Ccnpv7 Switch Lab 6-1 FHRP HSRP VRRP Student

CCNPv7 SWITCH
Chapter 6 Lab 6-1, First Hop Redundancy Protocols HSRP and

VRRP
Topology
Objectives
Configure inter-VLAN routing with HSRP with load balancing
Configure HSRP authentication
Configure HSRP Interface Tracking
Configure VRRP
Configure VRRP object tracking
Hot Standby Router Protocol (HSRP) is a Cisco-proprietary redundancy protocol for establishing a faulttolerant default gateway. It is described in RFC 2281. HSRP provides a transparent failover mechanism to the
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 1 of 19
Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

end stations on the network. This provides users at the access layer with uninterrupted service to the network
if the primary gateway becomes inaccessible.
The Virtual Router Redundancy Protocol (VRRP) is a standards-based alternative to HSRP and is defined in
RFC 3768. The two technologies are similar but not compatible.
This lab will offer configuration experience with both of the protocols in a phased approach.
Some of the configurations in this lab will be used in subsequent labs. Please read carefully before clearing
your devices.
Note: This lab uses the Cisco WS-C2960-24TT-L switch with the Cisco IOS image c2960-lanbasek9-mz.1502.SE6.bin and the Catalyst 3560V2-24PS switch with the Cisco IOS image c3560-ipservicesk9-mz.1502.SE6.bin. Other switches and Cisco IOS Software versions can be used if they have comparable capabilities
and features. Depending on the switch model and Cisco IOS Software version, the commands available and
output produced might vary from what is shown in this lab.
Required Resources
1
1
2 switches (Cisco 2960 with the Cisco IOS Release 15.0(2)SE6 C2960-LANBASEK9-M image or
comparable)
2 switches (Cisco 3560 with the Cisco IOS Release 15.0(2)SE6 C3560-IPSERVICESK9-M image or
comparable)
Ethernet and console cables
4 PCs with Windows OS
Prepare for the Lab

Prepare the switches for the lab
Use the reset.tcl script you created in Lab 1 Preparing the Switch to set your switches up for this lab.
Then load the file BASE.CFG into the running-config with the command copy flash:BASE.CFG
running-config. An example from DLS1:
DLS1# tclsh reset.tcl
Erasing the nvram filesystem will remove all configuration files! Continue?
[confirm]
[OK]
Erase of nvram: complete
Reloading the switch in 1 minute, type reload cancel to halt
Proceed with reload? [confirm]
*Mar 7
*Mar 7
Reason:
<switch
18:41:40.403: %SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram

18:41:41.141: %SYS-5-RELOAD: Reload requested by console. Reload
Reload command.
reloads - output omitted>
Would you like to enter the initial configuration dialog? [yes/no]: n

Switch> en
Page 2 of 19

*Mar 1 00:01:30.915: %LINK-5-CHANGED: Interface Vlan1, changed state to
administratively down
Switch# copy BASE.CFG running-config
Destination filename [running-config]?
184 bytes copied in 0.310 secs (594 bytes/sec)
Configure basic switch parameters.

Configure an IP address on the management VLAN according to the diagram. VLAN 1 is the default
management VLAN, but following best practice, we will use a different VLAN. In this case, VLAN 99.
Enter basic configuration commands on each switch according to the diagram.
DLS1 example:
DLS1# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
DLS1(config)# interface vlan 99
DLS1(config-if)# ip address 172.16.99.1 255.255.255.0
DLS1(config-if)# no shutdown
The interface VLAN 99 will not come up immediately, because the Layer 2 instance of the VLAN does not yet
exist. This issue will be remedied in subsequent steps
(Optional) On each switch, create an enable secret password and configure the VTY lines to allow remote
access from other network devices.
DLS1 example:
DLS1(config)# enable secret class
DLS1(config)# line vty 0 15
DLS1(config-line)# password cisco
DLS1(config-line)# login
Note: The passwords configured here are required for NETLAB compatibility only and are NOT
recommended for use in a live environment.
Note(2): For purely lab environment purposes, it is possible to configure the VTY lines so that they accept any
Telnet connection immediately, without asking for a password, and place the user into the privileged EXEC
mode directly. The configuration would be similar to the following example for DLS1:
DLS1(config)# enable secret class
DLS1(config)# line vty 0 15
DLS1(config-line)# no login
DLS1(config-line)# privilege level 15
a
Configure default gateways on the access layer switches ALS1 and ALS2. The distribution layer switches
will not use a default gateway because they are Layer 3 devices. The access layer switches are Layer 2
devices and need a default gateway to send management VLAN traffic off of the local subnet for the
management VLAN. **The HSRP virtual IP address 172.16.99.5 will be configured in subsequent steps.
ALS1(config)# ip default-gateway 172.16.99.5
*See note above
Page 3 of 19
Step 4: Configure trunks and EtherChannels between switches.

