Cisco Switching/Routing :: 2911 HSRP With Enterasys Matrix E1
Nov 27, 2012
Two c2911 routers are connected to LAN and have HSRP configured. HSRP is negotiating successfully (active/standby), but LAN switch Enterasys Matrix E1 has problems accessing the virtual HSRP address. The switch can ping HSRP IP, and the virtual HSRP MAC is visible in its MAC table. But the static routes configured on the switch towards the HSRP IP seem to refuse working. Workaround to enable users to access network was to direct the static routes to the physical IP of one router. Is there a known incompatibility between Enterasys with Cisco HSRP?
Two C2911 routers are connected to LAN and have HSRP configured. HSRP is negotiating successfully (active/standby), but LAN switch Enterasys Matrix E1 has problems accessing the virtual HSRP address. The switch can ping HSRP IP, and the virtual HSRP MAC is visible in its MAC table. But the static routes configured on the switch towards the HSRP IP seem to refuse working. Workaround to enable users to access network was to direct the static routes to the physical IP of one router. Is there a known incompatibility between Enterasys with Cisco HSRP?
in a customer project we are evaluating if it's possible to connect from cisco ios switches via "ssh -l <user> <ip address>" to an enterasys n series dfe modul which is running a ssh server v2.
Unfortunately this doesn't work as expected, every connection attempt is resetted.We did a trace of the ssh connection attempt where you can see that there is some problem in the algorithm negotiation (see attachment).
Does GLC-GE-100FX is supported on the WS-C2960S-24TD-L. I don't see this switch listed under the compatibiilty matrix.URL,But the datasheet for the 2960S says this:"The Cisco Catalyst 2960-S with SFP+ does not support the GLC-FE-100BX, GLC-FE-100FX, or GLC-FE-100LX."But it provides no reference for the GLC-GE-100FX,The easy answer is, no the 2960S-24TD doesn't support it.
I am facing an isssues with 7609 for LAN switching , based on LAN (VRRP/HSRP) feature.Actually we are having ES+ cards (on 7609) and we are using multiple groups(say 350 vrrp groups) running on the router . the routers are connected as router 1>>> mux(which is working as switches)>>> router2
my questing are
1. does their will be "multicast packets" (for VRRP/HSRP group) "from backup router to Master router", when in stable state( ie when Master and backup are already chosen) , or the packet from backup to master should be unicast.I know for sure, the packet from master to back is multicast packets denstination to Multicast IP packet and To MAC address.I am not sure but I think from backup to master it should be multicast
2. what is frequency of these packets( from backup to master)
3. As i have multiper group on a single interface ( we are using q-in-q), when the connectivity from router's is broken, then does all the groups will muticast their active roll in the lan sengment "at once" or it will be in a groups say 100 groups at once, and after few ms few 100's and sone ( as is on OSPF or RIP)
we are in between troubleshooting I hope we get the ans( Actul problem we are seeing in the router's that we have 2 ports on active routers and 2 ports on standby router , but we are not seeing muticast on 1 port on standby router where as all other 3 ports are seeing multicast packets) [code]
I configure HSRP on Router 2951 as a primary router, and Router 2811 as backup router. But when I am switching off my Primary router the backup router is taking 2 mins to take over form primary router.
We have two Cisco 3560E layer 3 switches at the core of our network. The switches are configured as an HSRP pair and the clients on our network point to the HSRP address as their default gateway. So if CORE-A dies, then CORE-B will pick up the address and the default route for the clients will continue to be available.We also need to specify a few static routes on the core switch to allow us to get to specific networks. Is there a way to do this so that the routes failover in the same way that the default gateway does?
I'm looking to try and implement ipv6 HSRP on a series of IOS-XR Routers running 4.2.1 following on from successfully setting up IPv6 HSRP on a few cat6509s on VLAN Interfaces in other parts of the network. I have entered the "router hsrp" configuration menu and gone into the interface in question that I'm looking to setup with IPv6 HSRP. Unfortunately, there version 2 or address-family ipv6 commands are not available.
if the above design is acceptable how does the routers know which one is active and which one is standby ? if we need a direct connection between two routers they have to be on a seperate subnet and routers dont allow broadcasts - so how will hsrp work on routers ?
