby router that will become active when active router fails.

III. All other router participating in HSRP group is called Additional Router or listening router.

Router will exchange HSRP Hello message at regular interval. Hello packets are only exchanged in Speak, Standby and active state.

3. Active and standby router is elected using below process:

1st. Active and standby router is elected based on Priority. Priority can be in between 0 to 255 and default priority is 100 and higher priority is preferred.

2nd. If all router in group have same priority then router with highest IP address on its HSRP interface is elected as Active router.

Note: By default HSRP election is Non-Preemptive. Router that is first powered on will become active even if it has lower priority.

4. HSRP State: – A router interface participating in HSRP must go through below states before taking the role:

I. Initial: This is the starting state and indicates that HSRP is not running.This state is entered via a configuration change or when an Interface first comes up.

II. Learn: The router has not determined the virtual IP address, and not yet Seen an authenticated Hello message from the active router. In this state the router is still waiting to hear from the active router.

III. Listen : The router knows the virtual IP address, but is neither the active router nor the standby router. It listens for Hello messages from those routers.

IV. Speak: The router sends periodic Hello messages and is actively participating in the election of the active and/or standby router.

V. Standby: The router is a candidate to become the next active router and Sends periodic Hello messages.

VI. Active: The router is currently forwarding packets that are sent to the Group’s virtual MAC address. The router sends periodic Hello messages.

Below are the customised capture during HSRP negotiation.

5. HSRP Preempt

As we know by default HSRP election process is Non-Preemptive. Router that is first powered on will become active even if it has lower priority.

Let’s discuss this through below topology.

Preempt is feature that will allow a router to powerfully assume the role of active router if it has high priority.

** When a high priority router peempts a lower priority router, the router sends a Coup message. When lower priority active router receive Coup Message then router change its state to speak state and sendsresign Message.

If router added in HSRP group where active router already exist and new router doesn’t have “Preempt” enabled then new router will not send Coup message even if it has higher priority.

Hello messages are sent to indicate that a router runs HSRP and is able to become the active router.

Coup messages are sent when a router wishes to become the active router.

Resign messages are sent when a router no longer wishes to be the active router.

6.

7. HSRP Load Balancing:

By default, HSRP does not support load-balancing, means that only one router can be active in the HSRP group, so only one path from active router will be used for traffic forwarding and other path (standby path is unused until active goes down) will be unused. In this way there is a waste on bandwidth, as only one router is used to forward traffic. To overcome from this situation cisco used MHSRP where we creates multiple group let’s say two group, one router is active for one group (let’s say group X) and another router in active for another group let’s say Y.Then we will configure half of the host’s default gateways with the HSRP group X virtual IP address, and the other half of the hosts default gateways with the HSRP group Y virtual IP address. In this way we can use both available path for traffic forwarding.

Let’s have look using below Topology:

HSRP Track

Let’s say Eva-wr01 is active router and eva-wr02 is standby.

• Both eva-wr01 and eva-wr02 exchange periodic hello packets to update their status.
• If WAN link goes down on eva-wr01 hello packets can still be exchanged with eva-wr02 via interface eth0/0
• eva-wr02 is unaware that eva-wr01 has a failure and can no longer forward traffic to other networks. Eva-wr02 will remain as the active router and traffic will be black holed.
• To avoid a scenario like this…. we can use HSRP track interface or IP. If a tracked interface fails, the router’s priority is decreased by a specified valve – by default , this is 10.

Eva-wr02 (config-if) # standby 1 track gi1/0 60

9. HSRP uses UDP port 1985. let see packet capture:

VRRP

1. VRRP is an open standard protocol which works same as like Cisco Proprietary HSRP. VRRP is used to provide default gateway redundancy for IP network by sharing a virtual IP address and MAC Address between two or more routers participating in a VRRP Group. VRRP Group is identified by group id.
2. The virtual MAC address by default is 0000.5e00.01xx, where xx means th hexadecimal VRRP group number.
3. By default preemption is enabled in VRRP.
4. A VRRP group has one master router and one or more backup routers.

• One router is elected as Master router and Master router is responsible for traffic forwarding destined to Virtual IP Address.
• One or more routers can be elected as Backup router that will become Master when Master router fails.

** In VRRP we can use physical interface IP as VRRP virtual IP when we are doing it than router who owns real IP Address will be the master and known as the IP address owner. Priority will be 255 when we use the physical IP address as virtual IP if needed to save IP address space.

Master and Backup router is elected based on highest priority and if priority ties

than router with highest IP address on its VRRP interface is elected as Master router. Priority can be configured between 0 to 254.

IF Master router fails, the router configured with the highest priority will become Master router.

5. VRRP state

There are 3 states defined for a VRRP protocol:

1. Initialize state: in this state device detects its state according to advertisement
   packets received from other routers
2. Master state: if router is in master this state means router functions as the forwarding router for the Virtual IP address.

3. Backup state: The purpose of the Backup state is to monitor the availability and state of the Master Router.

ICMP Redirect:ICMP redirect messages are used by router to notify host on the data link that a better route is available for particular destination.

ICMP redirect are automatically disabled when we enable HSRP.

When ICMP redirect messages are sent:

1. Interface on which packet comes into router is the same interface on which the packet gets routed out.

2. Network of the source IP address is on the same Next Hop IP address of the routed packet.