EtherChannel is used for the trunks because it allows you to utilize both Fast Ethernet interfaces that are
available between each device, thereby doubling the bandwidth.
Note: It is good practice to shut down the interfaces on both sides of the link before a port channel is created
and then re-enable them after the port channel is configured.
a
Configure trunks and EtherChannels from DLS1 and DLS2 to the other three switches according to the
diagram. The switchport trunk encapsulation {isl | dot1q} command is used because these switches
also support ISL encapsulation. A sample configuration is provided. Not all of the commands listed below
will be used on all devices. Repeat and reference chapter 2 labs if you still are having difficulty with
implementing trunking between devices.
DLS1(config)# interface range fastEthernet 0/x - x
DLS1(config-if-range)# switchport trunk encapsulation dot1q
DLS1(config-if-range)# switchport mode trunk
DLS1(config-if-range)# channel-group x mode desirable
DLS1(config-if-range)# no shut
Creating a port-channel interface Port-channel x
Note: Repeat configurations on the other three switches.
a. Verify trunking between DLS1, ALS1, and ALS2 using the show interface trunk command on all
switches.
b. Verify the EtherChannel configuration
c.
Which EtherChannel negotiation protocol is in use here?

____________________________________________________________________________________
Step 5: Configure VTP on DLS2, ALS1 and ALS2.

b
Change the VTP mode of ALS1 and ALS2 to client and VTP modes of DLS2 to server. A sample
configuration is provided.
ALS1(config)# vtp mode client
Setting device to VTP CLIENT mode for VLANS.
d. Verify the VTP changes.
Step 6: Configure VTP on DLS1 and create VLANs.

c
Create the VTP domain on VTP server DLS1 and create VLANs 10, 20, 30, 40 and 99 for the domain.
NOTE: Switches default to vtp mode server. However, remember the base configuration modifies this
setting to vtp mode transparent.
DLS1(config)# vtp domain SWLAB
DLS1(config)# vtp version 2
DLS1(config)#vtp mode server
Setting device to VTP Server mode for VLANS
DLS1(config)# vlan
DLS1(config-vlan)#
DLS1(config-vlan)#
DLS1(config-vlan)#
DLS1(config-vlan)#
10
name
vlan
name
vlan
Finance
20
Engineering
30
Page 4 of 19

DLS1(config-vlan)#
DLS1(config-vlan)#
DLS1(config-vlan)#
DLS1(config-vlan)#
DLS1(config-vlan)#
name
vlan
name
vlan
name
Server-Farm1
40
Server-Farm2
99
Management
Verify VLAN propagation across the SWLAB domain.
Step 7: Configure access ports.

d
Configure the host ports of all four switches. The following commands configure the switch port mode as
access, place the port in the proper VLANs, and turn on spanning-tree PortFast for the ports. A sample
configuration is provided for you.
Configure PCs with the IP addresses shown in the topology diagram. Use the address ending in .5 as
the gateway address for the respective VLANs.
DLS2(config)# interface fastEthernet 0/6
DLS2(config-if)# switchport mode access
DLS2(config-if)# switchport access vlan 40
DLS2(config-if)# spanning-tree portfast
DLS2(config-if)# no shutdown
e. Ping from the host on VLAN 10 to the host on VLAN 40. The ping should fail.
Are these results expected at this point? Why?
_______________________________________________________________________________
_______________________________________________________________________________
_______________________________________________________________________________
Note: The switchport host command can be used to configure individual access ports. This command
automatically activates access mode, PortFast, and removes all associations of the physical switch port
with the port-channel interfaces (if there are any).
Step 8: Configure HSRP interfaces and enable routing.

