Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Routing to Vendor network and tracking interface failure

Please see attached diagram for more details.

Senario:

You have a connection to vendor/business partner. You have two connections to this business partner. You are runing EIGRP on your internal network and with your routers and core switches. You don't know and don't care what IGP's the vendor is running. They are most likely doing statics. The vendor has two circuits from their routers to their network. If one of the vendors circuits goes down their equipment will failover to using their seconday circuit and equipment.

NOW the BIG question:

How can you configure your company primary router to notice when the vendor primary fails over and instruct your secondary router to take over as the primary path to the vendor network. Your company routers are using HSRP over a L2 link and the primary has static routes pointing to the failover ASA HSRP address of the Vendors ASAs.

I think you will have to do some sort of interface tracking, but not 100% sure.

Thanks!

Brandon

32 REPLIES
Blue

Re: Routing to Vendor network and tracking interface failure

His ASA HSRP VIP address and your router's HSRP VIP address should be on the same subnet and you should be pointing your outbound traffic to his VIP address, and the vendor should be pointing his outbound traffic to your HSRP VIP. This way it doesnt matter which one of his routers is active.

It's either that, or you use BGP peering with the vendor to withdraw routes and do things dynamically.

HTH

Victor

New Member

Re: Routing to Vendor network and tracking interface failure

Hi Victor,

This is the case with the addressing. His ASA HSRP VIP is on the same subnet as my router's HSRP address. We are pointing outbound traffic with static rotues to his VIP address. The same case is for the vendor. Can you kindly give a brief config example of what this would look like from the company primary and secondary routers? Would I use floating statics on the secondary? If not what would you suggest?

Kind Regards,

Brandon

Blue

Re: Routing to Vendor network and tracking interface failure

Hey, brandon:

Im a bit confused. It seems like this set up is already in place, but then you ask about what the configs on your routers should look like....

Anyway, yes, you're right. A static on primary and a floating static on the secondary, both redistributed back to your core.

New Member

Re: Routing to Vendor network and tracking interface failure

Hi Lamav,

This is way it is setup, but when the vendor test failover it doesn't seem to work. Perhaps I need to re-check the HSRP config on the routers. I'll see about posting the HSRP congigs.

Thanks

Blue

Re: Routing to Vendor network and tracking interface failure

Yes, well, thats exactly the point. If you're pointing traffic to the vendor's HSRP VIP, why would you care about anything happening on the vendor side? The vendor's failover will be transparent to you.

That goes back to what I was saying about tracking. What does tracking buy you? No matter what, the address you send traffic to will never change.

New Member

Re: Routing to Vendor network and tracking interface failure

So on the HSRP tracking my question is from a routing table topology perspective how does the path in the routing table know to change from primary to secondary if a failover happens on the vendor side. The statics will still be redistributed into the table from the primary, but how does when the failover occurs does the secondary router install the routes and start using the floating statics? I hope I am making sense.

Thanks,

Brandon

Blue

Re: Routing to Vendor network and tracking interface failure

Brandon:

Maybe I am missing something....

If the vendor fails over to a secondary path, why should you want to change the route that your company takes to get to them?

If you're forwarding traffic to their ASA's VIP (by the way, before I was typing "ASA HSRP VIP" by mistake - ASAs do not run HSRP. I meant its failover VIP), then that should be enough. Whichever ASA is processing the incoming traffic will forward it accordingly within the vendor's domain.

Am I not understanding something?

Is the vendor telling you that you MUST failover to your secondary router if they failover to their secondary ASA for stateful connection purposes?

New Member

Re: Routing to Vendor network and tracking interface failure

Hi Lamav,

I think you pretty much have the understanding. What I am not understanding is on the secondary router if I am using floating statics to the vendor ASA VIP address, how will that secondary router (and most importantly network traffic on the company side) know to use the secondary router path to reach the vendor network(s)?

Thanks,

Brandon

Blue

Re: Routing to Vendor network and tracking interface failure

Brandon:

Lets walk through this step by step.

R1 advertises a static route to the vendor network back to the company's core.

All router's in the eigrp routing domain will receive that route.

R2 will redistribute a comparable static route to the vendor's network, but with an AD of 220.

All routers in the eigrp domain will receive that route, but will NOT place it in the routing table because R1's static has a lower AD.

If R1 fails, or R1's vendor-facing interface fails or goes "down," it will lose its next hop to the vendor network.

R1 will then withdraw the route from its routing table and NOT redistirbute it back to the core. Therefore, the only route left to the vendor network is R2s route, and therefore, company traffic will be forwarded to R2.

Keep in mind that the ONLY time your company would need to forward traffic to R2 is if R1s route to the vendor ceases to exist, otherwise there is no reason why R1 should have a healthy route to the vendor, but nonetheless force a failover to R2.

New Member

Re: Routing to Vendor network and tracking interface failure

I think I am starting understanding this now?

So for the configuration you have seen our "the company side" looks like it is already setup properly?

