Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

HSRP secondary always responding in VPC.

Hi

I have a scenario where the secondary HSRP router is always responding as the gateway for devices on that VLAN that is part of a VPC. The device is attached to a dual homed Fex2K. The device itself is just a PC that is pinging and tracerouting off the local LAN/

I have tried with and without the peer-gateway command, but, in both scenarios, the secondary device will always respond as the gateway.

I have also tried the peer-switch command on and off (have made sure the ST priority for that VLAN is the same on both), I have tried making one switch the root bridge, I have tried shutting down and then re-enabling the port from the fex that connects to the secondary 5K, I have also tried dual active exclude, still no luck.

Does anyone have any suggestions? NXoS is 5.2(1)N1(4).

Many thanks


Anthony

Everyone's tags (4)
1 ACCEPTED SOLUTION

Accepted Solutions
VIP Super Bronze

HSRP secondary always responding in VPC.

Hi Anthony,

What happens if you shut the svi for that vlan on the secondary 5k? Does it take the primary or traffic goes nowhere?

Also can you post "sh hsrp vlan xxx" and "sh run int vlan xxx" from both primary and secondary?

Reza

7 REPLIES
VIP Super Bronze

HSRP secondary always responding in VPC.

Hi,

Does the active HSRP 5k match with the primary vPC switch?

Usually, you want your primary vPC domain 5k to be the root and the active HSRP.

hth

New Member

HSRP secondary always responding in VPC.

Hi Reza

Yes, both are primaries of their respective roles: See below:

NYOCORESW01# show vpc br
Legend:
                (*) - local vPC is down, forwarding via vPC peer-link

vPC domain id                     : 21
Peer status                       : peer adjacency formed ok
vPC keep-alive status             : peer is alive
Configuration consistency status  : success
Per-vlan consistency status       : success
Type-2 consistency status         : success
vPC role                          : primary
Number of vPCs configured         : 698
Peer Gateway                      : Enabled
Peer gateway excluded VLANs     : -
Dual-active excluded VLANs        : 901
Graceful Consistency Check        : Enabled
Auto-recovery status              : Enabled (timeout = 240 seconds)

NYOCORESW01# show hsrp br

                     P indicates configured to preempt.

                     |

Interface   Grp Prio P State    Active addr      Standby addr     Group addr

Vlan20      1   105  P Active   local            10.96.20.251     10.96.20.254    (conf)

Vlan30      1   105  P Active   local            10.96.31.251     10.96.31.254    (conf)

Vlan40      1   105  P Active   local            10.96.40.251     10.96.40.254    (conf)

Vlan50      1   105  P Active   local            10.96.51.251     10.96.51.254    (conf)

Vlan90      1   105  P Active   local            10.96.90.251     10.96.90.254    (conf)

Vlan219     1   105  P Active   local            10.96.219.251    10.96.219.254   (conf)

Vlan901     1   105  P Active   local            10.96.254.123    10.96.254.126   (conf)

Both outputs are from the primary switch

Thanks


Anthony

VIP Super Bronze

HSRP secondary always responding in VPC.

Hi Anthony,

What happens if you shut the svi for that vlan on the secondary 5k? Does it take the primary or traffic goes nowhere?

Also can you post "sh hsrp vlan xxx" and "sh run int vlan xxx" from both primary and secondary?

Reza

New Member

Re: HSRP secondary always responding in VPC.

Hi

If I shut it down, it goes via the primary and the device I had pinging constantly dropped 1 packet. Once I brought the interface back up it started responding for this device again. It's almost as if it is in a split brain scenario, but not causing issues other than sub-optimal routing.

I've attached the VPC config as well, just in case that is of use.