HSRP provides redundancy in the network. The VLANs can be load-balanced by using the standby group
priority priority command. The ip routing command is used on DLS1 and DLS2 to activate routing
capabilities on these Layer 3 switches.
Each route processor can route between the various SVIs configured on its switch. In addition to the real IP
address assigned to each distribution switch SVI, assign a third IP address in each subnet to be used as a
virtual gateway address. HSRP negotiates and determines which switch accepts information forwarded to the
virtual gateway IP address.
The standby command configures the IP address of the virtual gateway, sets the priority for each VLAN, and
configures the router for preempt. Preemption allows the router with the higher priority to become the active
router after a network failure has been resolved. Notice that hsrp is not used in the command syntax to
implement HSRP.
In the following configurations, the priority for VLANs 10, 20, and 99 is 150 on DLS1, making it the active
router for those VLANs. VLANs 30 and 40 have a default priority of 100 on DLS1, making DLS1 the standby
Page 5 of 19

router for these VLANs. DLS2 is configured to be the active router for VLANs 30 and 40 with a priority of 150,
and the standby router for VLANs 10, 20, and 99 with a default priority of 100.
Note: It is recommended that the HSRP group number be mapped to VLAN number.
DLS1(config)# ip routing
DLS1(config)# interface loopback 200
DLS1(config-if)#ip address 209.165.200.254 255.255.255.0
*NOTE: This loopback is used only for the purpose of testing HSRP state
changes. Both DLS1 and DLS2 will have this loopback configured.
DLS1(config-if)# standby 99 ip 172.16 99.5
DLS1(config-if)# standby 99 preempt
DLS1(config-if)# standby 99 priority 110
DLS1(config-if)# exit
DLS1(config-if)# standby 10 ip 172.16.10.5
*NOTE: When the priority command is not present on the L3 interface, the HSRP
priority value defaults to 100.
DLS2(config)# ip routing
DLS1(config)# interface loopback 200
DLS1(config-if)#ip address 209.165.200.254 255.255.255.0
*NOTE: This loopback is used only for the purpose of testing HSRP state
changes. Both DLS1 and DLS2 will have this loopback configured.
Page 6 of 19

From PC-A (VLAN 10) ping the HSRP virtual gateway address of 172.16.10.5.
C:\>ping 172.16.10.5
Pinging 172.16.10.5 with 32 bytes of data:
Reply
Reply
Reply
Reply
from
from
from
from
172.16.10.5:
172.16.10.5:
172.16.10.5:
172.16.10.5:
bytes=32
bytes=32
bytes=32
bytes=32
time=1ms
time<1ms
time=1ms
time<1ms
TTL=127
TTL=127
TTL=127
TTL=127
Ping statistics for 172.16.10.5:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
Now, issue a continuous ping using the t option to the loopback interface 209.165.200.254. The following is
from the Payroll host (VLAN 10) to the 209.165.200.254 destination. This continuous ping will be used to
analyze the loss of connectivity experienced as result HSRP failover demonstration in coming in future steps.
C:\>ping 209.165.200.254 -t
Pinging 209.165.200.254
Reply
Reply
Reply
Reply
from
from
from
from
with 32 bytes of data:
209.165.200.254:
209.165.200.254:
209.165.200.254:
209.165.200.254:
bytes=32
bytes=32
bytes=32
bytes=32
time=1ms
time<1ms
time=1ms
time<1ms
TTL=127
TTL=127
TTL=127
TTL=127

Page 7 of 19

Step 9: Verify the HSRP configuration.

In the output below, the last two digits (XX) in the MAC address (0000.0c07.acXX) correspond with the HSRP
group number. The MAC address is 0000.0c07.ac0a. The last two hexadecimal digits are 0a. These equate to
decimal # 10. Our HSRP configuration is group 10.
a
Issue the show standby command on both DLS1 and DLS2.

