in search of the cert: hsrp

Showing posts with label hsrp. Show all posts

Saturday, February 2, 2013

arp and hsrp...

this might be painfully obvious, but i thought interesting enough to note...

DLS1#clear arp-cach
DLS1#sh arp
Protocol Address          Age (min) Hardware Addr   Type   Interface
Internet 10.1.10.1               0   e89a.8f98.a703 ARPA   Vlan10
Internet 10.1.2.1                -   0016.c706.96c2 ARPA   FastEthernet0/5
Internet 10.1.2.2                0   0019.06e7.acc0 ARPA   FastEthernet0/5
Internet 10.1.100.1              0   000f.8ffe.0980 ARPA   Vlan100
Internet 10.1.100.254            -   0000.0c07.ac64 ARPA   Vlan100
Internet 10.1.100.253            0   0016.479e.5fc1 ARPA   Vlan100
Internet 10.1.100.252            -   0016.c706.96c1 ARPA   Vlan100
Internet 10.1.50.252             -   0016.c706.96c6 ARPA   Vlan50
Internet 10.1.20.252             -   0016.c706.96c4 ARPA   Vlan20
Internet 10.1.30.252             -   0016.c706.96c5 ARPA   Vlan30
Internet 10.1.30.254             -   0000.0c07.ac1e ARPA   Vlan30
Internet 10.1.10.252             -   0016.c706.96c3 ARPA   Vlan10
Internet 10.1.10.254             -   0000.0c07.ac0a ARPA   Vlan10

of course we know in the arp output that the "-" means local... we also know that
0c07.ac represents the virtual mac for hsrp...

the output is also telling us that dls1 is active for those three addresses, proven below...

DLS1#sh stand brie
                     P indicates configured to preempt.
                     |
Interface   Grp Pri P State   Active          Standby         Virtual IP
Vl10        10   110 P Active local           10.1.10.253     10.1.10.254
Vl20        20   100 P Standby 10.1.20.253     local           10.1.20.254
Vl30        30   110 P Active local           10.1.30.253     10.1.30.254
Vl50        50   100 P Standby 10.1.50.253     local           10.1.50.254
Vl100       100 110 P Active local           10.1.100.253    10.1.100.254

obvious is good too...

Tuesday, January 8, 2013

quote of the day, doccd...

yuck...

your doccd at work for you... it's all right there...

http://www.cisco.com/en/US/docs/ios-xml/ios/ipapp_fhrp/configuration/12-4t/fhp-hsrp.html#GUID-12096984-19A9-4F90-8CB6-D8E2C66E7349

HSRP MD5 Authentication

Before the introduction of HSRP MD5 authentication, HSRP authenticated protocol packets with a simple plain text string. HSRP MD5 authentication is an enhancement to generate an MD5 digest for the HSRP portion of the multicast HSRP protocol packet. This functionality provides added security and protects against the threat from HSRP-spoofing software.
MD5 authentication provides greater security than the alternative plain text authentication scheme. MD5 authentication allows each HSRP group member to use a secret key to generate a keyed MD5 hash that is part of the outgoing packet. A keyed hash of an incoming packet is generated and if the hash within the incoming packet does not match the generated hash, the packet is ignored.
The key for the MD5 hash can be either given directly in the configuration using a key string or supplied indirectly through a key chain.
HSRP has two authentication schemes:

Plain text authentication
MD5 authentication

HSRP authentication protects against false HSRP hello packets causing a denial-of-service attack. For example, Router A has a priority of 120 and is the active router. If a host sends spoof HSRP hello packets with a priority of 130, then Router A stops being the active router. If Router A has authentication configured such that the spoof HSRP hello packets are ignored, Router A will remain the active router.
HSRP packets will be rejected in any of the following cases:

The authentication schemes differ on the router and in the incoming packets.
MD5 digests differ on the router and in the incoming packet.
Text authentication strings differ on the router and in the incoming packet.

1. enable

2. configure terminal

3. terminal interface type number

4. ip address ip-address mask [secondary]

5. standby [group-number] priority priority

6. standby [group-number] preempt [delay {minimum | reload | sync} seconds]

7. standby [group-number] authentication md5 key-string [0 | 7] key [timeout seconds]

8. standby [group-number] ip [ip-address] [secondary]]

9. Repeat Steps 1 through 8 on each router that will communicate.

10. end

11. show standby

Sunday, June 17, 2012

hsrp states...

hsrp goes through various states to obtain the active role... according to david hucaby in the ccnp switch ocg we have:

When HSRP is configured on an interface, the router progresses through a series of states before becoming active. This forces a router to listen for others in a group and see where it fits into the pecking order. Devices participating in HSRP must progress their interfaces through the following state sequence:

1. Disabled
2. Init
3. Listen
4. Speak
5. Standby
6. Active

whoa... according to rfc 2281 we have...

