Hot Standby Routing Protocol (HSRP)

Let say you have a gateway which allows you to access internet. This gateway goes down
All you need is … redundancy ! Hot Standby Routing Protocol is here to help you.
This article will show you a configuration example to make it work.

Lets explain the basic configuration of the routers.

R1

R1(config)#int fa0/0
R1(config-if)#ip add 192.168.0.2 255.255.255.0
R1(config-if)#no sh
R1(config-if)#int s0/0/0
R1(config-if)#ip add 1.1.1.1 255.255.255.252
R1(config-if)#no sh
R1(config)#exit
R1(config)#ip route 0.0.0.0 0.0.0.0 serial 0/0/0

R2

R2(config)#int fa0/0
R2(config-if)#ip add 192.168.0.3 255.255.255.0
R2(config-if)#no sh
R2(config-if)#int s0/0/0
R2(config-if)#ip add 2.2.2.1 255.255.255.252
R2(config-if)#no sh
R2(config)#exit
R2(config)#ip route 0.0.0.0 0.0.0.0 serial 0/0/0

Nothing difficult to understand. You can see that there will be a static route for the internet traffic on both R1 and R2.

Now let’s configure R3 and R4. In my lab both R3 and R4 on their f0/1 interfaces will get IP addresses from the DHCP server on my LAN (which will also provide internet connection).
NAT with overload (PAT) will also be configured on both R3 and R4 for the internet connectivity on PC1

R3

R3(config)#int f0/1
R3(config-if)#ip add dhcp
R3(config-if)#ip nat outside
R3(config-if)#no sh
R3(config-if)#int s0/0/1
R3(config-if)#ip add 1.1.1.2 255.255.255.252
R3(config-if)#ip nat inside
R3(config-if)#no sh
R3(config-if)#exit
R3(config)#ip route 192.168.0.0 255.255.255.0 serial 0/0/1
R3(config)#access-list 1 permit any
R3(config)#ip nat inside source list 1 interface fastEthernet 0/1 overload

R4

R4(config)#int f0/1
R4(config-if)#ip add dhcp
R4(config-if)#ip nat outside
R4(config-if)#no sh
R4(config-if)#int s0/0/1
R4(config-if)#ip add 2.2.2.2 255.255.255.252
R4(config-if)#ip nat inside
R4(config-if)#no sh
R4(config-if)#exit
R4(config)#ip route 192.168.0.0 255.255.255.0 serial 0/0/1
R4(config)#access-list 1 permit any
R4(config)#ip nat inside source list 1 interface fastEthernet 0/1 overload

Don’t forget the route for the LAN network (192.168.0.0)
Now all is set.

If we want to configure PC1, we can set for example:
IP ADDRESS> 192.168.0.60
NETMASK> 255.255.255.0
GATEWAY> 192.168.0.2 or 192.168.0.3
DNS SERVER> 10.19.40.1 //this is my LAN DNS server.

Sweet it’s working, now we can configure our redundancy. The principle here is simple, we will assign a virtual IP address on both R1 and R2. And this virutal IP address will be the gateway for PC1
R1

R1(config)#int f0/0
R1(config-if)#standby 1 ip 192.168.0.1
R1(config-if)#standby 1 preempt
R1(config-if)#standby 1 priority 105
R1(config-if)#standby 1 track serial 0/0/0

R2

R2(config)#int f0/0
R2(config-if)#standby 1 ip 192.168.0.1
R2(config-if)#standby 1 preempt
R2(config-if)#standby 1 priority 100
R2(config-if)#standby 1 track serial 0/0/0

Explanations:
standby 1 ip 192.168.0.1
The number 1 is the hsrp group. The IP address 192.168.0.1 will be the virtual one, this will be PC1′s gateway.

standby 1 preempt
This is needed for the router to become the Active Router instead of the Standby Router. When it sees that the Active router is down or when its priority has becomed higher thant the Active router’s one.

standby 1 priority 100
that’s the priority, if we have 2 routers, the one with the biggest priority will become the Active Router, the other one will be the Standby Router.
By default the priority is set to 100 (From 1 to 255). If the 2 routers have the same priority, the one with the biggest IP address will become the Active Router.

standby 1 track serial 0/0/0
Let say R1 is the Active router, everything is fine except the serial link between R1 and R3, so the internet connection is down, but R1 will still remain the Active router.
That’s why this command is so important, it will check the serial link, and if it goes down, it will decrement from 10 the priority. Then R2 will have a higher priority (100 > 95) and R2 will become the Active Router, thanks to the preempt command that allows to automatically let R2 become the Active router when it sees its priority bigger thant R1′s priority.

Verifications
Now let’s go on tests.
PC1 is configured this way:
IP ADDRESS> 192.168.0.60
NETMASK> 255.255.255.0
GATEWAY> 192.168.0.1
DNS SERVER> 10.19.40.1 //this is my LAN DNS server.

You can see when i use the tracert command on my DNS server, I am using the link between R1 and R3.

I just can’t explain why the name in front of [192.168.0.2] is thinklabs.esi-supinfo.com … It seems to be a host in the LAN (the LAN that provides internet connectivity to f0/1 on both R3 and R4)

Now I will ping google and then unplug a wire on R1

As you can see we have 2 timeout then the connection is up again

Another tracert now

Still the same bug (?) with the name of the router.
But We can see that now we are using the link between R2 and R4 !

Now let’s go on PC1 and see the ARP cache.

The MAC address of a virtual IP Address with hsrp will always be:
00-00-0c-07-ac-**
** will be the HSRP group number.

For security reasons, you will may want to set a secure password between your routers for the protocol HSRP to work.
You will just need to set this command on the interface configuration mode.

Router(config-if)#standby 1 authentication md5 key-string toto

You also can set the password in clear text mode…