Routing to Vendor network and tracking interface failure

[mbroberson1]

Please see attached diagram for more details.

Senario:

You have a connection to vendor/business partner. You have two connections to this business partner. You are runing EIGRP on your internal network and with your routers and core switches. You don't know and don't care what IGP's the vendor is running. They are most likely doing statics. The vendor has two circuits from their routers to their network. If one of the vendors circuits goes down their equipment will failover to using their seconday circuit and equipment.

NOW the BIG question:

How can you configure your company primary router to notice when the vendor primary fails over and instruct your secondary router to take over as the primary path to the vendor network. Your company routers are using HSRP over a L2 link and the primary has static routes pointing to the failover ASA HSRP address of the Vendors ASAs.

I think you will have to do some sort of interface tracking, but not 100% sure.

Thanks!

Brandon

[lamav]

HSRP configs look fine. Show me the statics and the routing protocol configs.

Also, when the vendor tests failover, exactly what does he fail to create the failover?

[mbroberson1]

Hi Lamav,

Please see attached.

when the vendor fails over they will usually failover their ASA form ther primary to ther secondary causing traffic to go over their secondary equipment and circuit.

Thanks,

Brandon

[lamav]

"when the vendor fails over they will usually failover their ASA form ther primary to ther secondary causing traffic to go over their secondary equipment and circuit."

And this is supposed to effect you, how?

Make sure the vendor is pointing to your HSRP VIP.

[mbroberson1]

Hi Lamav,

Is this the solution that would work?

http://www.tech-recipes.com/rx/1934/cisco_hsrp_like_vrrp_redundant_gateway_router_configuration/

[Edison Ortiz]

Hi Brandon,

You can create an IP SLA to track reachability via ICMP to the vendor's circuit.

Once that monitoring is configured, you can setup your HSRP to decrement its priority based on that tracking status.

http://www.cisco.com/en/US/docs/ios/ha/command/reference/ha_s3.html#wp1044974

HTH,

__

Edison.

[lamav]

"You can create an IP SLA to track reachability via ICMP to the vendor's circuit."

I seriously doubt that the vendor is going to allow him to PING his ASA to death. Most likely that ASA will be blocking all ICMP.

[Edison Ortiz]

Victor,

We are not pinging the ASA, we are pinging the vendor's router WAN interface.

__

Edison.

[lamav]

Understood. But I doubt the vendor is going to allow PINGs through his ASA. If so, that'll be a first for me.

[mbroberson1]

Hi Edison,

Could you kindly give a config example of what this would look like on both the company primay and company secondary routers?

Thanks,

Brandon

[Edison Ortiz]

Brandon

Per your requirements, it seems they want you to draw traffic to your secondary router from your LAN segment and currently they are using HSRP to do that.

Your primary router is the active HSRP router so you need to decrement its value based on a tracked event.

The only router that needs to be modified will be your company primary router.

Note.- I don't have any equipment at the moment, this was taken from the documentation:

1) Create a tracked object:

ip sla monitor 1

type icmp-echo dest-ipaddr [wan-circuit-ip]

ip sla monitor schedule 1 start now life forever

(More information at: http://www.cisco.com/en/US/docs/ios/ipsla/command/reference/sla_02.html#wp1052325)

2) Associate the track to the HSRP config:

standby 1 preempt

standby 1 priority 105

standby 1 track 1 decrement 10

On the secondary router, make sure you have:

standby 1 preempt

HTH,

__

Edison.

[mbroberson1]

Hi Edison,

So the [wan-circuit-ip] would be the address of the vendor primary's "far-remote-side", or the local side?

Regards,

Brandon

[Edison Ortiz]

Good question. It's up to you how far out you want the ICMP packet to travel. Keep in mind to modify the timeout and frequency within the SLA monitor and try not to be too aggressive on those parameters.

[mbroberson1]

Hi Edison,

Is this the solution you think would work?

http://www.tech-recipes.com/rx/1934/cisco_hsrp_like_vrrp_redundant_gateway_router_configuration/

[Edison Ortiz]

VRRP and HSRP have the same features.

The main difference between HSRP and VRRP is that HSRP is Cisco proprietary while VRRP is industry standards.

__

Edison.

[mbroberson1]

Hi Edison,

See if this would be a valid configuration?

Can you track on the same interface where you are running HSRP on?

Thanks,

Brandon