Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
2183
Views
3
Helpful
11
Replies

HSRP Configuration help

Go to solution
Sreejesh S
Level 1
Level 1

‎03-19-2013 04:35 AM - edited ‎03-07-2019 12:20 PM

                  Hi

Here I need to configure HSRP in between  two 4948E Coreswitches We have 6 vlans and Intervlan routing enabled on Firewall so please sugest me how can configure HSRP inbetween thos core switch. Please find attached daigram and suggest me Coreswitch commands for HSRP

Labels:
Preview file
143 KB
0 Helpful
2 Accepted Solutions

Accepted Solutions

Go to solution
blau grana
Level 7
Level 7
In response to Sreejesh S

‎03-20-2013 01:01 AM

Hello,

First of all you said that "Intervlan routing enabled on Firewall". What type of  firewall is it? HSRP is cisco proprietary protocol, so it can be used only between cisco devices. If your firewalls are not cisco you have to find out if they support VRRP, which is very similar to HSRP, but it is open standard.

Lower is example configuration of HSRP and VRRP, they are very similar but in some things they work differently (like preempting which VRRP do by default, but in HSRP you have to configure it).

Basically this is configuring default gateway for VLAN 50.

EXAMPLE OF HSRP CONFIGURATION

FirewallA(config)# interface vlan 50

FirewallA(config-if)# ip address 192.168.1.10 255.255.255.0

FirewallA(config-if)# standby 1 priority 200

FirewallA(config-if)# standby 1 preempt

FirewallA(config-if)# standby 1 ip 192.168.1.1

FirewallA(config-if)# standby 1 authentication MyKey

FirewallB(config)# interface vlan 50

FirewallB(config-if)# ip address 192.168.1.11 255.255.255.0

FirewallB(config-if)# standby 1 priority 100

FirewallB(config-if)# standby 1 ip 192.168.1.1

FirewallB(config-if)# standby 1 authentication MyKey

EXAMPLE OF VRRP CONFIGURATION

FirewallA(config)# interface vlan 50

FirewallA(config-if)# ip address 192.168.1.10 255.255.255.0

FirewallA(config-if)# vrrp 1 priority 200

FirewallA(config-if)# vrrp 1 ip 192.168.1.1

FirewallB(config)# interface vlan 50

FirewallB(config-if)# ip address 192.168.1.11 255.255.255.0

FirewallB(config-if)# vrrp 1 priority 100

FirewallB(config-if)# no vrrp 1 preempt

FirewallB(config-if)# vrrp 1 ip 192.168.1.1

Best Regards

Please rate all helpful posts and close solved questions

Best Regards Please rate all helpful posts and close solved questions

View solution in original post

0 Helpful

Go to solution
blau grana
Level 7
Level 7
In response to Sreejesh S

‎03-25-2013 08:19 AM

IP addressing looks good, but I do not get why did you configure same priority for both switches. You should prefer one switch over another, or maybe you can configure "load-balancing" -> half of vlans will be go over one switch and another half over other switch.

Also, I see no point of tracking interface Gigaethernet1/0/2 on both firewalls, both firewalls will send HSRP hellos via these interfaces (directly connected) so if interface or link fail, no hellos will be received and HSRP peer will be presumed dead.

You should rather track your uplink interfaces to internet, because there is no point to be a gateway for LAN if you do not have working uplink to internet.

Or you should configure IP SLA and track state of IP SLA [monitoring gateway] because sometimes uplink port is up/up but link is not working properly.

Best Regards

Please rate all helpful posts and close solved questions

Best Regards Please rate all helpful posts and close solved questions

View solution in original post

0 Helpful
11 Replies 11

Go to solution
Gregory Snipes
Level 4
Level 4

‎03-19-2013 05:55 AM

If you have the inter-VLAN routing setup on the firewalls and not the switches then you cannot configure HSRP on the switches. You must use whatever the firewalls support (probably active/standby failover) for high availability.

Go to solution
blau grana
Level 7
Level 7
In response to Gregory Snipes

‎03-19-2013 08:01 AM

As Gregory pointed, HSRP/VRRP has to be run between devices acting as default gateways.

