topic vip & interface redundancy for css11506 in Application Networking

vip & interface redundancy for css11506

julxu — Wed, 21 Dec 2005 00:31:51 GMT

When I configure redundancy on my two css11506s, I find when I put acl on, I can not see the vip if not working fine.

and also, if remove redundancy it works fine.

my access list is only bypass ssh and permit VIPs. do I need add more for redundancy?

Any comments will be appreciated

Thanks in advance

Gilles Dufour — Wed, 21 Dec 2005 08:18:27 GMT

if you create acl, you need to permit the vrrp traffic [dst ip == 224.0.0.18].

Gilles.

Thanks for rating this answer.

julxu — Thu, 22 Dec 2005 00:08:44 GMT

what is the source ip ? I did:

master:

======

circuit VLAN295

ip address 10.2.95.2 255.255.255.0

ip virtual-router 2 110 preempt

ip redundant-interface 2 10.2.95.1

ip critical-service 2 upstream-downstream

backup:

=======

circuit VLAN295

ip address 10.2.95.3 255.255.255.0

ip virtual-router 2

ip redundant-interface 2 10.2.95.1

ip critical-service 2 upstream-downstream

so the acl should be:

clause 1 permit ip 10.2.95.2 destination 224.0.0.18?

Should I use bypass?

Should I use src ip as any?

Please advance.

julxu — Thu, 22 Dec 2005 01:44:25 GMT

I think I found the solution myself. the src should be the interfaces of vrrp.

I will try today and thanks for help.

Gilles Dufour — Thu, 22 Dec 2005 09:06:14 GMT

the source is the ip address configured on the interface where you configured the virtual vip or virtual interface.

So in your example, your clause 1 is correct.

Gilles.