DLS1#sh standby
Vlan10 - Group 10
State is Active
2 state changes, last state change 00:10:11
Virtual IP address is 172.16.10.5
Active virtual MAC address is 0000.0c07.ac0a <Local virtual MAC address is 0000.0c07.ac0a (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 1.872 secs
Preemption enabled
Active router is local
Standby router is 172.16.10.2, priority 100 (expires in 10.864 sec)
Priority 150 (configured 150)
Here is the priority value we used in the configuration.
Group name is "hsrp-Vl10-10" (default)
Vlan20 - Group 20
State is Active
Active virtual MAC address is 0000.0c07.ac14
Local virtual MAC address is 0000.0c07.ac14 (v1 default)
Preemption enabled
Vlan30 - Group 30
State is Standby
Active virtual MAC address is 0000.0c07.ac1e
Local virtual MAC address is 0000.0c07.ac1e (v1 default)
Preemption enabled
Active router is 172.16.30.2, priority 150 (expires in 9.104 sec)
Standby router is local
Priority 100 (default 100)
Vlan40 - Group 40
State is Standby
Page 8 of 19

Preemption disabled
Vlan99 - Group 99
State is Active
Preemption enabled
DLS2#sh stand
Vlan10 - Group 10
State is Standby
1 state change, last state change 00:04:26
Active virtual MAC address is 0000.0c07.ac0a
Local virtual MAC address is 0000.0c07.ac0a (v1 default)
Preemption enabled
Vlan20 - Group 20
State is Standby
Preemption enabled
Vlan30 - Group 30
State is Active
Active virtual MAC address is 0000.0c07.ac1e
Local virtual MAC address is 0000.0c07.ac1e (v1 default)
Page 9 of 19

Preemption enabled
Vlan40 - Group 40
State is Active
Preemption enabled
Vlan99 - Group 99
State is Standby
Preemption enabled
b
Issue the show standby brief command on both DLS1 and DLS2.
DLS1#sh stand bri
Interface
Vl10
Vl20
Vl30
Vl40
Vl99
Grp
10
20
30
40
99
Grp
10
20
30
40
99
indicates configured to preempt.
P
|
P
P
P
P
P
P
Pri
150
150
100
100
150 P
DLS2#sh stand bri

Interface
Vl10
Vl20
Vl30
Vl40
Vl99
P
|
P
P
P
P
Pri
100
100
150
150
100
State
Active
Active
Standby
Standby
Active
State
Standby
Standby
Active
Active
Standby
Active
local
local
172.16.30.2
172.16.40.2
local
Active
172.16.10.1
172.16.20.1
local
local
172.16.99.1
Standby
172.16.10.2
172.16.20.2
local
local
172.16.99.2
Standby
local
local
172.16.30.1
172.16.40.1
local
Virtual IP
172.16.10.5
172.16.20.5
172.16.30.5
172.16.40.5
172.16.99.5
Virtual IP
172.16.10.5
172.16.20.5
172.16.30.5
172.16.40.5
172.16.99.5
Page 10 of 19

Which router is the active router for VLANs 10, 20, and 99? Which is the active router for 30 and 40?
________________________________________________________________________________
________________________________________________________________________________
What is the default hello time for each VLAN? What is the default hold time?
________________________________________________________________________________
________________________________________________________________________________
How is the active HSRP router selected?
____________________________________________________________________________________
____________________________________________________________________________________
f.
Use the show ip route command to verify routing on both DLS1 and DLS2.
DLS1# show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+ - replicated route, % - next hop override
Gateway of last resort is not set
C
L
C
L
C
L
C
L
C
L
172.16.0.0/16 is variably subnetted, 10 subnets, 2 masks

172.16.1.0/24 is directly connected, Vlan1
Step 10: Verify connectivity between VLANs.

Verify connectivity between VLANs using the ping command with a t option from the SQL Server (VLAN 40)
to the other hosts and servers on the network. Keep the ping running to evaluate loss of connectivity that will
occur in Step 11.
The following is from the SQL Server (VLAN 40) to the 209.165.200.254 address.
C:\>ping 209.165.200.254 -t
Pinging 209.165.200.254 with 32 bytes of data:
Reply from 209.165.200.254: bytes=32 time=1ms TTL=127
Page 11 of 19

Reply from 209.165.200.254: bytes=32 time<1ms TTL=127
Reply from 209.165.200.254: bytes=32 time=1ms TTL=127
Reply from 209.165.200.254: bytes=32 time<1ms TTL=127
Step 11: Verify HSRP functionally.