Best Regards

Please rate all helpful posts and close solved questions

Best Regards Please rate all helpful posts and close solved questions
0 Helpful

Go to solution
Sreejesh S
Level 1
Level 1
In response to Gregory Snipes

‎03-20-2013 12:37 AM

Could you please suggest me how can configure failover/hsrp based on this daigram and please give sample configuration also

0 Helpful

Go to solution
blau grana
Level 7
Level 7
In response to Sreejesh S

‎03-20-2013 01:01 AM

Hello,

First of all you said that "Intervlan routing enabled on Firewall". What type of  firewall is it? HSRP is cisco proprietary protocol, so it can be used only between cisco devices. If your firewalls are not cisco you have to find out if they support VRRP, which is very similar to HSRP, but it is open standard.

Lower is example configuration of HSRP and VRRP, they are very similar but in some things they work differently (like preempting which VRRP do by default, but in HSRP you have to configure it).

Basically this is configuring default gateway for VLAN 50.

EXAMPLE OF HSRP CONFIGURATION

FirewallA(config)# interface vlan 50

FirewallA(config-if)# ip address 192.168.1.10 255.255.255.0

FirewallA(config-if)# standby 1 priority 200

FirewallA(config-if)# standby 1 preempt

FirewallA(config-if)# standby 1 ip 192.168.1.1

FirewallA(config-if)# standby 1 authentication MyKey

FirewallB(config)# interface vlan 50

FirewallB(config-if)# ip address 192.168.1.11 255.255.255.0

FirewallB(config-if)# standby 1 priority 100

FirewallB(config-if)# standby 1 ip 192.168.1.1

FirewallB(config-if)# standby 1 authentication MyKey

EXAMPLE OF VRRP CONFIGURATION

FirewallA(config)# interface vlan 50

FirewallA(config-if)# ip address 192.168.1.10 255.255.255.0

FirewallA(config-if)# vrrp 1 priority 200

FirewallA(config-if)# vrrp 1 ip 192.168.1.1

FirewallB(config)# interface vlan 50

FirewallB(config-if)# ip address 192.168.1.11 255.255.255.0

FirewallB(config-if)# vrrp 1 priority 100

FirewallB(config-if)# no vrrp 1 preempt

FirewallB(config-if)# vrrp 1 ip 192.168.1.1

Best Regards

Please rate all helpful posts and close solved questions

Best Regards Please rate all helpful posts and close solved questions
0 Helpful

Go to solution
Sreejesh S
Level 1
Level 1
In response to blau grana

‎03-25-2013 12:44 AM

Switch>enable

Switch#configure terminal

Switch(config)#hostname Coreswitch1

Coreswitch1(config)#enable secret Cisco

Coreswitch1(config)#banner motd #Welcome Authorized Users Unauthorized access prohibited!#

