Information About HSRP
The Hot Standby Router Protocol (HSRP) is a First Hop Redundancy Protocol (FHRP) designed to allow transparent failover of the first-hop IP device. HSRP provides high network availability by providing first-hop routing redundancy for IP hosts on networks configured with a default gateway IP address. For identifying an active and standby device in a group of routers, HSRP is used. In a group of device interfaces, the active device is the device of choice for routing packets; the standby device is the device that takes over if the active device fails or if preset conditions are met.
You can configure multiple hot standby groups on an interface, thereby making full use of redundant devices and load sharing.
The following figure shows a network configured for HSRP. By sharing a virtual MAC address and IP address, two or more devices can act as a single virtual router. The virtual device represents the common default gateway for devices that are configured to provide backup to each other. You don't need to configure the hosts on the LAN with the IP address of the active device. Instead, you can configure them with the IP address (virtual IP address) of the virtual device as their default gateway. If the active device fails to send a hello message within a configurable time period, the standby device takes over and responds to the virtual addresses and becomes the active device, taking over the duties of the active device.
HSRP Version 2 Support
Following are the HSRP version 2 (HSRPv2) features:
-
HSRPv2 advertises and learns millisecond timer values. This change ensures stability of the HSRP groups in all cases.
-
HSRPv2 expands the group number range from 0 to 4095.
-
HSRPv2 provides improved management and troubleshooting. The HSRPv2 packet format includes a 6-byte identifier field that is used to uniquely identify the sender of the message. Typically, this field is populated with the interface MAC address.
-
HSRPv2 uses the IP multicast address 224.0.0.102 to send hello packets. This multicast address allows Cisco Group Management Protocol (CGMP) leave processing to be enabled at the same time as HSRP.
-
HSRPv2 has a different packet format that uses a type-length-value (TLV) format.
HSRP MD5 Authentication
HSRP supports simple plain text string and message digest 5 (MD5) schemes of protocol packets authentication. HSRP MD5 authentication is an advanced type of authentication that generates an MD5 digest for the HSRP portion of the multicast HSRP protocol packet. This functionality provides added security and protects against the threat from HSRP-spoofing software.
MD5 authentication provides greater security than the alternative plain text authentication scheme. MD5 authentication allows each HSRP group member to use a secret key to generate a keyed MD5 hash that is part of the outgoing packet. A keyed hash of an incoming packet is generated, and if the hash within the incoming packet doesn't match the generated hash, the packet is ignored.
The key for the MD5 hash can be either given directly in the configuration using a key string or supplied indirectly through a key chain.
HSRP packets will be rejected in any of the following cases:
-
The authentication schemes differ on the device and in the incoming packets.
-
MD5 digests differ on the device and in the incoming packets.
-
Text authentication strings differ on the device and in the incoming packets.
HSRP Object Tracking
Object tracking separates the tracking mechanism from HSRP and creates a separate standalone tracking process that can be used by any other process and HSRP. The priority of a device can change dynamically when it has been configured for object tracking, and the object that is being tracked goes down. Examples of objects that can be tracked are the line protocol state of an interface or the reachability of an IP route. If the specified object goes down, the HSRP priority is reduced.
HSRP Static NAT Redundancy Overview
Starting from Cisco IOS XE Catalyst SD-WAN Release 17.9.1a release, HSRP Static NAT redundancy is supported on Cisco IOS XE Catalyst SD-WAN. Static mapping support for HSRP enables the active router configured with a NAT address to respond to an incoming ARP. This feature provides redundancy in NAT for traffic that fails over from HSRP active router to standby router without waiting for the ARP entry to timeout from previously active router.
The static NAT configuration is mirrored on the active and standby routers, and the active router processes the traffic.
A virtual IP address is assigned to the router. The edge device sends traffic to the virtual IP address, which is serviced by the active router. The standby routers monitor the active router. When the failover occurs, the new HSRP active edge router automatically resumes the ownership of static NAT mapping without waiting for ARP timeout. It sends gratuitous ARP for the static NAT mapping entry to update devices with their own mac addresses in the same LAN segment.
 Note |
Only static NAT is supported in HSRP NAT redundancy configuration. |
Perform the following tasks on active and standby routers to configure NAT static mapping for HSRP:
-
Ensure that the source and destination NAT works.
-
Enable HSRP on the NAT interface.
-
Configure HSRP redundancy group name.
-
Configure static NAT mapping manually on both active and standby edges, referring to HSRP redundancy group name configured.
To enable static NAT redunndancy for high availability in an HSRP environment, refer to Static NAT mapping support with HSRP.
HSRP Benefits
-
Redundancy: HSRP employs a redundancy scheme that is time proven and deployed extensively in large networks.
-
Fast Failover: HSRP provides transparent fast failover of the first-hop device.
-
Preemption: Preemption allows a standby device to delay becoming active for a configurable amount of time.
-
Authentication: HSRP MD5 algorithm authentication protects against HSRP-spoofing software and uses the industry-standard MD5 algorithm for improved reliability and security.
Feedback