Hot answers tagged

45

Gratuitous ARP is a sort of "advance notification", it updates the ARP cache of other systems before they ask for it (no ARP request) or to update outdated information. When talking about gratuitous ARP, the packets are actually special ARP request packets, not ARP reply packets as one would perhaps expect. Some reasons for this are explained in ...


23

Besides VRRP not being proprietary, there are a few minor differences between the protocols as well: With HSRP, each interface must have an IP address that is separate from the HSRP group address. VRRP lets you share the Master's interface IP address. On Cisco devices, VRRP is configured to preempt by default, whereas HSRP is not configured to preempt by ...


18

A Gratuitous ARP is an ARP Response that was not prompted by an ARP Request. The Gratuitous ARP is sent as a broadcast frame, as a way for a node to announce or update its IP to MAC mapping to the entire network. An ARP Packet contains an "Opcode" field which indicates whether the packet is a request or a response. In the Gratuitous ARP, the Opcode field is ...


13

The simple answer is to make the CAM timer equal or slightly longer than the corresponding interface ARP timer, but there are at least three different options to select from... Option 1: Lower all interface ARP Timers This option works best if you have a decent-sized layer2 switched network, a reasonable number of ARP entries and few routed interfaces. ...


10

I would HIGHLY recommend getting rid of HSRP and using routing over the tunnels (both up all the time), whether OSPF or EIGRP. Set an inferior metric on one of the tunnels at both ends. Problem solved. HSRP is BAD NEWS over WAN. I am struggling to see what use the HSRP is. As you're now seeing it also causes a lot of issues when overlaid on top of routing. ...


10

On a Cisco Nexus switch, the syntax for HSRP is actually "HSRP" instead of "Standby". In my experience, it makes it easier to troubleshoot as you know immediately which redundancy protocol you're dealing with (HSRP, GLBP, or VRRP). See this Cisco doc for more information on HSRP on the Nexus 7000 platform. First, be sure that you have enabled HSRP on the ...


9

HSRP 1) Cisco propriteray 2) 1 Active & 1 standby router & 1 or more listening routers 3) use virtual ip add as gateway 4) hello 3 sec & holddown timer 10 sec 5) we can enable preempt manually (standby 1 preempt) 6) multicast at:224.0.0.2 (ver1), multicast at:224.0.0.102 (ver2). Both versions use udp port 1985 VRRP 1) open standard (ietf) ...


8

You are confused. What you claim is your router's MAC address is not your router's MAC address. The MAC address is in the range, 0000.0C07.ACxx, which is the MAC address range for HSRP. The 06 on the end of the MAC address is the HSRP group number. HSRP uses virtual IP and MAC addresses. You send to the virtual addresses to transit the router, but anything ...


7

PIM messages are not sourced from HSRP VIP's so the RPF check fails since the HSRP VIP is your RPF neighbor. There are two ways around this though. Set up a dynamic routing protocol between your router and the other sides routers so HSRP is not needed. Configure static mroutes to the other sides actual interface IP's such as: ip mroute 0.0.0.0 0.0.0.0 1.1....


7

I have found the issue. The problem was my testing procedure. I simulated the http connection using telnet to http port but I did not generate any traffic(requests). I repeated the tests using GET requests and the nat session table was replicated almost instant. I post the debug messages. The NAT replication trigger is the next segment, request in ...


6

You forgot to use the standby 5 preempt command. It is also a good idea to set a preempt delay. Hot Standby Router Protocol (HSRP): Frequently Asked Questions: Q. Which HSRP router requires that I configure preempt? A. An HSRP-enabled router with preempt configured attempts to assume control as the active router when its Hot Standby priority is ...


6

What the ISP means is that as they make changes, you may lose connectivity for a time because the ARP table entries your router has with them will not match the changes it is making. If you reduce the ARP timeout, you reduce the time you may have lost connectivity. You really only need to change arp timeout on the interface used to connect to the ISP. ...


5

It's all about the timers. There's an advertise interval and a master down interval (hello and hold time in HSRP and GLBP). The master sends VRRP advertisements according to the advertise interval. This lets the backup know that the master is up. If the backup doesn't receive an advertisement within the master down interval, it will transition to master. ...


5

You will need HSRP or VRRP for you FHRP if you want redundancy for your gateway. Each switch will need an SVI for each VLAN, and each VLAN will have its own FHRP group. You place the group for a VLAN on the SVI. The FHRP will use a path on the VLAN (dictated by STP) between the switches for the FHRP traffic. One thing you want to carefully plan is that the ...


