HSRP Route Tracking

I have been accustomed to tracking the WAN interface to determine the HSRP priority. However, there are more ways to use tracking in HSRP and one of those is to track a certain prefix in the routing table. This works by checking a specific route configured in "track" if it is still in the routing table. If not, it will decrease the priority according the configured decrement.

R1 and R2 are in one site. R1 is the Active HSRP route while R2 is the standby. R1 and R2 should
not be OSPF neighbors. Traffic should go to R2 once a route to 3.3.3.3/32 is lost in R1.

This is not the best way to track this scenario but just for example sake. Excuse the IP addressing scheme as well because I find it easier to know which ip is from which router just by number in the last octet. (e.g. .1 is in R1, .2 is in R2 and .3 is in R3)

The pre-configuration of the routers is found below.

R1#
interface FastEthernet0/0
ip address 10.10.20.1 255.255.255.0
duplex half
standby 1 ip 10.10.20.10
standby 1 preempt
!
interface Serial1/0
ip address 10.10.13.1 255.255.255.0
serial restart-delay 0
no fair-queue
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
router ospf 1
log-adjacency-changes
passive-interface FastEthernet0/0
network 10.10.13.0 0.0.0.255 area 0
network 10.10.20.0 0.0.0.255 area 0

R2#
interface FastEthernet0/0
ip address 10.10.20.2 255.255.255.0
duplex half
standby 1 ip 10.10.20.10
standby 1 priority 91
standby 1 preempt
!
interface Serial1/0
ip address 10.10.23.2 255.255.255.0
serial restart-delay 0
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
router ospf 1
log-adjacency-changes
passive-interface FastEthernet0/0
network 10.10.20.0 0.0.0.255 area 0
network 10.10.23.0 0.0.0.255 area 0

R3#
interface Loopback0
ip address 3.3.3.3 255.255.255.255
!
interface FastEthernet0/0
no ip address
shutdown
duplex half
!
interface Serial1/0
ip address 10.10.13.3 255.255.255.0
serial restart-delay 0
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
ip address 10.10.23.3 255.255.255.0
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
router ospf 1
log-adjacency-changes
network 3.3.3.3 0.0.0.0 area 0
network 10.10.13.0 0.0.0.255 area 0
network 10.10.23.0 0.0.0.255 area 0

Let's configure tracking and apply it on the HSRP group of 1.

R1(config)#track 1 ip route 3.3.3.3 255.255.255.255 reachability
R1(config-track)#int fa0/0
R1(config-if)#standby 1 track 1 decrement 11

Ok, lets see how a "show track" output looks like.

R1#sh track 1
Track 1
IP route 3.3.3.3 255.255.255.255 reachability
Reachability is Up (OSPF)
1 change, last change 00:01:22
First-hop interface is Serial1/0
Tracked by:
HSRP FastEthernet0/0 1

Notice that tracking knows what routing protocol the route is learned from. It also shows how long its up, which interface and what HSRP group is using. Pretty neat huh? :) Let's remove the announcement of 3.3.3.3/32 in R3 to simulate lost of entry in the routing table.

R3(config-router)#no network 3.3.3.3 0.0.0.0 area 0

Let's see how R1 reacts to that.

R1#
*Sep  4 16:57:37.679: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Serial1/0 from FULL to DOWN, Neighbor Down: Dead timer expired
*Sep  4 16:57:53.679: %HSRP-5-STATECHANGE: FastEthernet0/0 Grp 1 state Active -> Speak
*Sep  4 16:58:03.675: %HSRP-5-STATECHANGE: FastEthernet0/0 Grp 1 state Speak -> Standby
*Sep  4 16:58:08.747: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Serial1/0 from LOADING to FULL, Loading Done
*Sep  4 16:58:23.691: %HSRP-5-STATECHANGE: FastEthernet0/0 Grp 1 state Standby -> Active
*Sep  4 16:58:38.831: %HSRP-5-STATECHANGE: FastEthernet0/0 Grp 1 state Active -> Speak
*Sep  4 16:58:48.831: %HSRP-5-STATECHANGE: FastEthernet0/0 Grp 1 state Speak -> Standby

R1#sh standby br
            P indicates configured to preempt.
            |
Interface   Grp Prio P State    Active          Standby         Virtual IP
Fa0/0       1   89   P Standby  10.10.20.2      local           10.10.20.10

R1#sh track 1
Track 1
IP route 3.3.3.3 255.255.255.255 reachability
Reachability is Down (no route)
4 changes, last change 00:00:56
First-hop interface is unknown
Tracked by:
HSRP FastEthernet0/0 1

Ok, as we can see, once OSPF detected that the network isn't anymore reachable, HSRP reacted as well by decrementing the priority by 11 as per configured. The priority is now 89, 11 less than the default HSRP priority of 100. "show track" also indicated that there is no more route going to 3.3.3.3. I would just like to point out here that if the command "standby 1 preempt" was not configured in R2, it would not assume the Active state and R1 will still remain the Active HSRP router. Preempt feature will make HSRP renegotiate.

