Hi Victor,

This is the case with the addressing. His ASA HSRP VIP is on the same subnet as my router's HSRP address. We are pointing outbound traffic with static rotues to his VIP address. The same case is for the vendor. Can you kindly give a brief config example of what this would look like from the company primary and secondary routers? Would I use floating statics on the secondary? If not what would you suggest?

Kind Regards,

Brandon

Hey, brandon:

Im a bit confused. It seems like this set up is already in place, but then you ask about what the configs on your routers should look like....

Anyway, yes, you're right. A static on primary and a floating static on the secondary, both redistributed back to your core.

Hi Lamav,

This is way it is setup, but when the vendor test failover it doesn't seem to work. Perhaps I need to re-check the HSRP config on the routers. I'll see about posting the HSRP congigs.

Thanks

Yes, well, thats exactly the point. If you're pointing traffic to the vendor's HSRP VIP, why would you care about anything happening on the vendor side? The vendor's failover will be transparent to you.

That goes back to what I was saying about tracking. What does tracking buy you? No matter what, the address you send traffic to will never change.

So on the HSRP tracking my question is from a routing table topology perspective how does the path in the routing table know to change from primary to secondary if a failover happens on the vendor side. The statics will still be redistributed into the table from the primary, but how does when the failover occurs does the secondary router install the routes and start using the floating statics? I hope I am making sense.

Thanks,

Brandon

Brandon:

Maybe I am missing something....

If the vendor fails over to a secondary path, why should you want to change the route that your company takes to get to them?

If you're forwarding traffic to their ASA's VIP (by the way, before I was typing "ASA HSRP VIP" by mistake - ASAs do not run HSRP. I meant its failover VIP), then that should be enough. Whichever ASA is processing the incoming traffic will forward it accordingly within the vendor's domain.

Am I not understanding something?

Is the vendor telling you that you MUST failover to your secondary router if they failover to their secondary ASA for stateful connection purposes?

Hi Lamav,

I think you pretty much have the understanding. What I am not understanding is on the secondary router if I am using floating statics to the vendor ASA VIP address, how will that secondary router (and most importantly network traffic on the company side) know to use the secondary router path to reach the vendor network(s)?

Thanks,

Brandon

Brandon:

Lets walk through this step by step.

R1 advertises a static route to the vendor network back to the company's core.

All router's in the eigrp routing domain will receive that route.

R2 will redistribute a comparable static route to the vendor's network, but with an AD of 220.

All routers in the eigrp domain will receive that route, but will NOT place it in the routing table because R1's static has a lower AD.

If R1 fails, or R1's vendor-facing interface fails or goes "down," it will lose its next hop to the vendor network.

R1 will then withdraw the route from its routing table and NOT redistirbute it back to the core. Therefore, the only route left to the vendor network is R2s route, and therefore, company traffic will be forwarded to R2.

Keep in mind that the ONLY time your company would need to forward traffic to R2 is if R1s route to the vendor ceases to exist, otherwise there is no reason why R1 should have a healthy route to the vendor, but nonetheless force a failover to R2.

I think I am starting understanding this now?

So for the configuration you have seen our "the company side" looks like it is already setup properly?

Thanks,

Brandon

So the interface on the primary company router will have to do down/down or can it be up/down in order for the healthy routes advertised by the primary to go away from the table forcing the floating statics from the secondary to be injected?

Thanks,

Brandon

Brandon:

Once the exit interface, and therefore the next hop, for a route is no longer available (up/down, down/down), the route is removed from the routing table.

This may be the question I was looking to have answered that started this post?

So even though the company primary router (outside interface) is connected to a switch it will still be able to go up/down or down/down when a failover on the vendor side occurs?

I think this is the question/answer I am after?

Thanks,

Brandon

Hi Lamav,

See attached for HSRP config. Tell me what you think.

Thanks,

Brandon