2

I'm doing my VRRP networking lab. My understanding is if the Master failed then Backup will take over. In this scenarios, I have two layer 3 SW are connected together over LACP, and these two layer 3 switches are connected one Access Switch over LACP and one Firewall with static IPs. Now, two layer 3 sw are doing VRRP over SVI (Vlan 400). Now, if I shutdown one interface on Master that connected to FW then suppose Backup VRRP will take over, but the PC connected to Access can't ping FW IP (192.168.122.192). Any suggestion how I fix it?

enter image description here

here is configuration file Core SW1

interface Loopback0
 ip address 10.10.10.10 255.255.255.255
!
interface Port-channel10
 switchport trunk allowed vlan 172,201,300,400
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface Port-channel20
 switchport trunk allowed vlan 172,201,300,400
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface Port-channel30
 switchport trunk allowed vlan 172,201,300,400
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet1/2
 no switchport
 description ---connected to DHCP---
 ip address 10.100.100.1 255.255.255.0
 ip helper-address 10.100.100.2
 negotiation auto
!
interface GigiabitEthernet 2/2
no switchport
description --connected to FW---
ip address 10.10.10.1 255.255.255.252
negotiation auto

interface Vlan400
 ip address 10.10.0.10 255.255.254.0
 ip helper-address 10.100.100.2
 vrrp 10 description -Load balance-
 vrrp 10 ip 10.10.0.1
 vrrp 10 ip 10.10.0.2 secondary
 vrrp 10 priority 254
 vrrp 10 authentication text cisco
!
router ospf 1
 network 10.10.0.0 0.0.3.255 area 1
 network 10.10.10.0 0.0.0.3 area 0
 network 10.10.10.10 0.0.0.0 area 0
 network 10.30.0.0 0.0.3.255 area 1
 network 10.100.100.0 0.0.0.255 area 1

CoreSW2

interface Loopback0
 ip address 20.20.20.20 255.255.255.255
!
interface Port-channel20
 switchport access vlan 300
 switchport trunk allowed vlan 172,201,300,400
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface Port-channel40
 switchport trunk allowed vlan 172,201,300,400
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface Port-channel45
 switchport trunk allowed vlan 172,201,300,400
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet2/0
 no switchport
 description ---Connected to FireWall---
 ip address 20.20.20.1 255.255.255.252
 ip ospf priority 0
 negotiation auto
!
interface Vlan400
 ip address 10.10.0.11 255.255.252.0
 ip helper-address 10.100.100.2
 vrrp 10 description -Load balance-
 vrrp 10 ip 10.10.0.1
 vrrp 10 ip 10.10.0.2 secondary
 vrrp 10 authentication text cisco
!
router ospf 1
 network 10.10.0.0 0.0.3.255 area 1
 network 10.30.0.0 0.0.3.255 area 1
 network 20.20.20.0 0.0.0.3 area 0
 network 20.20.20.20 0.0.0.0 area 0

FireWall

interface Loopback0
 ip address 40.40.40.40 255.255.255.255

!
interface GigabitEthernet2/0
 ip address 10.10.10.2 255.255.255.252
 description ---CoreSW1---
 ip nat inside
 ip virtual-reassembly
 ip ospf priority 255
 negotiation auto
!
interface GigabitEthernet3/0
 ip address 20.20.20.2 255.255.255.252
 description --CoreSW2---
 ip nat inside
 ip virtual-reassembly
 ip ospf priority 255
!
router ospf 1
 log-adjacency-changes
 network 10.10.10.0 0.0.0.3 area 0
 network 20.20.20.0 0.0.0.3 area 0
 network 40.40.40.40 0.0.0.0 area 0
 network 192.168.122.0 0.0.0.255 area 2 (ISP)
  • This is confusing. On the first switch, you have the connection to the firewall (10.100.100.1) in Area 1, but there are is no Area 1 on the firewall. I think you need to either put better descriptions on the interface, or put some addressing and interface numbers on your drawing, or both. It would also be nice to have the OSPF areas on the drawing too, so we can see what you are actually trying to do. – Ron Maupin Oct 16 '17 at 0:39
2

One thing I noticed is that you are not tracking the links to the firewall, and you have no way configured for VRRP to fail over to the other switch if a link goes down. You will fail over if the entire switch fails.

You probably want the priority on the primary VRRP switch to be set at 105, and the backup as 100, then decrement by 10 if the link to the firewall fails. Configure preempt so that the backup will preempt the primary, and that the primary will resume when the link comes back up. You should also put in a delay so that a bouncing link doesn't cause the primary to jump back and forth.

Something like:

Core SW1:

track 100 interface GigiabitEthernet2/2 line-protocol
!
interface Vlan400
 ip address 10.10.0.10 255.255.254.0  !*** doesn't match the other switch ***
 ip helper-address 10.100.100.2
 vrrp 10 ip 10.10.0.1
 vrrp 10 priority 105
 vrrp 10 preempt delay 30
 vrrp 10 track 100 decrement 10
 vrrp 10 authentication text cisco
!

Core SW2:

interface Vlan400
 ip address 10.10.0.11 255.255.252.0  !*** doesn't match the other switch ***
 ip helper-address 10.100.100.2
 vrrp 10 ip 10.10.0.1
 vrrp 10 priority 100
 vrrp 10 preempt delay 30
 vrrp 10 authentication text cisco
!

Also, with switches, it is a really bad idea to try to load balance the way you have it configured. You want the STP root bridge to match the FHRP primary, otherwise you will get suboptimal traffic flows. If you want, you can have one switch as the STP root FHRP primary for the odd numbered VLANs, and the other switch the same for the even numbered VLANs, or some other such scheme, but all the traffic from a VLAN will go to the STP root, which should be the FHRP primary for that VLAN.

  • I just follow your steps and now it works... I really appreciated for your help. – Will Oct 17 '17 at 3:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.