HSRP and Static NAT behavior

Question

May I have your opinion on the following matter?

Configuration:

Two 2911 routers. Doing HSRP on Wan and LAN side with 2 standby groups. Doing static NAT to internal servers. Added redundacy keyword on the nat statements . Tracking wan side interface in LAN side hsrp group and tracking LAN side interface in WAN side hsrp group.

All is working well but I discovered the following convergence time Issues when HSRP failover.

1. HSRP active device has a TCP translation in the table.

2. HSRP active does a failover (shut the interface).

3. The failover goes well but the ip nat session table on the new active is updated with the TCP sessions after about 30s after the failover took place. Seen from debugs.

The new active device received the NAT session table update message from the old active after 30 sec or more.

My client wants the TCP session replication to take place in less than 15s when a HSRP failover.

Is there a way to make it work in less than 15s? Also , what are the recommended ip nat translation timeout timers when doing HSRP and static NAT?

I post the config and debug messages:

Debug messages:

---Connecting to server on 80

SPR2#telnet  10.31.71.20 80
Trying 10.31.71.20, 80 ... Open

--- NATGW1 is the hsrp active, simulate failover, shutdown the interface

NATGW1(config-if)#shut

--- NATGW2 is the new active

It moves from Standby to Active at 05:02:18.323 but receives the NAT session at Nov 5 05:02:48.604: .After 30 seconds.

NATGW2#debug ip nat detailed
IP NAT detailed debugging is on
NATGW2#

It moves from Standby to Active at 05:02:18.323 *Nov 5 05:02:18.323: %HSRP-5-STATECHANGE: Ethernet0/1 Grp 200 state Standby -> Active

NATGW2#
*Nov  5 05:02:18.324: NAT: redundancy_update: Standby->Active grp:OSE, Address:10.31.71.19
*Nov  5 05:02:18.324: NAT: Find alias : 10.31.71.19 Ethernet0/2
*Nov  5 05:02:18.324: NAT: Found alias
*Nov  5 05:02:18.325: NAT: Setup alias as Active
*Nov  5 05:02:18.325: NAT: redundancy_update: Standby->Active grp:OSE, Address:10.31.71.20
*Nov  5 05:02:18.329: NAT: Find alias : 10.31.71.20 Ethernet0/2
*Nov  5 05:02:18.329: NAT: Found alias
*Nov  5 05:02:18.330: NAT: Setup alias as Active
NATGW2#
*Nov  5 05:02:19.377: %HSRP-5-STATECHANGE: Ethernet0/2 Grp 100 state Standby -> Active
NATGW2#
*Nov  5 05:02:21.399: NAT: redundancy_update: Active->Active grp:OSE, Address:10.31.71.19
*Nov  5 05:02:21.399: NAT: Find alias : 10.31.71.19 Ethernet0/2
*Nov  5 05:02:21.399: NAT: Found alias
*Nov  5 05:02:21.399: NAT: Setup alias as Active
*Nov  5 05:02:21.400: NAT: redundancy_update: Active->Active grp:OSE, Address:10.31.71.20
*Nov  5 05:02:21.400: NAT: Find alias : 10.31.71.20 Ethernet0/2
*Nov  5 05:02:21.400: NAT: Found alias
*Nov  5 05:02:21.400: NAT: Setup alias as Active
NATGW2#

receives the NAT session at Nov 5 05:02:48.604:

*Nov  5 05:02:48.604: NAT: API parameters passed: src_addr:192.168.153.90, src_port:0 dest_addr:10.31.71.252, dest_port:0, proto:6 if_input:Ethernet0/1 pak:B046DD78 get_translated:1

Config:

NATGW1#show run | sec nat
 ip nat inside
 ip nat outside
ip nat inside source static 192.168.153.99 10.31.71.19 redundancy OSE
ip nat inside source static 192.168.153.90 10.31.71.20 redundancy OSE


NATGW2#show run | sec nat
 ip nat inside
 ip nat outside
ip nat inside source static 192.168.153.99 10.31.71.19 redundancy OSE
ip nat inside source static 192.168.153.90 10.31.71.20 redundancy OSE


NATGW1#show standby
Ethernet0/1 - Group 200
  State is Active
    8 state changes, last state change 00:02:27
  Virtual IP address is 192.168.153.253
  Active virtual MAC address is 0000.0c07.acc8
    Local virtual MAC address is 0000.0c07.acc8 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 2.944 secs
  Preemption enabled
  Active router is local
  Standby router is 192.168.153.252, priority 105 (expires in 9.792 sec)
  Priority 110 (configured 110)
    Track interface Ethernet0/2 state Up decrement 10
  Group name is "OSE" (cfgd)
Ethernet0/2 - Group 100
  State is Active
    11 state changes, last state change 00:02:28
  Virtual IP address is 10.31.71.103
  Active virtual MAC address is 0000.0c07.ac64
    Local virtual MAC address is 0000.0c07.ac64 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.352 secs
  Preemption enabled
  Active router is local
  Standby router is 10.31.71.102, priority 105 (expires in 9.584 sec)
  Priority 110 (configured 110)
    Track interface Ethernet0/1 state Up decrement 10
  Group name is "hsrp-Et0/2-100" (default)

Thanks for helping.

Answer 1

I have found the issue.

The problem was my testing procedure. I simulated the http connection using telnet to http port but I did not generate any traffic(requests). I repeated the tests using GET requests and the nat session table was replicated almost instant.

I post the debug messages.

The NAT replication trigger is the next segment, request in the tcp session.

Debug messages

Telnet from client

telnet 10.31.73.12 3099 
*Nov  7 03:52:17.071: TCBB2701B60 connected to 10.31.73.12.3099
GET / HTTP/1.0
GET / HTTP/1.0
GET / HTTP/1.0

New active

Becomes Active at 03:52:32,34

NATGW2#
*Nov  7 03:52:32.700: %HSRP-5-STATECHANGE: Ethernet0/2 Grp 100 state Standby -> Active
NATGW2#
*Nov  7 03:52:32.701:  IP-ADDR: ipaddr_table_insert_w_tableid() 10.31.71.254, in global table on Ethernet0/2
NATGW2#
*Nov  7 03:52:34.657: %HSRP-5-STATECHANGE: Ethernet0/1 Grp 200 state Standby -> Active

new Active listens for ARP requests for the HSRP IP

*Nov  7 03:52:34.658:  IP-ADDR: ipaddr_table_insert_w_tableid() 192.168.153.253, in global table on Ethernet0/1

The nat session is recreated on the new Active.

*Nov  7 03:52:34.745: NAT: API parameters passed: src_addr:10.31.71.3, src_port:0 dest_addr:10.31.73.12, dest_port:0, proto:6 if_input:Ethernet0/2 pak:B072F0A8 get_translated:1
*Nov  7 03:52:34.745: ipnat_api_translated_address_and_port_common, out->in want IL,OL
*Nov  7 03:52:34.745: NAT: API Translated-Info(1): (src-addr:10.31.71.3, src-port:0) (dest-addr:192.168.153.12, dest-port:0)