5

I can't think of a way to achieve this within the limits of "same set of router interfaces of the same pair/group of routers". HSRPv1 and v2 are: a) incompatible and b) mutually exclusive on one given (sub)interface of a router and c) conflicting when implemented in parallel with the same standby ip addresses. That much, I assume, you already figured out....


5

Cisco has many documents to explain such things. For example, Hot Standby Router Protocol (HSRP): Frequently Asked Questions: Q. If there is no priority configured for a standby group, what determines which router is active? A. The priority field is used to elect the active router and the standby router for the specific group. In the case of an equal ...


4

One option is to connect both switches together and create two vlans that span across both switches. Connect the routers and the WAN side of the FW to VLAN 1. Connect the LAN side and the servers to VLAN 2. If you run HSRP on the routers, that is your default gatewway for the firewall. Here is a logical diagram. Let me know if you need help configuring ...


4

For R2 to become the active HSRP router, the priority has to be higher than R1. You've set the priority on R1 to 150, and the decrement value in the track statement to 20. So when the IPSLA "fails" R1's priority changes to 130 (150-20). but that is still higher than R2, so it remains the active router. You can change R1's priority to 110, so when the IP ...


4

If I put two interfaces (one on each SRX) in a reth, is that sufficient to ensure that there won't be any loops? Yes* - reth interfaces are essentially a logical L3 interface - they will not loop traffic between node0 and node1 of the SRX chassis cluster Is this the correct/optimal way to ensure redundancy with the two upstream links? No. Ask your ...


4

Solved This command was missing in e1/27 interface. spanning-tree port type edge trunk Full interface output look like following. interface Ethernet1/27 description Connected to server switchport mode trunk switchport trunk allowed vlan 10,20,30,100 spanning-tree port type edge trunk spanning-tree bpduguard enable


3

The HSRP behavior is normal; that's how HSRP works. You don't say what kind of switch you are using, but most Cisco switches can change the CAM aging interval. They have something like: mac address-table aging-time <time> Some Cisco switches with different IOS versions may have the dashes different from this.


3

I would use SVIs for the L3 interfaces at core instead of assigning the IP configuration to physical ports. This way, having VLAN 100 allowed in all links between Core1, Core2, Distribution1 and Distribution2 the Spanning Tree protocol will manage which of the available uplinks will be used to forward traffic between distribution and core. A config ...


3

The individual routers' physical interfaces do not share the master router's IP address. Each router must have different addresses configured on the physical interface. What that statement means is that the virtual interface may be assigned to the IP address of one of the physical interfaces. The physical interface which shares its address with the virtual ...


3

They really have nothing to do with each other. The client workstation will send unicast data to the VIP, but multicast will be sent to the group address. The DR will then forward the data up the tree. By default, if there are two multicast routers on a segment, one will be the DR and the other will be the IGMP querier. IGMP joins and membership query/...


3

Let me preface this by saying that I have not used Fortigate, but speaking generally. You should have two links from each firewall (FW ), one to each switch (SW), just as you have a link from each FW to each server (SRV). This is what I suspect is happening. Assuming SW1 is the HSRP active interface, it initially receives traffic from SRV2 on the link to ...


3

Are you sure you are not injecting the subnet with HSRP into OSPF (recursive routing). I use HSRP for SSLVPN and it works fine. that things work until you have an OSPF routing table is what suggests the recursive routing scenario to me. Another question is are you seeing in your logs HSRP primary moving around, which would suggest a problem at the head end.


3

HSRP is Cisco-proprietary. VRRP is not (RFC 5798). There are probably other nitty gritty technical differences, but that is the major one. And IIRC VRRP doesn't have the ability to do interface tracking, while HSRP does - might be wrong on this though. edit: RFC 5798 gives v6 support to VRRP. The original RFC was 2338.


3

Problem1: You should have consistent ospf cost, the L3 routing is independent of the L2 hsrp gateway redundancy Problem1b: You host vlans hanging off the Nexus devices should be passive for OSPF, why do you want active ospf here ? Problem2: On your vlan2 (192.168.0.0/24) you should not have hsrp, if all the devices are using ospf to interconnect no need ...


Only top voted, non community-wiki answers of a minimum length are eligible