3441 HSRP Question. Does it require a switch to work?

[davidcanepa]

Hi, 

Is there any specific reason we could not use

 interface ge0/0/1 or 2

  on one router and connect to an equal interface on the second router and use this for the heartbeat.   Both Routers would have one interface attached individually to a clustered Fire wall.

One router to node 0 and one router to node 1. 

Does the heartbeat require switches between the routers l?

Thank you 

Please contact me at 

David.canepa@oncorellc.com

[Jon Marshall]

Not sure I follow what you are trying to do. 

If you used separate interfaces for the HSRP messages then you would not be running HSRP on the interfaces connecting to the firewalls so it wouldn't work unless I am not understanding what you are asking ? 

Jon

[davidcanepa]

I meant to say does the HSRP require a switch to make the protocol function or can we use a third interface on each router to connect the two routers together to form the HSRP.          Hope that makes more sense?

[Jon Marshall]

You need L2 adjacency between the interfaces for HSRP to work. 

So technically you could use two interfaces directly connected to each other and configure HSRP but there would be no point as there would be no end devices in that subnet as it is simply a direct link between the routers. 

What you couldn't do (and what I think you are asking) is use HSRP on the interfaces connecting to your firewalls but use another interface for the HSRP messages for that vlan/subnet. 

You really do need a switch (or switches) between the routers and the firewalls to make it all work. 

Jon

[MHM Cisco World]

....

[Richard Burts]

David

I agree with Jon that your question is not clear. It seems to me that what you are asking about is how to achieve that a pair of firewalls could be active/standby using connections to routers to achieve their inside connections. If that understanding is correct then in general it can not work. If the firewalls are to achieve active/standby then their interfaces would need to be in the same subnet. That would require that both router interfaces (one to the firewall and the other to the peer router) would need to be in the same subnet. But IOS will not allow 2 interfaces to be in the same subnet.

There may be a specific circumstance in which it might work. Depending on the platform (and perhaps version of code) it might be possible to configure Integrated Routing and Bridging. Using IRB the 2 physical interfaces (and their BVI virtual interface) could be in a single subnet. But if you contemplate using this approach then realize that it would require at least one more router interface, which would connect to where the inside network devices connect. This is quite a kludge (and a fairly expensive one) for which a simple (and less expensive) switch would work quite well.

[Georg Pauwen]

Hello,

same as Jon, I am not sure what you are after. Can you draw out the topology you have in mind ?

[davidcanepa]

Making a drawing now, Standby 

[davidcanepa · Accepted solution]

Thank you all, I was trying to avoid having a switch in the middle to run HSRP but it is a general consensus that a switch is needed. I want to thank all of you for the responses. It is greatly appreciated,   

Thank you ,

David Cabepa