 All routers begin in the Initial state.  This section discusses the
   intent of each state.  For specific details on the actions taken in
   each state, please see the state transition table in section 5.7.

   1. Initial

      This is the starting state and indicates that HSRP is not running.
      This state is entered via a configuration change or when an
      interface first comes up.

   2. Learn

      The router has not determined the virtual IP address, and not yet
      seen an authenticated Hello message from the active router.  In
      this state the router is still waiting to hear from the active
      router.

   3. Listen

      The router knows the virtual IP address, but is neither the active
      router nor the standby router.  It listens for Hello messages from
      those routers.


Li, et. al.                  Informational                      [Page 8]
 
RFC 2281                       Cisco HSRP                     March 1998


   4. Speak

      The router sends periodic Hello messages and is actively
      participating in the election of the active and/or standby router.
      A router cannot enter Speak state unless it has the virtual IP
      address.

   5. Standby

      The router is a candidate to become the next active router and
      sends periodic Hello messages.  Excluding transient conditions,
      there MUST be at most one router in the group in Standby state.

   6. Active

      The router is currently forwarding packets that are sent to the
      group's virtual MAC address.  The router sends periodic Hello
      messages.  Excluding transient conditions, there MUST be at most
      one router in Active state in the group.

 i hate when that shit happens...

then from cisco.com we have...

http://www.cisco.com/en/US/docs/ios/12_1t/12_1t3/feature/guide/dt_hsrpi.html

State

State of local router; can be one of the following:

•

Active—Current Hot Standby router

•

Standby—Router next in line to be the Hot Standby router

•

Speak—Router is sending packets to claim the active or standby role.

•

Init—Router is not yet ready to participate in HSRP, possibly because the associated interface is not up. HSRP groups configured in other routers on the network that are learned via snooping are displayed as being in the Init state. In these cases, an IP address is displayed in the "Active addr" field. Locally configured groups with an interface that is down or groups without a specified interface IP address appear in the Init state. For these cases, the Active addr and Standby addr will show "unknown."

•

Listen—Router is in neither active nor standby state, but if no messages are received from the active or standby router, it will start to speak.

•

Learn—Router is in neither active nor standby state, nor does it have enough information to attempt to claim the active or standby roles.

here there is learn, but no mention of disabled... in all 3 cases there are six states...

and finally...

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gthsrpv2.html

State is

State of local router; can be one of the following:

•

Active—Indicates the current Hot Standby router.

•

Standby—Indicates the router next in line to be the Hot Standby router.

•

Speak—Router is sending packets to claim the active or standby role.

•

Listen—Router is neither in the active nor standby state, but if no messages are received from the active or standby router, it will start to speak.

•

Learn—Router is neither in the active nor standby state, nor does it have enough information to attempt to claim the active or standby roles.

•

Init or Disabled—Router is not yet ready or able to participate in HSRP, possibly because the associated interface is not up. HSRP groups configured on other routers on the network that are learned via snooping are displayed as being in the Init state. Locally configured groups with an interface that is down or groups without a specified interface IP address appear in the Init state. For these cases, the Active addr and Standby addr fields will show "unknown." The state is listed as disabled in the fields when the standby ip command has not been specified.

initial and disabled got married in the fourth one...

would someone please try to get these people together...

Monday, May 28, 2012

hsrp quick scrape...

dls1

int vlan 1

standby 1 ip 172.16.1.5

standby 1 prio 110

standby 1 pre

int vlan 100

standby 100 ip 172.16.100.5

standby 100 pri 110

standby 100 pre

int vlan 200

standby 200 ip 172.16.200.5

standby 200 pri 110

standby 200 pre

int vlan 300

standby 255 ip 172.16.255.5

standby 255 pri 110

standby 255 pre

dls2

int vlan 1

standby 1 ip 172.16.1.5

stand 1 pri 90

stand 1 pre

int vlan 100

stan 100 ip 172.16.100.5

stan 100 pri 90

stan 100 pre

int vl 200

stan 200 ip 172.16.200.5

stan 200 pri 90

stan 200 pre

int vl 300

stan 255 ip 172.16.255.5

stan 255 pri 90

stan 255 pre

Sunday, April 22, 2012

speak, hsrp, speak... good hsrp...

