backup interface - ethernet with subinterface

[ld_ferguson]

Goal:  Configure router to support a failover Ethernet link (basically provide HA).

Scenario:  1 router (3925), 2 switches (3750).  All equipment is located in the same datacenter on the same LAN.   The switches are setup as primary/secondary for HA should one of them fail completely.  This has been tested successfully due to recently replacing PDUs in our data center (except for the router).  The router has not been configured to support a failed interface when one of the switches lose power.

The router has 2 gigethernet ports available to connect to each switch above respectively.   Would the following “backup interface” configuration provide the functionality we need?

interface GigabitEthernet0/0

backup interface gig0/2

no ip address

ip flow ingress

load-interval 30

duplex auto

speed auto

!

!

interface GigabitEthernet0/0.360

encapsulation dot1Q 360

ip address 10.248.120.253 255.255.255.224

!

interface GigabitEthernet0/0.500

encapsulation dot1Q 500

ip address 10.101.11.1 255.255.255.0

ip nat inside

ip virtual-reassembly

interface GigabitEthernet0/2

no ip address

ip flow ingress

load-interval 30

duplex auto

speed auto

!

!

interface GigabitEthernet0/0.360

encapsulation dot1Q 360

ip address 10.248.120.253 255.255.255.224

!

interface GigabitEthernet0/0.500

encapsulation dot1Q 500

ip address 10.101.11.1 255.255.255.0

ip nat inside

ip virtual-reassembly

[Jon Marshall]

I have never used the backup interface but why are you using subinterfaces on the other interface.

If the router has two interfaces then just use L3 links and connect each link to each switch.

Are you using the routers as default gateways for clients ?

Jon

[ld_ferguson]

The subs are used to separate VLANs (360 and 500).

Yes, the router (we only have one) is a default gateway for clients.

The goal is to provide an alternate path should the primary switch fail completely.  This issue was discovered when replacing PDUs in the data center and noticed the router was not physically connected to both switches as our other equipment is.

[Jon Marshall]

So is there a typo in your original post ie. under gi0/2 configuration should the subinterfaces be gi0/2.360 and gi0/2.500 ?

I'm not sure about the mac address of the default gateway on the clients ie. if you switch to the backup interface it will have a new mac address but the clients arp cache will still show the previous mac address.

Unless the backup interface does something like a gratuitous arp when it takes over.

Just out of interest why are not routing the client vlans on the 3750s and then you could simply use two P2P links from the router and prefer one of the links.

Although that does assume your switches are interconnected with a trunk link which they may well be but more importantly is the issue with route tracking ie. the 3750s only support IP SLA with the IP Services license as far as I am aware.

If you had that license it might be worth considering.

I'll have a quick search on backup interface but sorry can't say for sure at the moment it will work.

Jon

[ld_ferguson]

No typo.  This is my proposed config using the backup interface command.  I'm unsure how the backup interface handles sub-interface.  My understanding is Cisco allows you to have two interfaces (or sub interfaces for vlans) on the same router with the same IP config, as long as you use the "backup interface" command.

But, as you mentioned, under gi0/2 the configuration may need to be changed since gi0/1 will be down.  That's the part of 'backup interface' I'm trying to digest.

[Jon Marshall]

Okay, there is no gi0/1 in your configuration.

The router has just two interfaces ?

I can't see how that configuration will work unless you renumber the subinterfaces on gi0/2 but then you are probably more up to speed than me with this.

If I get the chance I can try and lab this up but it won't be until later today or tomorrow.

I get the idea of what you are trying to do.

Jon

[ld_ferguson]

gi0/1 is in use, so I omitted from the post.  Router has 3 gi interfaces.

[Jon Marshall]

Sorry I meant gi1/1 was not part of the backup interface setup ie. it used for presumably your WAN connectivity.

Jon

[ld_ferguson]

Yes, Gi0/1 is used for MPLS.  I do not have a Gi1/1.   I have Gi0/0, 0/1, and 0/2.

[ld_ferguson]

I just ran across this info:

The backup interface command "bonds" two interfaces on the router to behave as one. One is the primary, the other secondary. When the router detects a link failure on the primary, the secondary becomes active and remains active until the primary is restored. The backup interface command is defined on the primary interface:

Router (config)#int fa 0/0
Router (config-if)#backup interface Fast Ethernet 1/0

Both the primary interface and its backup should be configured identically. The primary interface dictates the operation state of the bond. If the primary interface is shut down, the backup is as well. Another little caveat of using interface backup is that the primary interface's slot and/or number must be lower then the backup interface. Otherwise, when the router reboots, the backup interface comes up first at boot.

[Jon Marshall]

Okay so maybe you do use the same subinterfaces but i still think maybe you refer to the corresponding main interface number.

I can run a lab with an emulator for you if you think it is worth it ?

I assume your 3750s are interconnected with a trunk ?

Jon

[ld_ferguson]

That would be fantabulous.  They are trunked.

[Jon Marshall]

Well that was a waste of time :-)

I am using an emulator and unfortunately if the switch end goes down the router ports line protocol stays up even with keepalives so it never fails over.

Obviously I can't shut the inteface because that disables the standby (tried anyway and it did).

So all I can confirm is the router accepts the configuration although I did use the main interface for the subinterfaces not like you have and that it then reports the backup interface as being in standby mode.

What I really wanted to check was what happens with the clients default gateway mac address entry in it's arp cache but obviously couldn't as it wouldn't failover.

Sorry about that.

Jon

[ld_ferguson]

Thank you for trying and the quick responses.  Maybe someone else will chime in.