Notes: Understanding HSRP

Background Information

• HSRP, which is unique to Cisco platforms, provides network redundancy for IP networks.
• Ensures that user traffic immediately and transparently recovers from first-hop failures.
• Two or more routers act as a single virtual router by sharing an IP address and a MAC address.
• End hosts do not typically contain a routing table and use only a single next-hop IP address (the
  default gateway).
• The default gateway is configured as the virtual IP address.
• HSRP routers continually exchange status messages.
• One router can assume the responsibility of another, if a router fails for either planned or unplanned reasons.
• The changeover is transparent to end hosts.
• Windows hosts can be configured to run multiple default gateways, but they are not dynamic (only a single default gateway is used at a time).
• The system only selects an additional configured default gateway at boot time if the first configured default gateway is determined unreachable by Internet Control Management Protocol (ICMP).

Basic Operation

• Two or more HSRP routers work in concert to present the illusion of a single default gateway.
• This set of routers is known as an HSRP group or standby group.
• One router (the active router) is selected from the group to forward packets sent to the virtual IP address.
• Another router is selected as the standby router.
• If the active router fails, the standby router assumes its role.
• Only the active and standby routers send periodic HSRP messages after the election process is completed.
• Additional routers in the HSRP group remain in the Listen state.
• If the standby router fails or becomes the active router, another router is elected as the new standby router. 
• Each standby group emulates a single virtual router (default gateway).
• A single well-known MAC and IP address is allocated to each group.
• Multiple groups can coexist and overlap on a LAN.
• Individual routers can participate in multiple groups.
• The router maintains a separate state and timers for each group.

HSRP Terms

• Active router: The router that currently forwards packets for the virtual router. 
• Standby router: The primary backup router. 
• Standby group: The set of routers that participate in HSRP and jointly emulate a virtual router. 
• Hello time: The interval between successive HSRP hello messages from a given router. 
• Hold time: The interval between the receipt of a hello message and the presumption that the sending router has failed.

HSRP Router Communication

• HSRP routers communicate by exchanging HSRP information through HSRP hello packets.
  HSRP uses the destination multicast IP address 224.0.0.2 on UDP port 1985.
• The active router sources hello packets from its configured IP address and the HSRP virtual MAC address.
• The standby router sources hello messages from its configured IP address and the burned-in MAC address (BIA).
• The virtual MAC address is 0000.0c07.acxx, where xx is the HSRP group number.
• When an HSRP group number is not specified, the default group number is 0.

HSRP Features

Preemption
The feature enables the router with the highest priority to immediately become the active router.
Preference is determnined first by the highest priority value configured (default 100), and then by the highest IP address.

When a higher priority router preempts a lower priority router, it sends a coup message. When a lower priority active router receives a coup message or hello message from a higher priority active router, it changes to the speak state and sends a resign message.

Preempt Delay
The feature allows preemption to be delayed for a configurable time period, allowing the router to populate its routing table before becoming the active router.

Interface Tracking
HSRP monitors the status of another interface in order to alter the HSRP priority for a given group. If the specified interface's status goes down, the HSRP priority of a router is reduced, allowing another HSRP router higher priority to become active (if preemption is enabled).

When multiple tracked interfaces are down, the priority is reduced by a cumulative amount. If the decrement value is not specifically set, the priority value is decreased by 10 for each interface that goes down.

Use of BIA
The feature allows HSRP groups to use an interface's burned-in MAC address instead of a virtual MAC address (some hardware only recognize a single MAC address).

Several disadvantages:

• When a router becomes active, the virtual IP address is moved to a different MAC address. The newly active router sends a gratuitous ARP response, but not all host implementations handle the gratuitous ARP correctly.
• Proxy ARP breaks when use-bia is configured. A standby router cannot cover for the lost proxy ARP database of a failed router. 
• Problems related to specific IOS versions: prior to Cisco IOS release 12.0(3.4)T, only one HSRP group is allowed if use-bia is configured, or prior to Cisco IOS release 12.0(6.2), the use-bia command on a subinterface actually showed up on the main interface and applied it to all subinterfaces.

Multiple HSRP Groups
The features enables load-sharing within networks, and allows redundant routers to be more fully utilized. A router can have different roles for different HSRP groups. While a router is forwarding traffic for one HSRP group, it can be in standby or in Listen state for another group.

Syslog Support
The feature allows for more efficient logging and tracking of the current HSRP status. Syslog support was added in Cisco IOS release 11.3.

HSRP Debugging
To enable HSRP debugging, use the debug standby command. The command prints output of HSRP state and packet information fro all standby groups on all interfaces.

A debug condition allows the output to be filtered upon interface and group number (debug condition standby int-num group-num). Debug conditions can be set for groups that do not exist, which allows the information capture during the initialization of a new group.

The standby debug command must be enabled to produce any output.

Enhanced HSRP Debugging
Before Cisco IOS release 12.1(0.2), HSRP debugging was of limited use because information was lost in the noise from periodic hello messages. Thus the enhanced debugging feature was added in Cisco IOS 12.1(0.2).

The following table explains the command options for enhanced debugging.

Authentication
The feature provides added security, and protects against the threat of spoofing attacks. Clear-text (default) and MD5 authentication are available.

