1

I have two L3-Switches performing HSRP for 3 VLANs (64,65,66).

When looking at the output of the "show standby brief" command, I can see that both switches have formed a virtual router just for one vlan (65).

Here's my topology:

enter image description here

This is the configuration on Core1:

    en
     conf t
     no ip domain-lookup
     ipv6 unicast-routing
     ip routing

     int loopback 0
      ip add 2.2.2.3 255.255.255.255
      exit

     vlan 64
      exit
     vlan 65
      exit
     vlan 66
      exit

     ipv6 router ospf 1
      auto-cost reference-bandwidth 100000
      router-id 2.2.2.3
      area 64 range 2001:db8:18:6400::/58
      area 65 range 2001:db8:18:6500::/58
      area 66 range 2001:db8:18:6600::/58
      passive-interface g0/1
      passive-interface g0/2
      exit

     router ospf 1
      auto-cost reference-bandwidth 100000
      area 64 range 10.0.64.0 255.255.255.0
      area 65 range 10.0.65.0 255.255.255.0
      area 66 range 10.0.66.0 255.255.255.0
      passive-interface g0/1
      passive-interface g0/2
      exit

     int vlan 64
      ip add 10.0.64.3 255.255.255.0
      ipv6 add 2001:db8:18:6400::3/64
      ipv6 ospf 1 area 0
      ip ospf 1 area 0
      no sh

     int vlan 65
      ip add 10.0.65.3 255.255.255.0
      ipv6 add 2001:db8:18:6500::3/64
      ipv6 ospf 1 area 0
      ip ospf 1 area 0
      no sh

     int vlan 66
      ip add 10.0.66.3 255.255.255.0
      ipv6 add 2001:db8:18:6600::3/64
      ipv6 ospf 1 area 0
      ip ospf 1 area 0
      no sh

     int fa0/5
      switchport mode trunk
      switchport trunk enc dot1q
      switchport native vlan 99
      exit

     int f0/4
      switchport mode trunk
      switchport trunk enc dot1q
      switchport native vlan 99
      exit

     int g0/1
      switchport mode trunk
      switchport trunk enc dot1q

     int g0/2
      switchport mode trunk
      switchport trunk enc dot1q

     int f0/24
      no switchport
      ip add 10.0.0.45 255.255.255.252
      ipv6 add 2001:db8:18:0010::1/64
      ipv6 ospf 1 area 0
      ip ospf 1 area 0
      ip ospf hello-interval 3
      ipv6 ospf hello-interval 3
      no sh
      exit 

     int fa0/1
      no switchport
      ip add 10.0.0.26 255.255.255.252
      ipv6 add 2001:db8:18:0006::2/64
      ipv6 ospf 1 area 0
      ip ospf hello-interval 3
      ipv6 ospf hello-interval 3
      no sh
      exit

     int fa0/2
      no switchport
      ip add 10.0.0.18 255.255.255.252
      ipv6 add 2001:db8:18:0005::2/64
      ipv6 ospf 1 area 0
      ip ospf hello-interval 3
      ipv6 ospf hello-interval 3
      no sh
      exit

     int vlan 64
      standby 64 priority 100
      standby 64 ip 10.0.64.2
      exit

     int vlan 65
      standby 65 priority 100
      standby 65 ip 10.0.65.2
      exit

     int vlan 66
      standby 66 priority 100
      standby 66 ip 10.0.66.2
      exit

     router ospf 1
      passive-interface Vlan 64
      passive-interface Vlan 65
      passive-interface Vlan 66
      exit

     ip access-list extended VLAN64 
      deny ip 10.0.0.0 0.255.255.255 any
      exit
     ip access-list extended  VLAN65
      deny ip 10.0.0.0 0.255.255.255 any
      exit
     ip access-list extended  VLAN66
      permit tcp 10.0.0.0 0.255.255.255 host 10.0.66.101 eq 80
      permit tcp 10.0.0.0 0.255.255.255 host 10.0.66.101 eq 443
      permit tcp 10.0.0.0 0.255.255.255 host 10.0.66.101 eq 139
      permit tcp 10.0.0.0 0.255.255.255 host 10.0.66.101 eq 445
      deny ip 10.0.0.0 0.255.255.255 any
      exit

     ipv6 access-list VLAN64IPv6
      deny ipv6 any any
      exit
     ipv6 access-list VLAN65IPv6
      deny ipv6 any any
      exit
     ipv6 access-list VLAN66IPv6
      permit tcp 2001:db8:18::/48 host 2001:db8:18:6600::0010 eq 80
      permit tcp 2001:db8:18::/48 host 2001:db8:18:6600::0010 eq 443
      permit tcp 2001:db8:18::/48 host 2001:db8:18:6600::0010 eq 139
      permit tcp 2001:db8:18::/48 host 2001:db8:18:6600::0010 eq 445
      deny ipv6 any any
      exit

     int vlan 64
      ip access-group VLAN64 out
      ipv6 traffic-filter VLAN64IPv6 out
      exit

     int vlan 65
      ip access-group VLAN65 out
      ipv6 traffic-filter VLAN65IPv6  out
      exit

     int vlan 66
      ip access-group VLAN66 out
      ipv6 traffic-filter VLAN66IPv6  out
     end