Thanks,

Brandon

New Member

Re: Routing to Vendor network and tracking interface failure

So the interface on the primary company router will have to do down/down or can it be up/down in order for the healthy routes advertised by the primary to go away from the table forcing the floating statics from the secondary to be injected?

Thanks,

Brandon

Blue

Re: Routing to Vendor network and tracking interface failure

Brandon:

Once the exit interface, and therefore the next hop, for a route is no longer available (up/down, down/down), the route is removed from the routing table.

New Member

Re: Routing to Vendor network and tracking interface failure

This may be the question I was looking to have answered that started this post?

So even though the company primary router (outside interface) is connected to a switch it will still be able to go up/down or down/down when a failover on the vendor side occurs?

I think this is the question/answer I am after?

Thanks,

Brandon

New Member

Re: Routing to Vendor network and tracking interface failure

Hi Lamav,

See attached for HSRP config. Tell me what you think.

Thanks,

Brandon

Blue

Re: Routing to Vendor network and tracking interface failure

HSRP configs look fine. Show me the statics and the routing protocol configs.

Also, when the vendor tests failover, exactly what does he fail to create the failover?

New Member

Re: Routing to Vendor network and tracking interface failure

Hi Lamav,

Please see attached.

when the vendor fails over they will usually failover their ASA form ther primary to ther secondary causing traffic to go over their secondary equipment and circuit.

Thanks,

Brandon

Blue

Re: Routing to Vendor network and tracking interface failure

"when the vendor fails over they will usually failover their ASA form ther primary to ther secondary causing traffic to go over their secondary equipment and circuit."

And this is supposed to effect you, how?

Make sure the vendor is pointing to your HSRP VIP.

New Member

Re: Routing to Vendor network and tracking interface failure

Hall of Fame Super Bronze

Re: Routing to Vendor network and tracking interface failure

Hi Brandon,

You can create an IP SLA to track reachability via ICMP to the vendor's circuit.

Once that monitoring is configured, you can setup your HSRP to decrement its priority based on that tracking status.

http://www.cisco.com/en/US/docs/ios/ha/command/reference/ha_s3.html#wp1044974

HTH,

__

Edison.

Blue

Re: Routing to Vendor network and tracking interface failure

"You can create an IP SLA to track reachability via ICMP to the vendor's circuit."

I seriously doubt that the vendor is going to allow him to PING his ASA to death. Most likely that ASA will be blocking all ICMP.

Hall of Fame Super Bronze

Re: Routing to Vendor network and tracking interface failure

Victor,

We are not pinging the ASA, we are pinging the vendor's router WAN interface.

__

Edison.

Blue

Re: Routing to Vendor network and tracking interface failure

Understood. But I doubt the vendor is going to allow PINGs through his ASA. If so, that'll be a first for me.

New Member

Re: Routing to Vendor network and tracking interface failure

Hi Edison,

Could you kindly give a config example of what this would look like on both the company primay and company secondary routers?

Thanks,

Brandon

Hall of Fame Super Bronze

Re: Routing to Vendor network and tracking interface failure

Brandon

Per your requirements, it seems they want you to draw traffic to your secondary router from your LAN segment and currently they are using HSRP to do that.

Your primary router is the active HSRP router so you need to decrement its value based on a tracked event.

The only router that needs to be modified will be your company primary router.

Note.- I don't have any equipment at the moment, this was taken from the documentation:

1) Create a tracked object:

ip sla monitor 1

type icmp-echo dest-ipaddr [wan-circuit-ip]

ip sla monitor schedule 1 start now life forever

(More information at: http://www.cisco.com/en/US/docs/ios/ipsla/command/reference/sla_02.html#wp1052325)

2) Associate the track to the HSRP config:

standby 1 preempt

standby 1 priority 105

standby 1 track 1 decrement 10

On the secondary router, make sure you have:

standby 1 preempt

HTH,

__

Edison.

New Member

Re: Routing to Vendor network and tracking interface failure

Hi Edison,

So the [wan-circuit-ip] would be the address of the vendor primary's "far-remote-side", or the local side?

Regards,

Brandon

Hall of Fame Super Bronze

Re: Routing to Vendor network and tracking interface failure

Good question. It's up to you how far out you want the ICMP packet to travel. Keep in mind to modify the timeout and frequency within the SLA monitor and try not to be too aggressive on those parameters.

New Member

Re: Routing to Vendor network and tracking interface failure

Hall of Fame Super Bronze

Re: Routing to Vendor network and tracking interface failure

VRRP and HSRP have the same features.

The main difference between HSRP and VRRP is that HSRP is Cisco proprietary while VRRP is industry standards.

__

Edison.

New Member

Re: Routing to Vendor network and tracking interface failure

Hi Edison,

See if this would be a valid configuration?

Can you track on the same interface where you are running HSRP on?

Thanks,

Brandon

219
Views
0
Helpful
32
Replies
CreatePlease to create content