a
Verify HSRP by disconnecting the trunks to DLS2. You can simulate this using the shutdown command
on those interfaces.
DLS2(config)# interface range fastEthernet 0/7 - 12
DLS2(config-if-range)# shutdown
Output to the console at DLS1 should reflect DLS1 becoming the active router for VLANs 30 and 40.
g. Verify that DLS1 is acting as the backup default gateway for VLANs 30 and 40 using the show standby
brief command. DLS1 is now the active HSRP router for all VLANs and the standby router is unknown.
DLS1#sh stand bri
Interface
Vl10
Vl20
Vl30
Vl40
Vl99
Grp
10
20
30
40
99
P
|
P
P
P
P
Pri
150
150
100
100
150 P

State
Active
Active
Active
Active
Active
Active
local
local
local
local
local
Standby
unknown
unknown
unknown
unknown
unknown
Virtual IP
172.16.10.5
172.16.20.5
172.16.30.5
172.16.40.5
172.16.99.5
Repeat this process by bringing up the DLS2 trunks and shutting down the DLS1 interfaces. Use the
show standby brief command to see the results.
Note: If both DLS1 and DLS2 have links to the Internet, failure of either switch will cause HSRP to
redirect packets to the other switch. The functioning switch will take over as the default gateway to
provide virtually uninterrupted connectivity for hosts at the access layer.
Go back to the payroll and SQL clients that we issued the continuous pings on in earlier steps.
The ping should still be running to the 209.165.200.254 destination address. Evaluate the loss of
connectivity the payroll client experienced during the HSRP state change. The users experience minimal
service disruption as a result of the HSRP state change.
Step 12: Apply HSRP authentication using MD5.

Now that we have successfully implemented default gateway redundancy in our network, we should think
about securing the HSRP communication between member devices. HSRP authentication prevents rogue
routers on the network from joining the HSRP group. Without authentication a rogue router could join the
group and claim the active role. The attacker would then be able to capture all the track forwarded to
attackers device. HSRP authentication can be configured using plain text or MD5. MD5 is the preferred
method. Using MD5 key, a hash is calculated on HSRP messages.
DLS1(config)# int vlan 10
DLS1(config-if)# standby 10 authentication ?
Page 12 of 19
WORD
md5
text
Plain text authentication string (8 chars max)

Use MD5 authentication
Plain text authentication
DLS1(config-if)# standby 10 authentication md5 ?

key-chain
Set key chain
key-string Set key string
With MD5 authentication, you can choose between a configuration using the key string or a key chain. Key
chains offer more options and security because you can have lifetime parameters associated with the different
keys. In this lab, we will be configuring HSRP authentication using the key string option.
DLS1(config-if)# standby 10 authentication md5 key-string ?
0
Specifies an UNENCRYPTED key string will follow
7
Specifies a HIDDEN key string will follow
WORD Key string (64 chars max)
DLS1(config-if)# standby 10 authentication md5 key-string cisco123
*Mar 1 22:22:34.315: %HSRP-4-BADAUTH: Bad authentication from 172.16.10.2, group
10, remote state Active
Notice as soon as this command was entered on DLS1 that we received a bad authentication message
display to the console screen. HSRP authentication is not yet configured on DLS2 therefore we expect for the
HSRP process to be disrupted. The output of the show standby brief command below confirms that
DLS2 is no longer the standby router for group 10. The standby router shows unknown.
DLS1# sh stand bri
Interface
Vl10
Vl20
Vl30
Vl40
Vl99
Grp
10
20
30
40
99
P
|
P
P
P
P
Pri
110
110
100
100
110 P

State
Active
Active
Standby
Standby
Active
Active
local
local
172.16.30.2
172.16.40.2
local
Standby
unknown
172.16.20.2
local
local
172.16.99.2
Virtual IP
172.16.10.5
172.16.20.5
172.16.30.5
172.16.40.5
172.16.99.5
Now configure HSRP authentication for interface VLAN 10 on DLS2.

