About tunneling and HSRP on different networks

[camille-eit]

Hi all,

I encounter a problem to allow HSRP through a tunnel between two routers on different networks.

My supposed active and standby routers, well configured with HSRP (this has been tested before), are on different networks with an intermediate router and the purpose of my question is to find how to configure a tunnel between the two HSRP configured routers and through this intermediate router that allows HSRP to work well.

The tunnel I have configured allows multicast (I know it because the two HSRP configured routers can share their OSPF table from the tunnel) but both keep on their active mode.

If you have any idea on this question please mail me your tips !

Thank U

Camille, France

[lgijssel]

If I remember well, the HSRP multicasts have their TTL set to one. Crossing a router kills them. I am afraid there is no workaround.

[gflenniken]

I don't think TTL is an issue since tunnelled packets are encapsulated with new ip headers.

I'm not sure if I understand everything but to use HSRP across a tunnel (assuming GRE), the HSRP virtual address would have to be configured on the tunnel itself. Is that the case? HSRP hellos only go out the interface it is configured on. I have not tried this but I'm not sure of the usefulness. There would not be any other devices on the tunnel network to access the virtual address which is the whole point of HSRP. I suppose you could use tracking statements to trigger other interfaces down based on HSRP. I'm curious about the application.

OSPF will flow across the tunnel as long as the address of the tunnel interfaces are included in the OSPF area.

[camille-eit]

Hi,

Here is more explanations about my problem :

For anyone who wants to understand the purpose of the tunnel and HSRP configured routers on different subnets, the aim of the intermediate router is to feign, on the ultimate architecture, a pix that should allow OSPF traffic and HSRP hello packets.

I have the idea of one GRE tunnel because the pix doesn't allow multicast traffic with classical filtering.

I have tried to configure the HSRP virtual address on the same subnet used by the tunnel interfaces on the two distant HSRP configured routers but the following error appeared :

192.168.50.100 overlaps with Tunnel0, with 192.168.50.100 as HSRP virtual address of the standby group

This issue seems not to solve my problem ...

Thanks for your cooperation,

Camille