Thanks for looking

CORESW01# show run int vlan 30

version 5.2(1)N1(4)

interface Vlan30
  no shutdown
  mtu 9216
  description DESKTOP_30
  no ip redirects
  ip address 10.96.31.252/23
  ip router ospf 1 area 0.0.0.96
  ip pim sparse-mode
  hsrp 1
    preempt delay minimum 300
    priority 105
    ip 10.96.31.254
  ip dhcp relay address 10.100.110.4

CORESW02(config)# show run int vlan 30

version 5.2(1)N1(4)

interface Vlan30
  no shutdown
  mtu 9216
  description DESKTOP_30
  no ip redirects
  ip address 10.96.31.251/23
  ip router ospf 1 area 0.0.0.96
  ip pim sparse-mode
  hsrp 1
    priority 95
    ip 10.96.31.254
  ip dhcp relay address 10.100.110.4

CORESW01#show run vpc

version 5.2(1)N1(4)
feature vpc

vpc domain 21
  role priority 4000
  system-priority 4000
  peer-keepalive destination 10.96.255.129 source 10.96.255.130 vrf default
  delay restore 120
  dual-active exclude interface-vlan 901
  peer-gateway
  auto-recovery

CORESW02# show run vpc

version 5.2(1)N1(4)
feature vpc

vpc domain 21
  role priority 8000
  system-priority 4000
  peer-keepalive destination 10.96.255.130 source 10.96.255.129 vrf default
  delay restore 120
  dual-active exclude interface-vlan 901
  peer-gateway
  auto-recovery

VIP Super Bronze

Re: HSRP secondary always responding in VPC.

Hi,

your config looks good and the vPC domain config also looks good.

Can you post "sh hsrp vlan 30" from both switches?

Also, just a hint, if you use HSRP ver 2, the group number can go up to 4094 versus the HSRP ver 1 is only 255.

So, for example: if you have a vlan id of 395, you can match the HSRP group with your vlan id.

see example:

interface Vlan395

  no ip redirects

  ip address 192.168.46.131/27

  no ipv6 redirects

  hsrp version 2

  hsrp 395

    priority 110

    ip 192.168.46.129

    no shutdown

HTH

New Member

Re: HSRP secondary always responding in VPC.

Thanks Reza

See below. Aware of that with the HSRP standby groups. Just wasnt aware there was any real benefit?

Given that these are dual homed fex, and that the peer link will not be forwarding requests to vlan 30 .254 address over itself, is it just by nature that it has to be responded by the secondary switch if the fex is forwarding the traffic to the second switch at L2 rather than the first?

CORESW01# show hsrp interf vlan 30

Vlan30 - Group 1 (HSRP-V1) (IPv4)

  Local state is Active, priority 105 (Cfged 105), may preempt

    Forwarding threshold(for vPC), lower: 1 upper: 105

  Preemption Delay (Seconds) Minimum:300

  Hellotime 3 sec, holdtime 10 sec

  Next hello sent in 2.577000 sec(s)

  Virtual IP address is 10.96.31.254 (Cfged)

  Active router is local

  Standby router is 10.96.31.251 , priority 95 expires in 8.810000 sec(s)

  Authentication text "cisco"

  Virtual mac address is 0000.0c07.ac01 (Default MAC)

  5 state changes, last state change 01:40:38

  IP redundancy name is hsrp-Vlan30-1 (default)

CORESW02#  show hsrp interf vlan 30

Vlan30 - Group 1 (HSRP-V1) (IPv4)

  Local state is Standby, priority 95 (Cfged 95)

    Forwarding threshold(for vPC), lower: 1 upper: 95

  Hellotime 3 sec, holdtime 10 sec

  Next hello sent in 0.241000 sec(s)

  Virtual IP address is 10.96.31.254 (Cfged)

  Active router is 10.96.31.252, priority 105 expires in 7.410000 sec(s)

  Standby router is local

  Authentication text "cisco"

  Virtual mac address is 0000.0c07.ac01 (Default MAC)

  11 state changes, last state change 01:15:34

  IP redundancy name is hsrp-Vlan30-1 (default)

VIP Super Bronze

HSRP secondary always responding in VPC.

So, the FEXs are connected to 2 different 5ks using a vPC and the PC is connected to the host.

Now, when the PC sends a packet, the FEX run its hash algorithm to choose one uplink to carry the flow, and so in this case since there is only one PC, it will always take the same path and if that patch is towards the secondary 5k, than that is why you always see it going through that switch.  You can test this by disconnecting the uplink that connects the FEX to the secondary switch. Or if you put 2 PCs on the same FEX, you should see that one PC is hitting the primary and the other PC is hitting the secondary.

HTH 

676
Views
0
Helpful
7
Replies
CreatePlease to create content