And this the configuration on Core0:

    en
 conf t
 no ip domain-lookup
 ipv6 unicast-routing
 ip routing

 int loopback 0
  ip add 2.2.2.1 255.255.255.255
  exit

 vlan 64
  exit
 vlan 65
  exit
 vlan 66
  exit

 ipv6 router ospf 1
  auto-cost reference-bandwidth 100000
  router-id 2.2.2.1
  area 64 range 2001:db8:18:6400::/58
  area 65 range 2001:db8:18:6500::/58
  area 66 range 2001:db8:18:6600::/58
  passive-interface g0/1
  passive-interface g0/2
  exit

 router ospf 1
  auto-cost reference-bandwidth 100000
  area 64 range 10.0.64.0 255.255.255.0
  area 65 range 10.0.65.0 255.255.255.0
  area 66 range 10.0.66.0 255.255.255.0
  passive-interface g0/1
  passive-interface g0/2

 int vlan 64
  ip add 10.0.64.1 255.255.255.0
  ipv6 add 2001:db8:18:6400::1/64
  ipv6 ospf 1 area 0
  ip ospf 1 area 0
  no sh

 int vlan 65
  ip add 10.0.65.1 255.255.255.0
  ipv6 add 2001:db8:18:6500::1/64
  ipv6 ospf 1 area 0
  ip ospf 1 area 0
  no sh

 int vlan 66
  ip add 10.0.66.1 255.255.255.0
  ipv6 add 2001:db8:18:6600::1/64
  ipv6 ospf 1 area 0
  ip ospf 1 area 0
  no sh

 int fa0/5
  switchport mode trunk
  switchport trunk enc dot1q
  switchport native vlan 99
  exit

 int f0/4
  switchport mode trunk
  switchport trunk enc dot1q
  switchport native vlan 99
  exit

 int g0/1
  switchport mode trunk
  switchport trunk enc dot1q

 int g0/2
  switchport mode trunk
  switchport trunk enc dot1q

 int f0/24
  no switchport
  ip add 10.0.0.41 255.255.255.252
  ipv6 add 2001:db8:18:0009::1/64
  ipv6 ospf 1 area 0
  ip ospf 1 area 0
  ip ospf hello-interval 3
  ipv6 ospf hello-interval 3
  no sh
  exit

 int fa0/1
  no switchport
  ip add 10.0.0.30 255.255.255.252
  ipv6 add 2001:db8:18:0008::2/64
  ipv6 ospf 1 area 0
  ip ospf 1 area 0
  ip ospf hello-interval 3
  ipv6 ospf hello-interval 3
  no sh
  exit

 int fa0/2
  no switchport
  ip add 10.0.0.22 255.255.255.252
  ipv6 add 2001:db8:18:0007::2/64
  ipv6 ospf 1 area 0
  ip ospf 1 area 0
  ip ospf hello-interval 3
  ipv6 ospf hello-interval 3
  no sh
  exit

 router ospf 1
  passive-interface Vlan 64
  passive-interface Vlan 65
  passive-interface Vlan 66
  exit

 int vlan 64
  standby 64 priority 200
  standby 64 ip 10.0.64.2
  exit

 int vlan 65
  standby 65 priority 200
  standby 65 ip 10.0.65.2
  exit

 int vlan 66
  standby 66 priority 200
  standby 66 ip 10.0.66.2
  exit

 ip access-list extended VLAN64 
  deny ip 10.0.0.0 0.255.255.255 any

  exit
 ip access-list extended  VLAN65
  deny ip 10.0.0.0 0.255.255.255 any
  exit
 ip access-list extended  VLAN66
  permit tcp 10.0.0.0 0.255.255.255 host 10.0.66.101 eq 80
  permit tcp 10.0.0.0 0.255.255.255 host 10.0.66.101 eq 443
  permit tcp 10.0.0.0 0.255.255.255 host 10.0.66.101 eq 139
  permit tcp 10.0.0.0 0.255.255.255 host 10.0.66.101 eq 445
  deny ip 10.0.0.0 0.255.255.255 any
  exit