Let's advertise again the route and see the changes.

R3(config)#router ospf 1
R3(config-router)#network 3.3.3.3 0.0.0.0 area 0

R1#sh standby br
                  P indicates configured to preempt.
                  |
Interface   Grp Prio P State    Active          Standby         Virtual IP 
Fa0/0       1   100  P Active   local           10.10.20.2      10.10.20.10

As expected R1 will reassume the HSRP Active state because the route is now found in the routing table. :)

IP SLA with HSRP

My friend recently had an implementation involving an EoSDH connection from one site to another involving 2 routers. LAN side of Site 1 requires HSRP to be running and it needs to track the EoSDH connection so the Active HSRP will shift to R2 incase of primary link failure. The problem is most EoSDH connection like his implementation has no way of detecting Layer 1 and Layer 2 failures upstream because there are switches installed in the customer premise and even within the ISP EoSDH connection. Houston we have a problem! :)

As a solution he can have a transit connection between R1 and R2 and run OSPF but configure the routes received from R2 to have a higher admin distance than the OSPF which has 110. He could also use IP SLA feature to detect failures and track it in the HSRP group so that any breaches on the configured IP SLA will make HSRP decrement priority. The diagram is shown below similar to most setups.

Cisco IOS IP SLAs is a feature included in the Cisco IOS Software that can allow administrators the ability to
Analyze IP Service Levels for IP applications and services.IP SLA's uses active traffic-monitoring technology to
monitor continuous traffic on the network. This is a reliable method in measuring over head network performance.
Cisco Routers provide IP SLA Responders that give accuracy of measured data across a network.
-Wikipedia- 

In our diagram, the requirement is to run HSRP on the LAN and connect the primary router R1
and backup router, R2 to Site 2 which has R3. Connections to R1 -R3 and R2 - R3 should be in
different subnets. Imagine the network after SW1 towards R3 will be on the ISP side and could
have several switches towards R3. R1 is the Active HSRP router and R2 is the Standby.

The challenge here is how to track the EoSDH link which is like a FastEthernet/ GigabitEthernet network run across the
WAN. Tracking the interface of R1 or R2 connected to the switch won't do any good in HSRP because, even if there is
an upstream failure, that connection will still remain up. HSRP only decrements priority once it detects the router's interface
down. The solution to this problem is to configure IP SLA.

Before we proceed the routers' initial configs are shown below.

R1#
interface FastEthernet0/0
ip address 10.10.20.1 255.255.255.0
duplex full
!
interface FastEthernet1/0
ip address 192.168.100.10 255.255.255.0
duplex full
speed auto
standby 12 ip 192.168.100.1
standby 12 preempt
!
router ospf 1
log-adjacency-changes
passive-interface FastEthernet1/0
network 10.10.20.0 0.0.0.255 area 0
network 192.168.100.0 0.0.0.255 area 0

R2#
!
interface FastEthernet0/0
ip address 10.10.30.2 255.255.255.0
duplex full
!
interface FastEthernet1/0
ip address 192.168.100.20 255.255.255.0
duplex full
speed auto
standby 12 ip 192.168.100.1
standby 12 priority 91
!      
router ospf 1
log-adjacency-changes
passive-interface FastEthernet1/0
network 10.10.30.0 0.0.0.255 area 0
network 192.168.100.0 0.0.0.255 area 0

R3#
!
interface Loopback0
ip address 192.168.33.33 255.255.255.255
!
interface FastEthernet0/0
ip address 10.10.20.3 255.255.255.0
duplex full
!
interface FastEthernet1/0
ip address 10.10.30.3 255.255.255.0
duplex full
speed auto
!
router ospf 1
log-adjacency-changes
network 10.10.20.0 0.0.0.255 area 0
network 10.10.30.0 0.0.0.255 area 0
network 192.168.33.33 0.0.0.0 area 0
distance 254 10.10.30.2 0.0.0.0

Now, lets configure and SLA that constantly pings the Loopback address of R3 from R1. We will set the frequency of 10 , timeout and threshold of 2000.

R1(config)#ip sla monitor 1
R1(config-sla-monitor)#type echo protocol ipIcmpEcho 192.168.33.33
R1(config-sla-monitor-echo)#timeout 2000
R1(config-sla-monitor-echo)#threshold 2000
R1(config-sla-monitor-echo)#frequency 10

The frequency means it will do a ping in every 10 seconds to check if the configured netework is still reachable. The timeout and threshold values will determine if there is a "breach" in the configured SLA. Now let's start the SLA now and let it continue "forever" as long as the router is alive. You can also set other parameters like what time of the day this will start and what time it will end.