you can get that actual cap at cln, profile arteq... the best i can do until i get my own website, someday...

hsrp lab...

note for vlan 30 and 40... the command is standby 1 priority 100, which is the default and doesn't show in the output... also note the logical groupings of vlans to ip's throughout... a real time saver and a way to keep shit straight...

on dls1...

interface Vlan1
ip address 172.16.1.3 255.255.255.0
standby 1 ip 172.16.1.1
standby 1 priority 150
standby 1 preempt
!
interface Vlan10
ip address 172.16.10.3 255.255.255.0
standby 1 ip 172.16.10.1
standby 1 priority 150
standby 1 preempt
!
interface Vlan20
ip address 172.16.20.3 255.255.255.0
standby priority 150
standby 1 ip 172.16.20.1
standby 1 priority 150
standby 1 preempt
!
interface Vlan30
ip address 172.16.30.3 255.255.255.0
standby 1 ip 172.16.30.1
standby 1 preempt
!
interface Vlan40
ip address 172.16.40.3 255.255.255.0
standby 1 ip 172.16.40.1
standby 1 preempt

on dls2...

interface Vlan1
ip address 172.16.1.4 255.255.255.0
standby 1 ip 172.16.1.1
standby 1 preempt
!
interface Vlan10
ip address 172.16.10.4 255.255.255.0
standby 1 ip 172.16.10.1
standby 1 preempt
!
interface Vlan20
ip address 172.16.20.4 255.255.255.0
standby 1 ip 172.16.20.1
standby 1 preempt
!
interface Vlan30
ip address 172.16.30.4 255.255.255.0
standby preempt
standby 1 ip 172.16.30.1
standby 1 priority 150
standby 1 preempt
!
interface Vlan40
ip address 172.16.40.4 255.255.255.0
standby 1 ip 172.16.40.1
standby 1 priority 150
standby 1 preempt

this command is your lifesaver...

dls1#sh standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp Prio P State    Active          Standby         Virtual IP
Vl1         1   150 P Active   local           172.16.1.4      172.16.1.1
Vl10        1   150 P Active   local           172.16.10.4     172.16.10.1
Vl20        1   150 P Active   local           172.16.20.4     172.16.20.1
Vl30        1   100 P Standby 172.16.30.4     local           172.16.30.1
Vl40        1   100 P Standby 172.16.40.4     local           172.16.40.1
dls1#

dls2#sh standby brie
                     P indicates configured to preempt.
                     |
Interface   Grp Prio P State    Active          Standby         Virtual IP
Vl1         1   100 P Standby 172.16.1.3      local           172.16.1.1
Vl10        1   100 P Standby 172.16.10.3     local           172.16.10.1
Vl20        1   100 P Standby 172.16.20.3     local           172.16.20.1
Vl30        1   150 P Active   local           172.16.30.3     172.16.30.1
Vl40        1   150 P Active   local           172.16.40.3     172.16.40.1
dls2#

and this one will get you every time...

dls2#sh ip route
Default gateway is not set

Host               Gateway           Last Use    Total Uses Interface
ICMP redirect cache is empty
dls2#config t
Enter configuration commands, one per line. End with CNTL/Z.
dls2(config)#ip routing
dls2(config)#end
dls2#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     172.16.0.0/24 is subnetted, 5 subnets
C       172.16.40.0 is directly connected, Vlan40
C       172.16.30.0 is directly connected, Vlan30
C       172.16.20.0 is directly connected, Vlan20
C       172.16.10.0 is directly connected, Vlan10
C       172.16.1.0 is directly connected, Vlan1
dls2#

shut all the links on dls1...

