Catalyst 3550 & HSRP v2

[giovanni.augusto]

Hi,

I am testing on lab equipment (2 Catalyst 3550 and 1 Catalyst 3560) HSRP version 1 and 2.

I successfully created a load balancing between the two Catalyst 3550 on a couple of vlans (11 and 12) on ver 1

now, just adding the command "standby xx version 2" my hosts on the 2 vlans are completely unable to ping the virtual IP def. gw

on debugging i checked that

• hello msgs are exchanged
  
• the two cat 3550 are seeing each other on HSRP (active / standby roles)
  
• the real ip addresses are pingable
  
• rebooted the swiches (just as a last resort try)
  
• deleted arp chache on hosts
  
• removed the auth on hsrp
  

all of this no effect...

i also tried to modify the priority on the cat 3560 (before he was on both vlans in standby) to make it the active one and with the same config it worked flawlessly...

My only idea is that there is a bug on CATs 3550 (IOS: c3550-ipservicesk9-mz.122-55.SE4.bin)

configs:

SW-3550-A

interface Vlan11

ip address 12.0.0.2 255.255.255.0

standby version 2

standby 11 ip 12.0.0.1

standby 11 priority 150

standby 11 preempt

standby 11 authentication md5 key-string LAB

SW-3550-B

interface Vlan11
ip address 12.0.0.3 255.255.255.0
standby version 2
standby 11 ip 12.0.0.1
standby 11 preempt
standby 11 authentication md5 key-string LAB

SW-3550-A#sh standby

Vlan11 - Group 11 (version 2)

State is Active

16 state changes, last state change 00:18:08

Virtual IP address is 12.0.0.1

Active virtual MAC address is 0000.0c9f.f00b

Local virtual MAC address is 0000.0c9f.f00b (v2 default)

Hello time 3 sec, hold time 10 sec

Next hello sent in 2.560 secs

Authentication MD5, key-string

Preemption enabled

Active router is local

Standby router is 12.0.0.3, priority 100 (expires in 8.976 sec)

Priority 150 (configured 150)

Group name is "hsrp-Vl11-11" (default)

SW-3550-B#sh standby

Vlan11 - Group 11 (version 2)

State is Standby

10 state changes, last state change 00:17:18

Virtual IP address is 12.0.0.1

Active virtual MAC address is 0000.0c9f.f00b

Local virtual MAC address is 0000.0c9f.f00b (v2 default)

Hello time 3 sec, hold time 10 sec

Next hello sent in 2.208 secs

Authentication MD5, key-string

Preemption enabled

Active router is 12.0.0.2, priority 150 (expires in 9.616 sec)

MAC address is 000a.8a28.ea80

Standby router is local

Priority 100 (default 100)

Group name is "hsrp-Vl11-11" (default)

Any suggestion is appreciatedd and...thank you all in advance!

[rsimoni]

Ciao Giovanni,

can you please check whether in your cat3550's other hsrp groups on range above 0-255 exist?

I am asking as on this platform there is a limitation related to hsrpv2 groups which gives this exact symptom if not taken care of.

–When configuring group numbers for HSRPv2 and HSRP for IPv6, you must use group numbers in ranges that are multiples of 256. Valid ranges are 0 to 255, 256 to 511, 512 to 767, 3840 to 4095, and so on.

Examples of valid and invalid group numbers:

If you configure groups with the numbers 2, 150, and 225, you cannot configure another group with the number 3850. It is not in the range of 0 to 255.

If you configure groups with the numbers 520, 600, and 700, you cannot configure another group with the number 900. It is not in the range of 512 to 767.

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750e_3560e/software/release/12.2_52_se/configuration/guide/swhsrp.html#wp1051422

Message was edited by: Riccardo Simoni

[Peter Paluch]

Hi Riccardo,

Wow, you always bring out a jewel of knowledge to the day's light +5 for that!

I wonder, what is the technical reason behind this limitation? I do not remember software-based platforms exhibiting a similar issue.

Best regards,

Peter

[giovanni.augusto]

Thank you for your answer,

i have tried with groups 1 & 2 and 11 & 12

VLAN	GRP	SW-3550-A	SW-3550-B
11	11	ACTIVE	STANDBY
12	12	STANDBY	ACTIVE

VLAN	GRP	SW-3550-A	SW-3550-B
11	1	ACTIVE	STANDBY
12	2	STANDBY	ACTIVE

I also tried to have just 1 group (1 or 11) and avoid a load-balance on hosts: same results.