DLS2(config-if)# standby 10 authentication md5 key-string cisco123
*Mar
*Mar
1 22:24:04.165: %HSRP-5-STATECHANGE: Vlan10 Grp 10 state Active -> Speak

1 22:24:14.349: %HSRP-5-STATECHANGE: Vlan10 Grp 10 state Speak -> Standby
Refer to the above output. Once the hsrp authentication with the correct key string were added to DLS2, the
hsrp state changed.
Page 13 of 19

Verify the HSRP status of VLAN 10 on DLS1 and DLS2. DLS1 should be the active router for VLAN 10 while
DLS2 is the standby.
DLS1# sh stand bri
Interface
Vl10
Vl20
Vl30
Vl40
Vl99
Grp
10
20
30
40
99
P
|
P
P
P
P
Pri
110
110
100
100
110 P

State
Active
Active
Standby
Standby
Active
Active
local
local
172.16.30.2
172.16.40.2
local
Standby
172.16.10.2
172.16.20.2
local
local
172.16.99.2
Virtual IP
172.16.10.5
172.16.20.5
172.16.30.5
172.16.40.5
172.16.99.5
Continue configuring HSRP authentication on the remaining HSRP groups used in this lab scenario.
CHALLENGE:
On one of the groups, implement HSRP authentication using a key chain instead of a key string.
Step 12: Configure HSRP interface tracking.

Interface tracking enables the priority of a standby group router to be automatically adjusted, based on the
availability of the router interfaces. When a tracked interface becomes unavailable, the HSRP priority of the
router is decreased. When properly configured, the HSRP tracking features ensures that a router with an
unavailable key interface will relinquish the active router role.
Refer to the network topology, we will track availability to the 209.165.200.254 destination. Loopback 200 is
configured with this destination and is used for testing HSRP interface tracking concepts.
HSRP can perform object and interface tracking. Configure an IP SLA reachability test on DLS1. Also create
an object that tracks this SLA test. HSRP will then be configured to track this object and decrease the priority
by a value that will cause an HSRP state change.
DLS1# conf t
DLS1(config)# ip sla 10
DLS1(config-ip-sla)# icmp-echo 209.165.200.254
DLS1(config-ip-sla-echo)# frequency 5
DLS1(config-ip-sla-echo)# ip sla schedule 10 life forever start-time now
DLS1(config)# track 100 ip sla 10
DLS1(config)# int vlan 10
DLS1(config-if)# standby 10 track 100 decrement 30
Verify SLA configuration using the show ip sla configuration and the show ip sla statistics
command.
Verify HSRP tracking configuration using the show standby command.
Page 14 of 19

To test the HSRP tracked object, shutdown the loopback 200 interface. Notice the messages displayed to
console screen concerning the tracked object 10. More significantly, notice the HSRP state change that
happened as a result of the failure of the SLA test.
DLS1(config)# int lo 200
DLS1(config-if)# shut
*Mar 1 23:29:32.072: %TRACKING-5-STATE: 1 interface Lo200 line-protocol Up->Down
*Mar 1 23:29:34.077: %LINK-5-CHANGED: Interface Loopback200, changed state to
administratively down
*Mar 1 23:29:35.084: %LINEPROTO-5-UPDOWN: Line protocol on Interface
Loopback200, changed state to down
*Mar 1 23:29:43.707: %TRACKING-5-STATE: 100 ip sla 10 state Up->Down
*Mar 1 23:29:46.207: %HSRP-5-STATECHANGE: Vlan10 Grp 10 state Active -> Speak
*Mar 1 23:29:57.691: %HSRP-5-STATECHANGE: Vlan10 Grp 10 state Speak -> Standby
Issue the show standby vlan 10 on DLS1 command to view how the new priority value.
DLS1# sh stand vlan 10
Vlan10 - Group 10
State is Standby
Active virtual MAC address is 0000.0c07.ac0a
Local virtual MAC address is 0000.0c07.ac0a (v1 default)
Authentication MD5, key-string
Preemption enabled
Track object 100 state Down decrement 30
Phase 2: Remove HSRP configurations and Implement VRRP .

