HSRP and ARP tables

[sknorr]

I have a question about ARP and HSRP traffic. Here's the situation. I have 2 6509's with MSFC's running HSRP for about 60 VLANs. All users are using the virtual IP as their gateway. On one of the segments we have an AS/400. Every night the AS/400 is brought down for maintence and backups. Sometimes it's down for over 4hrs. This causes it to be removed from the arp tables on the MSFC's. When they bring this back on-line I only see an ARP entry in one of the 6509's. I can't get an ARP entry to show up on the second unless I ping from the router interface on that segment. If I ping from any other VLAN it timesout.

Do redundant HSRP routers syncronze their ARP tables?

Why wouldn't a ping from another VLAN force an arp request to be sent from that router?

[mark-obrien]

The easy one first - HSRP routers do not synchronize their ARP tables.

As for the ping request from another VLAN forcing an ARP request, I am assuming that you are having the secondary router ping the AS/400 using the address of another VLAN as the source address. In this case, I suspect that an ARP request is being sent, and either no reply is received or the echo response is sent to the primary router, and the primary router may not have a path on the originating VLAN to the secondary router. Your description makes it obvious that there is a connection between the two 6509s, and this connection can carry the VLAN on which the AS/400 resides. Is this connection between the switches set up as a trunk cabable of carrying all of your VLANs? Also, after the ping attempt from another VLAN, does the MSFC have an ARP entry for the AS/400, even though the ping was not successful?

Good luck.

Mark

[efrahim]

regarding your second question, the arp request may be going out but not getting back, you have to snif it or run the debug if there are not many arp going on the router.. to see if the responce from the server is getting back..

Also check the encapsulation of the frame- what types of encap it is - arpa or something else.

[lgijssel]

One important thing to keep in mind is that ARP tables are local to a device. When a request comes in, and there is no entry, an ARP is sent on the corresponding LAN segment. Your AS400 presumably also has the HSRP adress as def. gw. Its reply will therefore always be sent to the active interface in the standby group. That is why you only see an ARP entry in one 6509. At the moment of a failure, the second one will take over and very quickly have an ARP entry for the AS400.

When you ping from the interface, you are using the local IP adress. This adress is in the same subnet, hence it does not go to the def.gw. and you get your ARP entry. This is all perfectly logical.

What do you mean with: If I ping from any other VLAN it timesout?

Is there no reply to the ping packets? Or does the entry time out? I suppose that you mean the first. This points to a potential problem in your IP routing config. To pinpoint it, more specific info will be needed.

[sknorr]

Odd # VLANs use 6509A as active and even #VLANs use 6509B. The ARP entry is on 6509A but not on 6509B. This is why when I ping from any even # VLANs it timesout.

Why wouldn't the ARP entry show up in 6509B if the requests are coming from an Odd # VLAN? This entry should be in both 6509s?

[henrybb]

>Your AS400 presumably also has the HSRP adress as def. gw. Its reply will >therefore always be sent to the active interface in the standby group. That is

> why you only see an ARP entry in one 6509. At the moment of a failure, the >second one will take over and very quickly have an ARP entry for the AS400.

>When you ping from the interface, you are using the local IP adress. This >adress is in the same subnet, hence it does not go to the def.gw. and you >get your ARP entry.

I think there are not relationship between arp and def. gw. You ping AS/400 from any interfaces,the arp request has same source(AS/400's router interface) and destionation(AS/400) ip address.

If you ping from other interface,I think packet will routing first,then arp.