Home FHRPs - First Hop Redundancy Protocols
Post
Cancel

FHRPs - First Hop Redundancy Protocols

FHRPs help us provide fault tolerance for our default gateways. if a client computer wants to get out of its local area network (LAN), it uses its default gateway to reach any other computers or servers outside of its LAN. if the default gateway cannot be reached by the client, the client would simply not be able to reach other networks that reside outside of its LAN. Having a fault tolerant network will prove crucial to the continued functionality of a network. Default gateways on client computers are usually statically configured by an administrator or dynamically learned from the DHCP server on the network. If a network has two default gateways, for example R1 and R2 a client can use, it wouldn’t help since they can only use one at a time and wouldn’t be able to fall back to the second gateway if the primary gateway fails to be operational, simply changing the default gateway on the host will fix the problem but that doesn’t scale very well in large environments. An FHRP protocol like HSRP, VRRP or GLBP will help us deploy a virtual IP (VIP) that both routers respond to and have it assigned as the default gateway for clients to use. Routers participating in the group will negotiate a protocol to support the VIP, in our case R1 and R2, so that they can respond to any incoming traffic destined to the VIP. Both routers will also negotiate who will respond to incoming traffic destined for the VIP, one router has to handle the virtual IP at any given point in time, say R2 takes the role, becomes the active router and Now R1 will be on standby keeping track of R2 to see if its functional. /assets/img/posts/FHRP/FHRP_R2_active.png

now if R2 fails, the active role of managing the virtual router is handled by R1 and clients can send traffic through without downtime.

FHRP_R2_inactive.png

To implement this, we have 2 Cisco proprietary protocols, namely, 1. HSRP (Hot Standby Router Protocol) 2. GLBP (Gateway Loadbalancing Protocol) and an Open standard called VRRP (Virtual Router Redundancy Protocol).

HSRP

HSRP is a cisco proprietary protocol for establishing fault tolerant default gateways. It achieves this by allowing hosts to use a single router and maintain connectivity even if the actual first hop router fails to forward packets. multiple routers participate in this protocol and in turn create the illusion of one router. The router responsible for forwarding packets is known as the active router. A stanby router is chosen to replace the active router should it fail to be operational.

configuring HSRP

Note that all routers participating should be configured for HSRP

Login to your router of choice using telnet, SSH or the console. Before executing any commands, its important to verify the interfaces you want to participate in HSRP and the network associated with the interface. The following configuration will be done based on our topology above. Carrying out router configuration over the network using Telnet is a security risk and NOT recommended. Click here to read more, use SSH instead.

R1_HSRP_config.png

the picture below shows configuring HSRP on R2

R2_HSRP_config.png

To verify HSRP has been deployed successfully, execute:

1
show standby

in privilege exec mode as shown below.

/assets/img/posts/FHRP/show_standby.png

The show standby command reveals that the “active router is local”, this means that R2 is now responsible for incoming traffic destined for the virtual ip address at 10.16.0.3, it also means that R2 is the active router in the group.

VRRP

VRRP is an open standard supported by all routers that support FHRPs, VRRP uses terminologies like master and backup to represent the role of the routers participating in VRRP compared to HSRP that used “active” and “standby”. In VRRP, the master is in charge of the virtual IP (VIP) and if it fails, the backup router will take over the role, When VRRP is enabled, an election happens between routers to choose who will be master and backup, The router with the highest priority will be selected as the master. The priority on the router interfaces is 100 by default, if priority is the same on all routers participating in VRRP (2 routers in our case), The router with the highest ip address will be chosen as the master. VRRP also has preemption enabled by default, This means that if a new router that has better “stuff” I.e higher priority steps in a VRRP group, it will take over the role of the master regardless of if one was already in place, This is disabled by default in HSRP.

This post will be updated to showcase VRRP configuration.

GLBP

GLBP stands for gateway load balancing protocol, This does exactly what the name says, it provides load balancing and fault tolerance between gateways, see… Cisco Routers aren’t cheap by any means and buying one so that It can be on standby or Backup isn’t ideal. The concept of fault tolerance is still the same in that GLBP introduces a virtual IP (VIP) and if a router goes down, the second one will step in to support the network, The benefit of using GLBP for fault tolerance is that GLBP provides loadbalancing for the gateways, To achieve this, GLBP introduces an AVG (Active virtual gateway) The AVG is supported by one of the routers and responds to ARP queries from clients that are looking for the mac address of their default gateway by the virtual mac addresses of the virtual routers in a round robin fashion. This means that clients on the Network will have different Mac addresses for the same gateway 10.16.0.3. packets destined for the default gateway at 10.16.0.3 will have different mac addresses and the switch will in turn forward them to two different destinations, in our case R1 and R2 and thats how we achieve load balance in our network. To configure GLBP… Execute the following commands as shown below:

Note that all routers participating should be configured for GLBP

/assets/img/posts/FHRP/GLBP_R1.png

configuring R2…

/assets/img/posts/FHRP/GLBP_R2.png

To verify that GLBP is working and successfully deployed, execute:

1
show glpb

in privilege Exec mode and parse the output returned.

i hope you enjoyed reading this post as much as i enjoyed writing it. 😊

This post is licensed under CC BY 4.0 by the author.