Coreswitch1(config)#line vty 0 4

Coreswitch1(config-line)#password cisco123

Coreswitch1(config-line)#login

Coreswitch1(config)#line console 0

Coreswitch1(config-line)#password cisco123

Coreswitch1(config-line)#login

Coreswitch1(config)#vlan 10

Coreswitch1(config-vlan)#name data

Coreswitch1(config)#vlan 20

Coreswitch1(config-vlan)#name Mgt

Coreswitch1(config)#vlan 30

Coreswitch1(config-vlan)#name LIOM

Coreswitch1(config)#vlan 40

Coreswitch1(config-vlan)#name IPCam

Coreswitch1(config)#vlan 50

Coreswitch1(config-vlan)#name BUR

Coreswitch1(config)#vlan 60

Coreswitch1(config-vlan)#name Heartbeats

Coreswitch1(config)#interface range fastEthernet 1/0/4– 20

Coreswitch1(config-if)#description to Dell Server

Coreswitch1(config-if-range)#switchport mode access

Coreswitch1(config-if-range)#switchport access vlan 10

Coreswitch1(config-if-range)#No Shutdown

Coreswitch1(config)#interface range fastEthernet 1/0/21-25

Coreswitch1(config-if)#description to Mangnt port

Coreswitch1(config-if-range)#switchport mode access

Coreswitch1(config-if-range)#switchport access vlan 20

Coreswitch1(config-if-range)#No Shutdown

Coreswitch1(config)#interface Gigaethernet1/0/1

Coreswitch1(config-if)#description to Firewall

Coreswitch1(config-if)#switchport mode trunk

Coreswitch1(config-if)#switchport trunk encapsulation dot1q

Coreswitch1(config-if)#switchport trunk allowed vlan all

Coreswitch1(config)#interface Gigaethernet1/0/2

Coreswitch1(config-if)#description to Coreswitch2

Coreswitch1(config-if)#switchport mode trunk

Coreswitch1(config-if)#switchport trunk encapsulation dot1q

Coreswitch1(config-if)#switchport trunk allowed vlan all

Coreswitch1(config)#interface Gigaethernet1/0/3

Coreswitch1(config-if)#description to Access Switch

Coreswitch1(config-if)#switchport mode trunk

Coreswitch1(config-if)#switchport trunk encapsulation dot1q

Coreswitch1(config-if)#switchport trunk allowed vlan all

Coreswitch1(config)#interface port-channel 1

Coreswitch1(config-if)#description to Dell Server

Coreswitch1(config-if)#no ip address

Coreswitch1(config-if)#logging event link-status

Coreswitch1(config-if)#switchport

Coreswitch1(config-if)#switchport access vlan 10

Coreswitch1(config)#interface  range fastEthernet 1/0/4 – 20

Coreswitch1(config-if)#no ip address

Coreswitch1(config-if)#logging event link-status

Coreswitch1(config-if)#channel-group 1 mode active

Coreswitch1(config)#spanning-tree mode rapid-pvst

Coreswitch1(config)#spanning-tree loopguard default

Coreswitch1(config)#no spanning-tree optimize bpdu transmission

Coreswitch1(config)#spanning-tree extend system-id

Coreswitch1(config)#spanning-tree pathcost method long

Coreswitch1(config)#interface Vlan10

Coreswitch1(config-if)#no IP

Coreswitch1(config-if)#standby 1 ip 172.16.1.254

Coreswitch1(config-if)#standby 1 priority 102

Coreswitch1(config-if)#standby 1 preempt

Coreswitch1(config-if)#standby 1 timers 1 4

Coreswitch1(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch1(config)#interface Vlan20

Coreswitch1(config-if)#no IP

Coreswitch1(config-if)#standby 1 ip 172.16.2.30

Coreswitch1(config-if)#standby 1 priority 103

Coreswitch1(config-if)#standby 1 preempt

Coreswitch1(config-if)#standby 1 timers 1 4

Coreswitch1(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch1(config)#interface Vlan30

Coreswitch1(config-if)#no IP

Coreswitch1(config-if)#standby 1 ip 172.16.2.62

Coreswitch1(config-if)#standby 1 priority 104

Coreswitch1(config-if)#standby 1 preempt

Coreswitch1(config-if)#standby 1 timers 1 4

Coreswitch1(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch1(config)#interface Vlan40

Coreswitch1(config-if)#no IP

Coreswitch1(config-if)#standby 1 ip 172.16.2.94

Coreswitch1(config-if)#standby 1 priority 105

Coreswitch1(config-if)#standby 1 preempt

Coreswitch1(config-if)#standby 1 timers 1 4

Coreswitch1(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch1(config)#interface Vlan50

Coreswitch1(config-if)#no IP

Coreswitch1(config-if)#standby 1 ip 172.16.2.110

Coreswitch1(config-if)#standby 1 priority 106

Coreswitch1(config-if)#standby 1 preempt

Coreswitch1(config-if)#standby 1 timers 1 4

Coreswitch1(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch1(config)#interface Vlan60

Coreswitch1(config-if)#no IP

Coreswitch1(config-if)#standby 1 ip 172.16.2.126

Coreswitch1(config-if)#standby 1 priority 107

Coreswitch1(config-if)#standby 1 preempt

Coreswitch1(config-if)#standby 1 timers 1 4

Coreswitch1(config-if)#standby 1  track Gigaethernet1/0/2

please check this configuration and suggest me if have any corrections

thanks

Sreejesh S

0 Helpful

Go to solution
blau grana
Level 7
Level 7
In response to Sreejesh S

‎03-25-2013 02:43 AM

Hello Sreejesh,

First of all, you have to configure IP addresses on Vlan interfaces, if you do not do that, HSRP will not work.