We have two numbers of Cisco 4900 ME Switches. Basically want LAN failover from these devices. There are about 400 users in our network. I have attached rough network topology for your reference(I am not good at Microsoft Visio). Need to know implementation of the HSRP in these switches. Two distribution switches(Cisco 4900 ME Switches) are connected to 4 Access switches and these are connected to the LAN.
i have 2 cisco 7604 distrubution routers .Both routers are running 310 hsrp groups.
Sundenly there is hsrp flapping which causes high CPU.
What is the limitation of HSRP group on cisco 7604 router .Below is the show ver from the router
----------------- show version ------------------ Cisco IOS Software, c7600rsp72043_rp Software (c7600rsp72043_rp-ADVIPSERVICES-M), Version 12.2(33)SRC2, RELEASE SOFTWARE (fc2)
I currently use L3 switches as edge routers to my WAN. I want to use a pair of 3560x switches with IPbase to provide a failover path to my WAN using HSRP at one location but had some problems testing the configuration. My plan is use a virtual address on the LAN interface (VLANx which port gi0/1 accesses) and the WAN interface (VLANy which port gi0/24 accesses). I want switch 1 to be primary since it will have an IPS attached to it, and switch 2 will be backup and used only when switch 1 or the IPS requires maintenance. On both the LAN and WAN sides there is no advanced routing going on, the various hosts just depend on the availability of their respective default gateways, so HSRP should be sufficient to provide a failover in either direction.
In my testing I got 1 or the other link to fail over but not the entire switch. What should my config look like to achieve failover of the entire switch in the event 1 or the other interface goes down, and fail back when the primary links are again available?
n our datacenter we've implemented HSRP on 2 6500's for redundancy purposes. Both switches are connected via a trunk. When an interface is administratively brought up, HSRP becomes instable. Below some selective logging:
12:58:01.759 CET: %HSRP-5-STATECHANGE: Vlan32 Grp 32 state Standby -> Active12:58:01.919 CET: %HSRP-5-STATECHANGE: Vlan21 Grp 21 state Standby -> Active12:58:02.031 CET: %HSRP-5-STATECHANGE: Vlan42 Grp 42 state Standby -> Active12:58:02.031 CET: %HSRP-5-STATECHANGE: Vlan18 Grp 18 state Standby -> Active12:58:02.223 CET: %HSRP-5-STATECHANGE: Vlan4 Grp 4 state Standby -> Active
Basically what happens, is that both switches becomes active and thus are forwarding traffic. After a few seconds all is back to normal. It seems they are missing each others "hello messages", so the state change is in this case normal outcome. What I can't figure out', is the root cause. Since it is triggered by bringing up an random interface configured as a dot1q trunk, I'm thinking of STP limits. But the limitations I found are 10.000 active STP logical ports and 1800 virtual ports per slot. In my case this is 2591 logical ports and all the virtual ports per slot are below 1800. This suggest the switch is capable of running this set-up without a problem.
Some extra information:-Sup 720 10GE-Version 12.2(33)SXH2a-No Vss used-No drops on trunked interfaces between the 2 core switches-83 standby groups (max256) -R-PVST
I just started a evaluation license for IP Base on my 3850 switches. But i can't configure HSRP cause the commands are not there (I rebooted allready). Do you need enterprise for HSRP on the 3850?
Had a Sev 1 issue today. We have a bunch of Nexus 5ks connecting to some HP C7000 Chassis for the use of Virual environments. Engineers build and tear down servers during the day, however today, an engineer configured a virtual machine accidently with its IP address as the default gateway. Each pair of nexus switches has one physical SVI per vlan and a HSRP address for the vlan. Of course this engineer configuring the server IP address as the HSRP address killed the vlan... which lead me onto think... are they are tried and tested techniques to protect this from happening on the switch. Enforcing the ARP/MAC of the HSRP address and not allowing it to change or any other device to change it?