 ipv6 access-list VLAN64IPv6
  deny ipv6 any any
  exit
 ipv6 access-list VLAN65IPv6
  deny ipv6 any any
  exit
 ipv6 access-list VLAN66IPv6
  permit tcp 2001:db8:18::/48 host 2001:db8:18:6600::0010 eq 80
  permit tcp 2001:db8:18::/48 host 2001:db8:18:6600::0010 eq 443
  permit tcp 2001:db8:18::/48 host 2001:db8:18:6600::0010 eq 139
  permit tcp 2001:db8:18::/48 host 2001:db8:18:6600::0010 eq 445
  deny ipv6 any any
  exit

 int vlan 64
  ip access-group VLAN64 out
  ipv6 traffic-filter VLAN64IPv6 out
  exit

 int vlan 65
  ip access-group VLAN65 out
  ipv6 traffic-filter VLAN65IPv6  out
  exit

 int vlan 66
  ip access-group VLAN66 out
  ipv6 traffic-filter VLAN66IPv6  out
 exit
exit

"show standby brief" on core1

enter image description here

  • Give us the output of the show running-config command, not what you are entering. Also, you really don't have the standby configured correctly, you probably want the priorities closer, using a track to subtract enough to switch, and use the preempt command. – Ron Maupin Mar 4 '18 at 20:58
  • Well, the problem was, that I set the hsrp priority on both L3-Switches. But I don't know why this is a problem. – watchme Mar 4 '18 at 20:59
  • You can set the priorities, but you probably want them to be something like 105 on the root bridge, and 100 on the secondary root. Then track the uplink interfaces, and use a decrement of 10, along with the preempt command, so that the HSRP active switches when an uplink goes down. – Ron Maupin Mar 4 '18 at 21:01
  • It is important with layer-3 switches that you match the root bridge (low priority) and the HSRP primary (high priority) to prevent suboptimal traffic flow. – Ron Maupin Mar 4 '18 at 21:03
  • But why didn't it work with the priorities set (100 on one and 200 on the other) then? – watchme Mar 4 '18 at 21:07
1

Assuming Core0 is both the root bridge and HSRP primary for all three VLANs, and the uplinks are FastEthernet0/1 and FastEthernet0/2, you should do something like this:

Core0:

spanning-tree vlan 64 priority root primary
spanning-tree vlan 65 priority root primary
spanning-tree vlan 66 priority root primary
!
interface Vlan64
 ip address 10.0.64.2 255.255.255.0
 ip ospf 1 area 0
 standby version 2
 standby 64 ip 10.0.64.1
 standby 64 priority 110
 standby 64 preempt delay 30
 standby 64 track FastEthernet0/1 8
 standby 64 track FastEthernet0/2 8
!
interface Vlan65
 ip address 10.0.65.2 255.255.255.0
 ip ospf 1 area 0
 standby version 2
 standby 65 ip 10.0.65.1
 standby 65 priority 110
 standby 65 preempt delay 30
 standby 65 track FastEthernet0/1 8
 standby 65 track FastEthernet0/2 8
!
interface Vlan66
 ip address 10.0.66.2 255.255.255.0
 ip ospf 1 area 0
 standby version 2
 standby 66 ip 10.0.66.1
 standby 66 priority 110
 standby 66 preempt delay 30
 standby 66 track FastEthernet0/1 8
 standby 66 track FastEthernet0/2 8
!

Core1:

spanning-tree vlan 64 priority root secondary
spanning-tree vlan 65 priority root secondary
spanning-tree vlan 66 priority root secondary
!
interface Vlan64
 ip address 10.0.64.3 255.255.255.0
 ip ospf 1 area 0
 standby version 2
 standby 64 ip 10.0.64.1
 standby 64 priority 100
 standby 64 preempt delay 30
 standby 64 track FastEthernet0/1 8
 standby 64 track FastEthernet0/2 8
!
interface Vlan65
 ip address 10.0.65.3 255.255.255.0
 ip ospf 1 area 0
 standby version 2
 standby 65 ip 10.0.65.1
 standby 65 priority 100
 standby 65 preempt delay 30
 standby 65 track FastEthernet0/1 8
 standby 65 track FastEthernet0/2 8
!
interface Vlan66
 ip address 10.0.66.3 255.255.255.0
 ip ospf 1 area 0
 standby version 2
 standby 66 ip 10.0.66.1
 standby 66 priority 100
 standby 66 preempt delay 30
 standby 66 track FastEthernet0/1 8
 standby 66 track FastEthernet0/2 8
!

This will set the HSRP priority to Core0 for the root bridge and the HSRP primary. When one uplink goes down, it will decrement the HSRP priority by 8 (not enough to switch), and if the other uplink goes down, it will switch the HSRP primary to Core1. I put a delay on the preempt so that a flaky connection doesn't cause HSRP to continuously bounce.

0

Well, after I didn't set the priority on both switches, they successfully formed a virtual router.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.