Second, we need to see configuration of second switch where HSRP will be enabled and how both switches will be connected together.

Best Regards

Please rate all helpful posts and close solved questions

Best Regards Please rate all helpful posts and close solved questions
0 Helpful

Go to solution
Sreejesh S
Level 1
Level 1
In response to blau grana

‎03-25-2013 04:01 AM

thanks for your inputs

please find bot switch configuration

Cisco 4900 Core switch  1

Switch>enable

Switch#configure terminal

Switch(config)#hostname Coreswitch1

Coreswitch1(config)#enable secret Cisco

Coreswitch1(config)#banner motd #Welcome Authorized Users Unauthorized access prohibited!#

Coreswitch1(config)#line vty 0 4

Coreswitch1(config-line)#password cisco123

Coreswitch1(config-line)#login

Coreswitch1(config)#line console 0

Coreswitch1(config-line)#password cisco123

Coreswitch1(config-line)#login

Coreswitch1(config)#vlan 10

Coreswitch1(config-vlan)#name data

Coreswitch1(config)#vlan 20

Coreswitch1(config-vlan)#name Mgt

Coreswitch1(config)#vlan 30

Coreswitch1(config-vlan)#name LIOM

Coreswitch1(config)#vlan 40

Coreswitch1(config-vlan)#name IPCam

Coreswitch1(config)#vlan 50

Coreswitch1(config-vlan)#name BUR

Coreswitch1(config)#vlan 60

Coreswitch1(config-vlan)#name Heartbeats

Coreswitch1(config)#interface range fastEthernet 1/0/4– 20

Coreswitch1(config-if)#description to Dell Server

Coreswitch1(config-if-range)#switchport mode access

Coreswitch1(config-if-range)#switchport access vlan 10

Coreswitch1(config-if-range)#No Shutdown

Coreswitch1(config)#interface range fastEthernet 1/0/21-25

Coreswitch1(config-if)#description to Mangnt port

Coreswitch1(config-if-range)#switchport mode access

Coreswitch1(config-if-range)#switchport access vlan 20

Coreswitch1(config-if-range)#No Shutdown

Coreswitch1(config)#interface Gigaethernet1/0/1

Coreswitch1(config-if)#description to Firewall

Coreswitch1(config-if)#switchport mode trunk

Coreswitch1(config-if)#switchport trunk encapsulation dot1q

Coreswitch1(config-if)#switchport trunk allowed vlan all

Coreswitch1(config)#interface Gigaethernet1/0/2

Coreswitch1(config-if)#description to Coreswitch2

Coreswitch1(config-if)#switchport mode trunk

Coreswitch1(config-if)#switchport trunk encapsulation dot1q

Coreswitch1(config-if)#switchport trunk allowed vlan all

Coreswitch1(config)#interface Gigaethernet1/0/3

Coreswitch1(config-if)#description to Access Switch

Coreswitch1(config-if)#switchport mode trunk

Coreswitch1(config-if)#switchport trunk encapsulation dot1q

Coreswitch1(config-if)#switchport trunk allowed vlan all

Coreswitch1(config)#interface port-channel 1

Coreswitch1(config-if)#description to Dell Server

Coreswitch1(config-if)#no ip address

Coreswitch1(config-if)#logging event link-status

Coreswitch1(config-if)#switchport

Coreswitch1(config-if)#switchport access vlan 10

Coreswitch1(config)#interface  range fastEthernet 1/0/4 – 20

Coreswitch1(config-if)#no ip address

Coreswitch1(config-if)#logging event link-status

Coreswitch1(config-if)#channel-group 1 mode active

Coreswitch1(config)#spanning-tree mode rapid-pvst

Coreswitch1(config)#spanning-tree loopguard default

Coreswitch1(config)#no spanning-tree optimize bpdu transmission