Saturday, March 10, 2012

hsrp states...

disabled- what it says... bear in mind cisco may consider this an actual state... to me it's the absence of a state

init- what it says... an hsrp enabled interface goes through initialization as it comes up

learn - the hsrp enabled router knows nothing, but is willing...

listen- knows the virtual ip address but is neither active nor standby; it is listening for hellos

speak- sends hello messages and participates in the election of the active router

standby- has graduated to become an active router if conditions are met like priority, preempt and failure, and sends hellos

active- it is now forwarding packets; it has made it to the big's...

standby pri...

the standby priority (a higher number) will take over as active in conjunction with the preempt command in real time... i lowered the standby priority on dsw1 to 1, raised it on dsw2 to ten and set preempt... it takes over right away, as below...

dsw2(config)#int vlan 10
dsw2(config-if)#standby 1 pri 10
dsw2(config-if)#
*Mar 7 22:31:02.042: %HSRP-5-STATECHANGE: Vlan10 Grp 1 state Standby -> Active

real time results are like burger king where you can have it your way...

like a dog, you can make hsrp speak...

dsw2(config-if)#standby 1 priority 0
dsw2(config-if)#
*Mar 7 22:36:50.046: %HSRP-5-STATECHANGE: Vlan10 Grp 1 state Active -> Speak
dsw2(config-if)#standby 1 priority
*Mar 7 22:37:00.046: %HSRP-5-STATECHANGE: Vlan10 Grp 1 state Speak -> Standby
dsw2(config-if)#standby 1 priority 200
dsw2(config-if)#
*Mar 7 22:37:14.046: %HSRP-5-STATECHANGE: Vlan10 Grp 1 state Standby -> Active
dsw2(config-if)#

if vlans were the birth of virtual routing, and svi's were the toddlers, hsrp graduated to middle school...

standby me...

hsrp keep it simple...

make a standby group and call it 1... set it on the redundant vlans between the dsw's... make sure the standby ip and group are the same, as below...

dsw1#sh run int vlan 10
Building configuration...

Current configuration : 84 bytes
!
interface Vlan10
ip address 10.2.1.1 255.255.255.0
standby 1 ip 10.2.1.100
end

dsw2#sh run int vlan 10
Building configuration...

Current configuration : 84 bytes
!
interface Vlan10
ip address 10.2.1.2 255.255.255.0
standby 1 ip 10.2.1.100
end

dsw2#sh standby
Vlan10 - Group 1
State is Standby
1 state change, last state change 00:08:20
Virtual IP address is 10.2.1.100
Active virtual MAC address is 0000.0c07.ac01
Local virtual MAC address is 0000.0c07.ac01 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 0.052 secs
Preemption disabled
Active router is 10.2.1.1, priority 100 (expires in 9.948 sec) "vlan 10 on dsw1"
Standby router is local
Priority 100 (default 100)
IP redundancy name is "hsrp-Vl10-1" (default)

i then took down the the vlan 10 interface on dsw1 so dsw2 took over...

dsw2#sh standby
Vlan10 - Group 1
State is Active
2 state changes, last state change 00:01:40
Virtual IP address is 10.2.1.100
Active virtual MAC address is 0000.0c07.ac01
Local virtual MAC address is 0000.0c07.ac01 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 1.664 secs
Preemption disabled
Active router is local
Standby router is unknown
Priority 100 (default 100)
IP redundancy name is "hsrp-Vl10-1" (default)

there is not another standby in the group so it is unknown... the client with the default gateway 10.2.1.1

will no longer be able to ping through to r3
lo0 3.3.3.3... its default gateway
has to be changed to the virtual
router address 10.2.1.100...

that is an important point about the default gateway...
this is how hsrp works...

Saturday, February 25, 2012

hsrp...

with hsrp, routers can give the illusion of a single virtual router to hosts on a lan. this is called a standby group. one router is elected from the group to forward packets that are sent by the hosts; this is the active router. if the active router fails, a standby router will then forward packets in its stead. although there may be more than two routers participating in the group (the virtual router), only the active router at any given time will actually forward packets.

once a router has been elected active, only the active and standby routers send periodic hello packets. of course, if the standby router then fails, another election commences.

routers may belong to more than one standby group, and hellos are kept separate between the groups.

each group has a single well known mac-address and ip address.

hsrp uses the well known mac-address

0000.0c07.acXX

where XX is the group number (ac01 ie. is group 1)

in search of the cert

ccie or die

Pages

network cisco ccna gns3 certification arteq

Search insearchofthecert

Saturday, February 2, 2013

arp and hsrp...

Tuesday, January 8, 2013

quote of the day, doccd...

HSRP MD5 Authentication

Sunday, June 17, 2012

hsrp states...

Monday, May 28, 2012

hsrp quick scrape...

Sunday, April 22, 2012

speak, hsrp, speak... good hsrp...

hsrp lab...

Saturday, March 10, 2012

hsrp states...

standby pri...

standby me...

Saturday, February 25, 2012

hsrp...

Popular Gropes

eye balls