It’s been five years since I started this blog! Time flies and a lot has happened since. Thanks for being along for the ride. What better way to celebrate than a blog post?
This post is going to be short and to the point.
Many of us run HSRP or VRRP. It is quite common to run it in a topology where you have dual routers and dual exits to the WAN and you don’t want to black hole your traffic.
One traditional way of achieving this is by tracking the interface that goes towards the WAN. There are a couple of drawbacks to this approach though:
- You may not get link down on failure (connecting to switch)
- You may experience an error that does not produce link down event
The next option is to use IP SLA that sends ICMP Echo towards the next-hop of the WAN or some destination further into the network. Ehanced Object Tracking (EOT) can then be used to create a track object that decrements the priority of the HSRP active router when the ICMP Echo probe fails. This works better but there are still some drawbacks to this approach:
- Frequency can’t be set to lower than one second
- There is no multiplier, one failed ping is enough which can lead to false positives
- False positives will lead to the state changing more than necessary
- The above can be solved by using a delay for the tracking object
- Using IP SLA is likely more CPU intensive than using BFD
Unfortunately there is no way to directly configure HSRP to check the status of BFD running on your WAN interface. That does not mean we can’t solve the task at hand though. BFD is supported over static routes. What if we insert a dummy route into the RIB when BFD is running successfully over the WAN link and track that this route is installed into the RIB. If it is not installed it must mean that BFD has failed and that the HSRP priority of the active router should be decremented.
The configuration is quite simple. In my lab I have an ISP router with the following config:
interface GigabitEthernet1.100
encapsulation dot1Q 100
ip address 10.0.0.1 255.255.255.252
bfd interval 500 min_rx 500 multiplier 3!
router bgp 1
bgp log-neighbor-changes
network 1.1.1.1 mask 255.255.255.255
neighbor 10.0.0.2 remote-as 2
neighbor 10.0.0.2 fall-over bfd
I’m using BGP in this case to have BFD packets sent over the link. There needs to be a protocol registered with BFD for the packets to be sent. It would be more likely for the ISP to configure a static route using BFD as well. If you are already running BGP, this configuration may be overkill since you could track routes coming from BGP.
This is then the configuration of the active HSRP router:
track 1 ip route 169.254.0.0 255.255.0.0 reachability
!
interface GigabitEthernet1
no ip address
negotiation auto
!
interface GigabitEthernet1.100
encapsulation dot1Q 100
ip address 10.0.0.2 255.255.255.252
bfd interval 500 min_rx 500 multiplier 3
!
interface GigabitEthernet1.200
encapsulation dot1Q 200
ip address 10.0.10.2 255.255.255.0
standby 1 ip 10.0.10.1
standby 1 priority 110
standby 1 preempt
standby 1 track 1 decrement 11
!
router bgp 2
bgp log-neighbor-changes
neighbor 10.0.0.1 remote-as 1
neighbor 10.0.0.1 fall-over bfd
!
ip route static bfd GigabitEthernet1.100 10.0.0.1
ip route 169.254.0.0 255.255.0.0 GigabitEthernet1.100 10.0.0.1
To trigger the BFD packets being sent over the WAN link we first have a static route pointing out the egress interface and the next-hop.
ip route static bfd GigabitEthernet1.100 10.0.0.1
Then we put a standard IP route statement which will insert the dummy route. It is important to point out the egress interface though for single-hop BFD.
ip route 169.254.0.0 255.255.0.0 GigabitEthernet1.100 10.0.0.1
EOT is used to track if the route is installed into the RIB or not.
track 1 ip route 169.254.0.0 255.255.0.0 reachability
The HSRP priority is decremented if the route is not in the RIB which will make the standby router become active.
standby 1 track 1 decrement 11
We can then test if it works by shutting down the interface on the ISP router.
ISP1(config)#int gi1
ISP1(config-if)#shut
ISP1(config-if)#
The change in the RIB is detected by the HSRP active router:
*Jul 29 15:57:23.278: %TRACK-6-STATE: 1 ip route 169.254.0.0/16 reachability Up -> Down
*Jul 29 15:57:24.872: %HSRP-5-STATECHANGE: GigabitEthernet1.200 Grp 1 state Active -> Speak
*Jul 29 15:57:36.582: %HSRP-5-STATECHANGE: GigabitEthernet1.200 Grp 1 state Speak -> Standby
The standby router takes over:
*Jul 29 15:57:24.872: %HSRP-5-STATECHANGE: GigabitEthernet1.200 Grp 1 state Standby -> Active
What are the advantages of this setup compared to IP SLA?
- Lightweight protocol designed to test reachability
- Can send packets faster than one second in between each
- Can define what multiplier to use
The drawback may be that you have to get your ISP to run BFD and that they need to put a static route in on their side as well. This can be a real route or a dummy route though.
Hopefully this post was somewhat useful and you’ll stay with me for another five years. Thanks for reading!