R1(config)#ip sla monitor schedule 1 start-time now life forever

Let's do a "debug ip icmp" and see if it is really doing its job now.

R1#debug ip icmp
ICMP packet debugging is on
R1#
*Sep  2 10:57:31.507: ICMP: echo reply rcvd, src 192.168.33.33, dst 10.10.20.1
*Sep  2 10:57:41.523: ICMP: echo reply rcvd, src 192.168.33.33, dst 10.10.20.1
*Sep  2 10:57:51.523: ICMP: echo reply rcvd, src 192.168.33.33, dst 10.10.20.1
*Sep  2 10:58:01.547: ICMP: echo reply rcvd, src 192.168.33.33, dst 10.10.20.1

Ok, its clear its receiving replies every 10 seconds. We are not done yet, we have to configure this to be tracked by HSRP.

R1(config)#track 1 rtr 1 reachability
R1(config-track)#int fa1/0
R1(config-if)#standby 12 track 1 decrement 11

The command "track 1 rtr 1" means that the IP SLA 1 is marked as tracked number 1. It doesn't matter what track number you use. Now, the HSRP config means that if the SLA is "breached" decrement by 11. First let's see the statistics of the configured IP SLA.

R1#sh ip sla monitor statistics 1
Round trip time (RTT)   Index 1
Latest RTT: 28 ms
Latest operation start time: *11:04:01.523 UTC Wed Sep 2 2009
Latest operation return code: OK
Number of successes: 42
Number of failures: 0
Operation time to live: Forever

I will shut down the connection from R1 to R3. The threshold and timeout are set to 2000 but if there isn't a reply its also a breach. Let's check what happens to the HSRP.

R1#sh standby br
         P indicates configured to preempt.
         |
Interface   Grp Prio P State    Active          Standby         Virtual IP
Fa1/0       12  89   P Standby  192.168.100.20  local           192.168.100.1

When the router is able to ping again the loopback of R3. The HSRP state will become active again.

Comparing Config Differences

When I started as a network engineer, whenever I configured something and forgot what it was, I usually do "show start" and "show run" to compare the difference manually before I do a "write mem". Believe me, it was an eyesore comparing the start-up and running-config line by line. There is a easy way though to compare the configs and the command is "show archive config differences" for the router to compare the start-up and the running-config. Check the output below.

Router#show archive config differences
Contextual Config Diffs:
+no aaa new-model
interface FastEthernet0/0
+description to LAN
+ip ospf cost 100
+duplex half
+mpls ip
-aaa new-model
-aaa session-id common
interface FastEthernet0/0
-description to Building 2
-ip ospf cost 800
-duplex full

The commands prepended with a "+" means that this commands are in the "start-up config". The ones with "-" are in the running config. Of course when you do a "write mem" after this and you issue the command, you won't be seing any differences :). Good day!

Show Command Multiple Filtering

Normally when we do show command we make use of the "|" to filter and put in keywords after like include, exclude, begin and section. As we all know "include" means show only that matches the string like for the example below.

R1#sh run | inc CISCO
 neighbor CISCO peer-group

We can do some multiple command filtering like the example below using the "include" keyword. Let's say we want to see the interface name, then the description, the OSPF cost and if its configured with the "mpls ip" command.

R1#sh run | inc interface |^ description |^ ip ospf cost |^ mpls ip
interface FastEthernet0/0
description towards LAN
ip ospf cost 100
mpls ip

The trick is to use multiple "|" and then the regular expression "^". Then put a space before the string because the configurations under the interface configuration if you do a "show run" has a space before the line. This also applies to the "exclude" keyword but who the heck uses "exclude" that much? There goes another stupid blog entry post. :)

Cisco Router as a DNS server

Not exactly like a DNS server that is hosted from a server and so on and so forth, the Cisco Router can act like a DNS server without the service stated above. It can even act as a proxy dns server, meaning forwarding the request to the upstream DNS server and cache the replies from the DNS server, so it can use the cache entries for other requesting hosts. We will only focus on the simple and practical configuration. I don't even know if this feature can be called a "DNS server" feature. :P If you have your own Dynamips Lab and has fixed ip addresses, it would be easier though to use hostnames when trying to ping devices. This can be achieved by the "ip host" command. It can be configured as the example below.

Router(config)#ip host R1 1.1.1.1
Router(config)#ip host R2 2.2.2.2
Router(config)#ip host R3 3.3.3.3
Router(config)#ip host R4 4.4.4.4

Let's do a ping test.