SNMP MIB
There are two relevant MIBs for HSRP:

• ciscoMgmt 106: The MIB module for managing HSRP
• ciscoMgmt 107: The extension MIB module for managing HSRP

HSRP Support for MPLS VPNs
The feature is useful when a CE router is connected to two PE routers, and the default route points to the HSRP virtual IP address.

HSRP States

• Initial: The start. Indicates that HSRP does not run. Entered through a configuration change or when an interface first becomes available.
• Learn: The router has not determined the virtual IP address, and has not yet seen an authenticated hello message from the active router. The router still waits to hear from the active router.
• Listen: The router knows the virtual IP address, but is neither the active router nor the standby router. The router listen for hello messages from the active and standby routers.
• Speak: The router sends periodic hello messages and actively participates in the election of the active and/or standby router. A router cannot enter Speak state unless it has the virtual IP address.
• Standby: The router is a candidate to become the next active router and sends periodic hello messages. There is only one router in the group in the standby state.
• Active: The router currently forwards packets that are sent to the group virtual IP address. The router sends periodic hello messages. There is only one router in the group in the active state.

HSRP Timers

• HSRP routers use only three timers, which time the hello messages.
• Convergence depends on how the HSRP hello and hold timers are configured.
• By default, the timers are set to 3 and 10 seconds, respectively.
• A hello packet is sent between the HSRP group every 3 seconds, and the standby router becomes active when a hello packet has not been received for 10 seconds.
• The timer values are configurable, but setting the hello timer below 1 second and the hold timer
  below 4 seconds is not recommended. 
• If the HSRP tracking mechanism is used and the tracked link fails, the failover or preemption occurs immediately, regardless of the hello and hold timers.
• Active timer: Used to monitor the active router. Started any time a hello packet is received from the active router. Expired in accordance with the hold time value.
• Standby timer: Used to monitor the standby router. Started any time a hello message is received from the standby router. Expired in accordance with the hold time value.
• Hello timer: Used to clock hello packets. Routers in Active, Standby, or Speak states generate hello messages.

Packet Format

Op Code
The Op code describes the type of message that the packet contains.
Possible values:

• 0 - Hello (sent to indicate that the router runs HSRP and is able to become the active router)
• 1 - Coup (sent when the router wishes to become the active router)
• 2 - Resign (sent when a router no longer wishes to be the active router)

State
Each router in the HSRP group implements a state machine. The state field describes the current state of the router.
Individual states:

• 0 - Initial
• 1 - Learn
• 2 - Listen
• 4 - Speak
• 8 - Standby
• 16 - Active

Hellotime
Only meaningful in hello messages. Contains the period (in seconds) between the hello messages that the router sends.

Holdtime
Only meaningful in hello messages. Contains the amount of time (in seconds) that the current hello message should be considered valid before initiating a state change.

Priority
Used to elect the active and standby routers. Highest priority wins. In case of a tie, the highest IP address is preferred.

Group
Identifies the HSRP group.

Authentication Data
Contains a clear-text, eight-character password.

Virtual IP Address
Specifies the virtual IP address used by this HSRP group.

HSRP Events

• 1 - HSRP is configured on an enabled interface.
• 2 - HSRP is disabled on an interface or the interface is disabled.
• 3 - Active timer expiry. The Active timer is set to the hold time when the last hello message is seen from the active router.
• 4 - Standby timer expiry. The Standby timer is set to the hold time when the last hello message is seen from the standby router.
• 5 - Hello timer expiry. The periodic timer for sending Hello messages is expired.
• 6 - Receipt of a Hello message of higher priority from a router in Speak state.
• 7 - Receipt of a Hello message of higher priority from the active router.
• 8 - Receipt of a Hello message of lower priority from the active router.
• 9 - Receipt of a Resign message from the active router.
• 10 - Receipt of a Coup message from a higher priority router
• 11 - Receipt of a Hello message of higher priority from the standby router.
• 12 - Receipt of a Hello message of lower priority from the standby router.

HSRP Actions

A - Start Active Timer
The Active timer is set to the Holdtime field in the Hello message from the Active router. Otherwise set to the current Holdtime value in use by the router. The Active Timer is then started.

B - Start Standby Timer
The Standby timer is set to the Holdtime field in the Hello message from the Standby router. Otherwise set to the current Holdtime value in use by the router. The Standby timer is then started.

C - Stop Active Timer
The Active timer is stopped.

D - Stop Standby Timer
The Standby timer is stopped.

E - Learn Parameters
This action is taken when a message is received from the active router. If the virtual IP address for this group was not manually configured, it can be learned from the message. The router can also learn Hellotime and Holdtime values from the message.

F - Send Hello Message
The router sends a Hello message with its current State, Hellotime, and Holdtime.

G - Send Coup Message
The router sends a Coup message to inform the active router that there is a higher priority router available.

H - Send Resign Message
The router sends a Resign message to allow another router to become the active router.

I - Send Gratuitous ARP Message
The router broadcasts an ARP response packet advertising the group's virtual IP and MAC addresses.

HSRP State Table

Each time that an event occurs, the associated action results, and the router transitions to the next HSRP state. In the diagram, numbers designate events, and letters designate the associated action.

References

Understanding and Troubleshooting HSRP Problems in Catalyst Switch Networks
Hot Standby Router Protocol Features and Functionality
RFC 2281: Cisco Hot Standby Router Protocol (HSRP)