Unanswered Question
Oct 13th, 2003
User Badges:

I have a 3660 and a 2610 which I intend to use in a HSRP group for a redundant default gateway.

The two routers are connected to a 3512 switch which does VLAN and so both routers only have one interface, the one connected to the switch.

There are 3 VLANs. One for my internal network, one for the DMZ and one for the Internet. I have one public IP address, and my default gateway on the Internet is

When using only the 3660 or the 2610 and when set up without HSRP, everything works just fine, I can ping the default gateway and everything.

But when I enable HSRP it all stop working. The routers use the address and respectively and are set to create a virtual router with the address of on the internal network. This works just fine. On the DMZ it works great as well.

But on the external interface towards the internet it does not work fine.

Since I only have one external IP adress I use a few private ones, okay this is not a very nice solution but hey, what choice do I have? Here's the configuration for the external interface


interface FastEthernet 0/0.25

ip address

standby 13 ip

standby 13 priority 110


interface Ethernet 0/0.25

ip address

standby 13 ip

standby 13 priority 100

Both routers can ping each other on the external interface, but neither can ping When doing a show standby FastEthernet 0/0.25 everything shows up just fine, and is set as active ip. Though when looking in the arp cache does not show up, so I configured it statically. It made no difference.

What do I do next?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
mark-obrien Mon, 10/13/2003 - 04:40
User Badges:
  • Bronze, 100 points or more

The problem is that your standby address is in a different subnet than your interface addresses. You will need three public addresses in order to make HSRP work on your outside network.


Ladislaus Mon, 10/13/2003 - 07:38
User Badges:

okey... uhm, but why? ;)

the way I understood the active router never actually communicates with the standby router through the active adress but via the address assigned to the interface, that is in my case and .2

Anyway, this was actually something which I suspected quite early on. And so I tried using two public IP adresses.

I assigned to the 2610 and to the 3660 and lastly to the virtual router.

This didn't work either.

When I use an IP which does not "belong" to me I cannot ping my default gateway ( But this should have no impact, should it? The routers ought to just communicate among themselves, right?

I seem to have missed a bit on the inner workings of HSRP.

thisisshanky Mon, 10/13/2003 - 07:52
User Badges:
  • Purple, 4500 points or more


Scenario 1:

Reason why you cannot use a different subnet for the virtual IP, is that the router doesnt know how to reach that subnet. When you assign and .2 to the physical interface, the router knows that its ethernet interface is attached to network.

But when you assign network to the virtual IP, it doesnt know that to reach this network, it has to use ethernet interface.

Scenario 2:

What was the status of HSRP, when you configured the virtual Ip and physical IP from the same subnet (, 217 and 219) ?

Give a show standby and see if one has become active and the other has become standby.

Also see if you can ping from .218 to .219 or vice versa.

Ladislaus Mon, 10/13/2003 - 09:31
User Badges:

On the 3660 (which had higher priority) it showed that it was active and had assigned as IP for the virtual router.

I could ping .218 and .219 from each other.

Well, I'm getting another 4 public IP addresses in a week or so, guess I'll be able to solve it then..

thisisshanky Mon, 10/13/2003 - 09:47
User Badges:
  • Purple, 4500 points or more

So what happens, when you try to ping

Is it still not pinging ? Have you configured any accesslist on the device ? What device is it ? Is it under your administration ? Give a show arp on the 3660 and see what mac address you see for the ip address (7.1)


This Discussion