UPDATE:

• Tried with a couple of 1841: everything is working fine
  
• tried changing 3550s hsrpv2 groups to higher values (like 1111 & 1112 instead of 1 & 2) : no way
  

still on the idea that is a 3550s bug...

[rsimoni]

Ciao Giovanni,

what I mean is that NO OTHER hrsp group must exist (outside the range) in the config at all. Have you checked that too?

Also I'd better mention that only one FHRP protocol can be configured on the c35x0 / c37x0 at any given time. i.e you can't have HSRPv1 configured on one L3 interface and HSRPv2 on the same or another L3 interface.

@Peter: thank you  It is a hw limitation specific to the DSBU switches but actually I don't recall the exact details  behind it. I should dig into that to know more. Probably will do that as soon as I have some time.

Riccardo

[giovanni.augusto]

Ciao,

I configured only HSRPv2 on the two 3550s and i have a really simple config without any other L3 interfaces running any VRRP or HSRPv1

Also, about the group ranges, i wanted to try that out of other ideas.

Hosts are receiving the HSRPv2 virtual mac address but it seems like the switches are not answering back on L2 frames received on the Virtual mac address.

i was running MST on the SWs and i thought it could have been something related to the spanning-tree, so i removed also MST and instead i applied RST, checking also for the appropriate VLANs RB and if any pruning was in place, result: still ok with HSRPv1 and ko with HSRPv2

Also, my two 3550 are connected by a Fa0/1, and from the standby SW i can't ping the Virtual IP on the active one, so it's not related to hosts only and, also CAM shows that the appropriate MAC is mapped on the port, also multicasts are received correctly (in fact the two SWs agree on the Standby/Active) and packets are exchanged.

Also trying to separate the two 3550 and make each one and independent Active router doesn't help, attached hosts are not receiving any reply from a ping while still receiving the correct MAC address for the Virtual Gateway.

Ok, almost white flag resigning on a IOS / ASIC bug...

[robertdrake75]

Hi Giovanni,

I just experienced the same condition this evening!  I have (2) 3550 SMI switches running

IPSERVICESK9-M), Version 12.2(44)SE6 and was configuring up a simple 4 switch lab for HSRP when I noticed that I couldn't ping the virtual IPs from outside the active switch.  I spent at least an hour verifying my commands, the status of my HSRP groups, and checking the debug logs which indicated everything was normal.

As soon as I changed my groups to V1, they worked perfectly.

I'm pretty confident suggesting there is a problem with the HSRP code for the 3550 switches at this point.

[ilevenson]

Wow, I wasn't as quick as you to try and change versions, in fact, I didn't downgrade to v.1 until I read this post.  By the way, once I switched versions everything worked!!! I would feel safe saying there is an issue with the code as well. thanks for all your help, I had been looking at this for a couple of days...doubting my config of course.

[ssambourg]

Hello,

I have the same issue when configuring one SVI with HSRP v2 group 999 and another one with HSRP v2 group 123.

Go back to HSRP v1 or try to have groups number in a range that are multiple of 256.

HSRP v1 solved the issue (range of 256 group number).

HSRP v2 with group numbers in the same 256 multiple range works fine !

Thanks rsimoni !

[giovanni.augusto]

Thank you guys,

We can state clearly that HSRPv2 on Catalyst 3550 has issues, moving on HSRPv1 works fine.

Hope this topic can help other people out there

Ciao ! e a presto

[robert.gowens]

Hi

Just adding another confirmation of the problem. I have two 3550s, both with c3550-ipservicesk9-mz.122-44.SE6.bin, and HSRP version 2 does not work. Symptoms are as mentioned, the virtual IP is unreachable except from the active switch itself.

Switching to version 1 solves the problem.

[glen.grant]

  If there is an issue with the 3550 it won't be fixed as those devices are "EOL/end of support" . 

[j-marenda]

After removing all HSRP groups from mv 3550,  also 12.2(44)SE6

(just one svi and one routed "no switchport" interface) and trying to

configure "no standby version 2" or "standby version 1" on either,

i get the message

% Warning: Current config does not permit HSRP version 1.

and no configuration change.

So do i really need to write a static new config.text and reload the device

to get rid of the broken hsrp version 2 ?

Thank you for advice,

Juergen.