I have a paif of nexus 5548 configured VPC using the mgmt interface as heartbeat and 2x10G as peerlink. Peer-gateway is also configure on the vpc domain. I have 2 FEX straight thru connection to each Nexus'es. Created 2 VPC and both are up and no suspended vlans. Allowed VLANs in peerlink is 10,20,30,40 and 50. I configure SVI for VLAN 10 on both nexus 10.10.10.100/24 and 10.10.10.101/24 respectively. The problem is when I create HSRP on this VLAN 10 (vip 10.10.10.88), the hello packets are not heard by both nexus, thus both Nexus are acting as active with unknown standby. I can ping both vlan 10 from each Nexus. I tried deleting and putting back the config but no luck.I tried creating another SVI vlan 20 on both nexus and form hsrp, result is same as in vlan 10. I am running version 5.1 release on both nexus.
I just started a evaluation license for IP Base on my 3850 switches. But i can't configure HSRP cause the commands are not there (I rebooted allready). Do you need enterprise for HSRP on the 3850?
I have a few old 2600 routers (2621, different IOS's) which I'm now replacing for new one's from the 2900 series (2901, Version 15.1(4)M4).In my configuration I have two IP addresses in my LAN interface and I have HSRP configured within the secondary IP subnet range. It would be something like this:
interface GigabitEthernet0/1 ip address 172.x.x.x x.x.x.x secondary ip address 10.z.z.z z.z.z.z
[Code].....
Now, in the new 2900 routers, my interface configuration hasn't changed however I can see that the hello packets are now sent with the source within the respective HSRP IP subnet so I had to edit my acl for that:
It looks like both my HSRP Interfaces (VLAN 600 & 700) cycle through standby --> active ---> speak continuously on one of the two switches. What can be causing this?
*May 4 06:41:24.883: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Speak -> Standby *May 4 06:41:33.671: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Standby -> Active *May 4 06:41:33.671: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Active -> Speak *May 4 06:41:34.251: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Speak -> Standby *May 4 06:41:47.691: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Standby -> Active *May 4 06:41:47.703: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Active -> Speak
I am facing a problem in implementing HSRP. My scenario is like this, I have two 3750 switches and I have a server with two NICs. I want to run HSRP in these two switches. By the way the server is connected directly with the switches. I mean each NIC to each switch.we have teamed the two NIC (Active / Standby).what configuration need to done in switches to work HSRP.
i have a big problem because i configure a vlans with vrf and HSRP but, when i do "show hsrp brief", dont show this interfaces and, i can ping virtual IP. it seems hsrp dont work.
SWSERVSCAMILO_N7010_A# interface Vlan405 description smsc-fwatlas1 no shutdown [Code] ....
I have configured HSRP with InterVlan routing. All communication is flowing properly between the vlan's on Router A but when I test failover to Router B I cant ping ANYWHERE. I cannot ping any of the VLANS.
Also, From the primary router I cannot ping any of the interfaces on the secondary router.
I have 2 Cisco 1921 Routers configured for HSRP. Both the G0/1 ports plug into a Cisco 2960S 48 port POE switch (STACKED) (port 1 and port 2 which are trunked and allowing all vlans to pass through. And both of the G0/0 ports are plugged into a Cisco ASA5510.
I have attached a diagram of the setup and the interface configs of the routers.
I have to migrate two Cat6K series switches in a Data center to the new Cisco 6509 Series switches with no downtime. i know there are few threads on the same topic but none of them discuss about the downtime.The two Old Cat6K series switches are working in HSRP redundant mode. All access/Dist switches are dual homed to these two switches in downlink direction. In the uplink direction a router is dual homed to both Switches. Now my requirement is to completely migrate the configuration from the old switches to the new one in VSS mode without any downtime. Already VTP server is running on of the old switches so VLAN migration is not an issue. I will update the network diagram in few hours .As per now i am going to follow these steps:
1. Remove active links from switch 1 and shut it down 2. Monitor network and traffic impact on switch 2 3. Install the new 6509 switch along with switch 2 (VSS config already done in Staging) 4. Config HSRP and make it standby 5. Connect all removed links back to new switch 6. Remove old switch 2 and monitor network 7. Connect new switch with VSS config 8. Connect the two new switches together in VSS and move virtual IP to SVI.
