3

I'm trying to configure HSRP on 2 L3 distribution layer switches and I'm confused as to what best practice is. I'm using Cisco's high availability campus guidelines and this is the topology I'm working with, focused on the left half of the network layer:

my topoloy

I have trunks connecting Dist 1 and 2 to both access switches, a L3 link between dist 1 and 2, VLANs are configured on all the devices and PC1 is in VLAN 10, which is 10.0.1.0/24, and is using the HSRP IP as its gateway, 10.0.1.10.

The problem I'm running into is that both Dist1 and Dist2 consider themselves the active HSRP router and don't see a standby router and from PC1 I can't ping the HSRP IP but I can ping both Dist 1 and 2's SVIs for VLAN 10. I'm assuming there's some sort of communication error between the 2 L3 switches and I have some ideas on how to fix it, like making the link between them a trunk, but I'm curious what best practice in a situation like this is? I know Cisco recommends avoiding layer 2 loops at all cost for optimal convergence during failover.

On Dist1 I have HSRP configured as

interface Ethernet0/3
 no switchport
 description to Dist 1
 ip address 10.255.0.81 255.255.255.252

interface vlan 10
 ip address 10.0.1.1 255.255.255.0
 standby version 2
 standby 1 ip 10.0.1.10
 standby 1 preempt
 standby 1 priority 95

and on Dist 2 I have:

interface Ethernet0/3
 no switchport
 description to Dist 1
 ip address 10.255.0.82 255.255.255.252

interface vlan 10
 ip address 10.0.1.2 255.255.255.0
 standby version 2
 standby 1 ip 10.0.1.10
 standby 1 preempt
 standby 1 priority 105

I'm running OSPF in my network, dist 1

router ospf 1
 router-id 8.8.8.8
 network 10.255.0.8 0.0.0.3 area 0
 network 10.255.0.24 0.0.0.3 area 0
 network 10.255.0.80 0.0.0.3 area 0
 network 10.255.0.84 0.0.0.3 area 0

Dist 2

router ospf 1
 router-id 9.9.9.9
 network 10.255.0.12 0.0.0.3 area 0
 network 10.255.0.28 0.0.0.3 area 0
 network 10.255.0.80 0.0.0.3 area 0

and then all the the links between the dist switches and the access switches are configured like this on both sides

interface Ethernet1/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 duplex auto
1
  • Its been a long time since i’ve done this configuration but if im not mistaken you need to change the priority of one of the HSRP routers so it thinks its a standby. Currently based on your config both HSRP devices have the same priority level so both think they are active.
    – Ryan S
    Oct 19, 2022 at 9:31

2 Answers 2

6

You'll need to make sure that both SVI10s of Dist1 and Dist2 can hear each other's HSRP hello packets. HSRP active/standby negotiation cannot complete without that.

Possibly, VLAN 10's spanning tree has a blocking uplink port at Access1, be sure to check.

One common way to work around this is to add a 802.1q trunk (best as LACP bundle) between Dist1 and Dist2.

Oh and... do yourself a favour in OSPF, and run all the interfaces (SVIs) into the edge VLAN/subnets as 'passive', and have only one L3 link between Dist1 and Dist2. Can be as SVI & VLAN-that-only-exists-on-the-Dist1-Dist2-trunk, or can be as a dedicated L3 link from Dist1 to Dist2.

And while we're at it, on the Distris, also consider tuning the ARP cache timeouts on the Access Switch facing SVIs, usually by reducing ARP timeout to be the same as CAM table aging.

On the HSRP standby distribution switch, with ARP cache timers longer than CAM aging time, the CAM table entries will age out pretty soon; when that switch needs to forward routed traffic into the given VLAN, it will not ARP for the end host (because it's entry is still in the cache), but when it has no CAM entry, it will have to resort to Unknown Unicast Flooding through the access switch.

Cisco's CEF on the L3 switches will refresh/maintain its ARP entries ca 1min before they timeout; by reducing this to happen before CAM entries age out, everything will be kept nicely "in state".

3

HSRP requires L2 connectivity between the backing routers. So, a L3 link between dist 1 and 2 produces the problem you see.

Cisco's linked guideline states (emphasis mine):

Additionally, in a less than optimal design where VLANs span multiple access layer switches, the distribution nodes must be linked by an L2 connection. Otherwise, multiple convergence events can occur for a single failure and undesirable traffic paths are taken after the spanning tree converges.

Without reading it all, the 'more optimal design' is likely using L3 links between access and distribution, with a link-state routing protocol for failover, and no HSRP towards the edge nodes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.