Background: Your company is merging with another company that does not have all Cisco devices employed
in their campus network. As a result, you need to change your choice in first hop redundancy protocols from a
proprietary solution to an industry standard solution. In preparation for the next phase of this lab, remove all
HSRP configurations. The commands can be removed by issuing the command no standby x command
on the switched virtual interface (SVI).
In the next phase of this lab, we will use the Virtual Router Redundancy Protocol (VRRP). Virtual Router
Redundancy Protocol (VRRP) is an industry standard protocol that has many similarities to HSRP. HSRP
elects an active and standby router to participate in the HSRP process. VRRP elects a Master and Backup.
Although referred to by different names, the operational concepts of the VRRP master and backup are likened
unto the HSRP active and standby respectively. HSRP operation requires the use of a virtual router IP
address. VRRP also requires the use of a virtual router IP address, but it can use an address in use on the
device. If a device owns the configured IP address, then it automatically assumes the Master role and ignores
the priority value in its role election process. Recall that is what necessary to configure HSRP routers with the
Page 15 of 19

preempt option. VRRP uses preempt by default. The next lab will demonstrate the commands necessary to
run VRRP in a campus switched network.
Step 12: Implement VRRP on DLS1 and DLS2.

Assign the VRRP protocol to the switched virtual interfaces. DLS1 should be the master for VLANs 10, 20,
and 99. DLS2 should be the master for VLANs 30 and 40. The priority values default to 100. A higher
priority is preferred. One of the noteworthy differences in HSRP and VRRP operation is that VRRP virtual ip
address can be set to an IP address that is actually configured and in use on your devices. If you set the
virtual IP address to an IP that is in use, then VRRP ignores the priority values sent in VRRP messages and
automatically chooses the router that owns the IP to be the master.
DLS2(config)# interface Vlan10
DLS2(config-if)# vrrp 10 ip 172.16.10.5
DLS2(config-if)# vrrp 10 priority 150
*Only use the vrrp x priority command on the interfaces in which you desire this switch to be the
master forwarder.
Repeat these commands as necessary to implement vrrp on all SVIs on DLS1 and DLS2 switches.
Verify VRRP operation using the following show commands: show vrrp. Ensure DLS1 is the master for
VLANs 10, 20 and 99 and backup for VLANs 30 and 40. DLS2 should be the master for VLANs 30 and 40
and backup for VLANs 10, 20, and 99.
DLS1# show vrrp
Vlan10 - Group 10
State is Master
Virtual MAC address is 0000.5e00.010a
Advertisement interval is 1.000 sec
Preemption enabled
Priority is 150
Master Router is 172.16.10.1 (local), priority is 150
Master Advertisement interval is 1.000 sec
Master Down interval is 3.414 sec
Vlan20 - Group 20
State is Master
Virtual MAC address is 0000.5e00.0114
Preemption enabled
Priority is 150
Vlan30 - Group 30
State is Backup
Virtual MAC address is 0000.5e00.011e
Page 16 of 19

Preemption enabled
Priority is 100
Master Router is 172.16.30.2, priority is 150
Master Down interval is 3.609 sec (expires in 3.475 sec)
Vlan40 - Group 40
State is Backup
Preemption enabled
Priority is 100
Vlan99 - Group 99
State is Master
Preemption enabled
Priority is 150
View the show vrrp output on DLS2.
DLS2# sh vrrp
Vlan10 - Group 10
State is Backup
Virtual MAC address is 0000.5e00.010a
Preemption enabled
Priority is 100
Vlan20 - Group 20
State is Backup
Preemption enabled
Page 17 of 19

Priority is 100
Vlan30 - Group 30
State is Master
Virtual MAC address is 0000.5e00.011e
Preemption enabled
Priority is 150
Vlan40 - Group 40
State is Master
Preemption enabled
Priority is 150
Vlan99 - Group 99
State is Backup
Preemption enabled
Priority is 100
You can also use the show vrrp brief command to view a summary of the VRRP configuration.
DLS1# show vrrp brief
Interface
Grp
Vl10
10
Vl20
20
Vl30
30
Vl40
40
Vl99
99
Pri
150
150
100
100
150
Time
3414
3414
3609
3609
3414
Own Pre
Y
Y
Y
Y
Y
State
Master
Master
Backup
Backup
Master
Master addr
172.16.10.1
172.16.20.1
172.16.30.2
172.16.40.2
172.16.99.1
Group addr
172.16.10.5
172.16.20.5
172.16.30.5
172.16.40.5
172.16.99.5
DLS2# show vrrp brief
Page 18 of 19

Interface
Vl10
Vl20
Vl30
Vl40
Vl99
Grp
10
20
30
40
99
Pri
100
100
150
150
100
Time
3609
3609
3414
3414
3609
Own Pre
Y
Y
Y
Y
Y
State
Backup
Backup
Master
Master
Backup
Master addr
172.16.10.1
172.16.20.1
172.16.30.2
172.16.40.2
172.16.99.1
Group addr
172.16.10.5
172.16.20.5
172.16.30.5
172.16.40.5
172.16.99.5
Step 12: Configure VRRP tracking.