During last step i think i will face some minor packet drops.
I am setting up multiple vlan interfaces on a pair of HSRP Routers that will provide layer 3 routing for a network. I am seeing this command sporadically show up in the router config mac-address-table static 0000.0c07.acd2 vlan 210
I am not entering this command. So far, it has not shown up on the companion 3725 router. I have a 2nd vlan I have just created and the problem hasn't shown up for that vlan as yet.Using C3725-ADVSECURITYK9-M), Version 12.4(15)T7, RELEASE SOFTWARE (fc3) on the routers.
Is there a loop between 192.168.99.191 and .192 (this are two routers with hsrp .190) or is this normal behavior when using trace route on an asr 1001?
Below is a basic image of the HSRP and backup link setup for our LAN.
The virtual IP 192.168.178.50 resides on the primary router and fails over to the backup router. Internal default gateways for the switches are set to 178.50.
Switch1 is Layer3 and has two static default routes configured as:
ip route 0.0.0.0 0.0.0.0 192.168.179.50 track 1 - - - (interface line-protocol track) ip route 0.0.0.0 0.0.0.0 192.168.178.50 2
And the primary router has a static route out 179.50 which tracks the interface (route goes down if interface is down), and a backup static route.
ip route (internal LAN) Gi0/1 track 1 - - - (interface line-protocol track) ip route (internal LAN) Gi0/2 2
Everything works fine. If the primary router fails, Switch1 tears down the route across Vlan179, HSRP fails over the IP to the backup router and routing continues as normal. If the link across Vlan179 fails, the routers tear down the primary routes and again, things continue as normal.
The problem comes when the primary WAN link fails but the router remains up. This means the default route is still across Vlan179. Normally, Id set an IP SLA on Switch1 to track the WAN link BUT Switch1 only has the BASE IOS and the company wont pay for the Advanced IP IOS so I dont have IP SLA as an option.
How can I get the static default route to failover in the event that only the primary WAN link goes down?
I have been reading several posts in this forum to try to understand ACL behaviour on a standby HSRP 6500, I would be glad to get this cleared.I have two 6509 running HSRP for all Vlans...I created VLAN 100 with standby ip address 192.168.1.129 255.255.255.128
Active 6509 (SW01) ip is 192.168.1.130/25, priority 120 Standby 6509 (SW02) ip is 192.168.1.131/25
I have created a DHCP server on the standby 6509 only on the same VLAN 100 with a defaul router of 192.168.1.129 (i.e. the hsrp vip). I connected a pc directly to the ethernet port on the standby 6509 and put it under VLAN 100 and it obtained its ip 192.168.1.200 from the ios dhcp.Now I want to restrict this PC (and any other on its subnet) to access only a remote server 172.168.10.10 and nothing else. I have created the following access list, allowing traffic to the remote server, ospf and hsrp updates,ios dhcp...
Extended IP access list SWRES 10 permit ospf any any log (172 matches) 20 permit ip any host 172.168.10.10 30 permit ip any host 224.0.0.2 40 permit udp any host 255.255.255.255 eq bootpc 50 deny ip any any log (52 matches)
I have applied this ACL on both the 6509s under interface VLAN 100 ip access-group SWRES in
1. When I ping different subnets on the 6509s from the PC, I still receive icmp replies although I expected the acl to pass traffic destined for the remote server only. I do get deny log messages on the Active 6509, but not on the standby 6509 where the PC is connected.
2. Is permitting bootpc in the acl enough for IOS DHCP server and client operation? Do i need to explicitly permit access to the defaul-router configured in the DHCP, which happens to be the VLAN 100 gateway ip and hsrp vip as well (192.168.1.129)
3. I do get deny logs on both the 6509s from the PC trying to access the local VLAN 100 broadcast address on ports 137, 138.
%SEC-6-IPACCESSLOGP: list SWRES denied udp 192.168.1.200(137) -> 192.168.1.255(137)