Router#ping R1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
...

Well, R1 now resolves to 1.1.1.1. There you have it, makes life easier! :P

Using Aliases in Cisco Routers

Cisco has long, frequently used commands like our favorites "show ip interface brief", "show ip route" and the annoying "do show" commands while in the global configuration mode. If you want the easy way, the good news is there is an easy way. Using aliases will save you some keystrokes. Here's the way to configure aliases. We will create aliases for the commands above and also be able to use the "show" command on the global configuration mode. "show ip interface brief" will be assigned with the alias "sib", "show ip route" will be "sir" and "do show" will be "show".

Router(config)#alias exec sib show ip interface brief
Router(config)#alias exec sir show ip route
Router(config)#alias configure show do show

Let's test if the alias commands really work.

Router#sib
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            unassigned      YES unset  administratively down down

Router#sir
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
  D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
  N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
  E1 - OSPF external type 1, E2 - OSPF external type 2
  i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
  ia - IS-IS inter area, * - candidate default, U - per-user static route
  o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

Router#config t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#show ip int brief
Interface                  IP-Address      OK? Method Status                Protocol

FastEthernet0/0            unassigned      YES unset  administratively down down

Well it did! Lets check what we will see in IOS help.

Router#s?
*s=show     *sib="show ip interface brief"  *sir="show ip route"  sdlc
send        set                             setup                 show
slip        snasw                           squeeze               ssh
start-chat  systat

Router#config t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#s?
*show="do show"  sap-priority-list  scheduler          scripting
secure           security           service            sgbp
signaling-class  sip-ua             sna                snasw
snmp             snmp-server        source-bridge      srcp
standby          state-machine      stun               su-mac
su-tag           subscriber         subscriber-policy  subscription

Now we see the aliases we made and they have the preceeding asterisk before them. *s=show is the default alias in the router. Cool! Try other aliases in different modes, make your own aliases and just be creative!

Using Parser View In Cisco Routers

What exactly is a parser view? In simple terms, its like creating user accounts with certain filtering of commands. Parser views can be used to customize which command are allowed for a certain user depending on their privileges. Its simple to create parser views but doing the command filtering takes a while to learn.

Let's make a parser view called "user". One requirement needed is to enable first the "root" view. The hierarchy is similar to Unix/Linux wherein there should be a root. Secondly AAA must be enabled and thirdly, there should be an enable secret configured on the router.

Router#config t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#aaa new
Router(config)#aaa new-model
Router(config)#enable view root
Routerconfig)#enable secret cisco

It would need to be in the privilege exec mode to access the root view.

Router#sh parser view
No view is active ! Currently in Privilege Level Context
Router#enable view root
Password:
*May  2 00:50:51.283: %PARSER-6-VIEW_SWITCH: successfully set to view 'root'.

Router#show parser view
Current view is 'root'

Now from the root view, this is where we create all other views and define the commands that can be included or excluded per view.

Router(config)#parser view user
Router(config-view)#
*May  2 00:52:54.999: %PARSER-6-VIEW_CREATED: view 'user' successfully created.

We can set a password for the parser view "user".

Router(config-view)#secret cisco

Great! Our parser view is done. Lets say, we exclude the reload command for this view. Pretty dangerous if someone not authorize will reload the router!

Router(config-view)#commands exec exclude reload

Lets dissect what the command above does. The word command is literally for the commands allowed. "Exec" is for the privilege exec mode since reload is done on the mode and "reload" is basically the command itself. We can see its the same hierarchy as configuration.

For testing, we will go to parser view and try reloading the router.

Router#enable view user
Password:
Router#reload
 ^
% Invalid input detected at '^' marker.

Cool! Now reload command doesn't work on that mode anymore. I have my online hopping server which I configured with parser view so my friends won't do any cpu or performance intensive commands in the routers.

commands configure exclude aaa
commands exec include all telnet
commands exec include all write
commands exec include all traceroute
commands exec include all ping
commands exec include all enable
commands exec include all configure
commands exec include all send
commands exec exclude reload
commands exec exclude undebug ip packet
commands exec include undebug ip
commands exec exclude undebug all
commands exec include all undebug
commands exec include all show
commands exec include all set
commands exec exclude debug ip packet
commands exec include debug ip
commands exec exclude debug all
commands exec include all debug
commands configure exclude interface FastEthernet0/0

The router's behavior regarding parser view is that it adds command opposite to the one you excluded. Lets say for example "commands exec exclude debug ip packet". Since this command is excluded the undebug part also should be excluded. The router automatically generated this command "commands exec exclude undebug ip packet".

There you have it. Enjoy and try configuring some parser views.