As you may recall from earlier configurations with HSRP, the HSRP protocol can perform interface tracking
and object tracking. VRRP can only perform object tracking. As with the HSRP scenario, we are using the
simulating connectivity to the 209.165.200.254 address in the cloud. Create an object that tracks the line
protocol status of the interface loopback 200 with this address. Once the object is created, configure VRRP to
track the object and to decrease the priority to a value that would cause a state change between the Master
and Backup devices. Recall that we configured the priority values to 150 on the Master devices. The Backup
devices priority defaults to 100. To cause the state change, we would need to decrease the priority by at least
60. A sample configuration is provided for you below.
DLS1(config)# track 1 interface Loopback 200 line-protocol
DLS1(config-if)# vrrp 99 track 1 decrement 60
CHALLENGE:
Step 13: Alternative option for VRRP configuration
Remove the VRRP commands from the interfaces and implement VRRP using the actual IP addresses
configured on the SVIs.
On DLS1, configure VRRP using the actual IP addresses on interfaces VLAN, 10, 20, and 99 as the virtual
router IP. A sample configuration is provided for you below.
Do not configure the VRRP priority.

On DLS2, use the IP address on interfaces VLAN 30 and 40.

Observe VRRP results. DLS1 should automatically become the Master for VLANs 10, 20, and 99 and
Backup for VLANs 30 and 40.
DLS2 should become the Master for VLANs 30 and 40 and become the backup for VLANs 10, 20, and
99.
Page 19 of 19

Ccnpv7 Switch Lab 6-1 FHRP HSRP VRRP Student

Uploaded by

Copyright:

Available Formats

Ccnpv7 Switch Lab 6-1 FHRP HSRP VRRP Student

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Ccnpv7 Switch Lab 6-1 FHRP HSRP VRRP Student

Uploaded by

Copyright:

Available Formats

CCNPv7 SWITCH

Chapter 6 Lab 6-1, First Hop Redundancy Protocols HSRP and

Configure inter-VLAN routing with HSRP with load balancing

Configure HSRP authentication

Configure HSRP Interface Tracking

Configure VRRP object tracking

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

Ethernet and console cables

4 PCs with Windows OS

Prepare for the Lab

18:41:40.403: %SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram

Would you like to enter the initial configuration dialog? [yes/no]: n

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

Configure basic switch parameters.

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

Step 4: Configure trunks and EtherChannels between switches.

Which EtherChannel negotiation protocol is in use here?

Step 5: Configure VTP on DLS2, ALS1 and ALS2.

d. Verify the VTP changes.

Step 6: Configure VTP on DLS1 and create VLANs.

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

Verify VLAN propagation across the SWLAB domain.

Step 7: Configure access ports.

Step 8: Configure HSRP interfaces and enable routing.

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

Ping statistics for 172.16.10.5:

with 32 bytes of data:

Ping statistics for 209.165.200.254:

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

Step 9: Verify the HSRP configuration.

Issue the show standby command on both DLS1 and DLS2.

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

indicates configured to preempt.

indicates configured to preempt.

DLS2#sh stand bri

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

172.16.0.0/16 is variably subnetted, 10 subnets, 2 masks

Step 10: Verify connectivity between VLANs.

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

Step 11: Verify HSRP functionally.

indicates configured to preempt.

Step 12: Apply HSRP authentication using MD5.

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

Plain text authentication string (8 chars max)

DLS1(config-if)# standby 10 authentication md5 ?

indicates configured to preempt.

Now configure HSRP authentication for interface VLAN 10 on DLS2.

1 22:24:04.165: %HSRP-5-STATECHANGE: Vlan10 Grp 10 state Active -> Speak

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

indicates configured to preempt.

Step 12: Configure HSRP interface tracking.

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

Phase 2: Remove HSRP configurations and Implement VRRP .

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

Step 12: Implement VRRP on DLS1 and DLS2.

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)

Chapter 6 Lab 6-1, First Hop Redundancy Protocols (HSRP, VRRP)