Coreswitch1(config)#spanning-tree extend system-id

Coreswitch1(config)#spanning-tree pathcost method long

Coreswitch1(config)#interface Vlan10

Coreswitch1(config-if)#Ip address 172.16.1.253 255.255.255.0

Coreswitch1(config-if)#standby 1 ip 172.16.1.254

Coreswitch1(config-if)#standby 1 priority 102

Coreswitch1(config-if)#standby 1 preempt

Coreswitch1(config-if)#standby 1 timers 1 4

Coreswitch1(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch1(config)#interface Vlan20

Coreswitch1(config-if)# Ip address 172.16.2.29 255.255.255.224

Coreswitch1(config-if)#standby 1 ip 172.16.2.30

Coreswitch1(config-if)#standby 1 priority 103

Coreswitch1(config-if)#standby 1 preempt

Coreswitch1(config-if)#standby 1 timers 1 4

Coreswitch1(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch1(config)#interface Vlan30

Coreswitch1(config-if)# Ip address 172.16.2.61 255.255.255.224

Coreswitch1(config-if)#standby 1 ip 172.16.2.62

Coreswitch1(config-if)#standby 1 priority 104

Coreswitch1(config-if)#standby 1 preempt

Coreswitch1(config-if)#standby 1 timers 1 4

Coreswitch1(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch1(config)#interface Vlan40

Coreswitch1(config-if)# Ip address 172.16.2.93 255.255.255.224

Coreswitch1(config-if)#standby 1 ip 172.16.2.94

Coreswitch1(config-if)#standby 1 priority 105

Coreswitch1(config-if)#standby 1 preempt

Coreswitch1(config-if)#standby 1 timers 1 4

Coreswitch1(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch1(config)#interface Vlan50

Coreswitch1(config-if)# Ip address 172.16.2.109 255.255.255.224

Coreswitch1(config-if)#standby 1 ip 172.16.2.110

Coreswitch1(config-if)#standby 1 priority 106

Coreswitch1(config-if)#standby 1 preempt

Coreswitch1(config-if)#standby 1 timers 1 4

Coreswitch1(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch1(config)#interface Vlan60

Coreswitch1(config-if)# Ip address 172.16.2.125 255.255.255.224

Coreswitch1(config-if)#standby 1 ip 172.16.2.126

Coreswitch1(config-if)#standby 1 priority 107

Coreswitch1(config-if)#standby 1 preempt

Coreswitch1(config-if)#standby 1 timers 1 4

Coreswitch1(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch1(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.1

Coreswitch1(config)#vtp mode server

Coreswitch1(config)#vtp domain KP

Coreswitch1(config)#vtp password Cisco

Cisco 4900 Core switch2

Switch>enable

Switch#configure terminal

Switch(config)#hostname Coreswitch2

Coreswitch2(config)#enable secret Cisco

Coreswitch2(config)#banner motd #Welcome Authorized Users Unauthorized access prohibited!#

Coreswitch2(config)#line vty 0 4

Coreswitch2(config-line)#password cisco123

Coreswitch2(config-line)#login

Coreswitch2(config)#line console 0

Coreswitch2(config-line)#password cisco123

Coreswitch2(config-line)#login

Coreswitch2(config)#vlan 10

Coreswitch2(config-vlan)#name data

Coreswitch2(config)#vlan 20

Coreswitch2(config-vlan)#name Mgt

Coreswitch2(config)#vlan 30

Coreswitch2(config-vlan)#name LIOM

Coreswitch2(config)#vlan 40

Coreswitch2(config-vlan)#name IPCam

Coreswitch2(config)#vlan 50

Coreswitch2(config-vlan)#name BUR

Coreswitch2(config)#vlan 60

Coreswitch2(config-vlan)#name Heartbeats

Coreswitch2(config)#interface range fastEthernet 1/0/4– 20

Coreswitch2(config-if)#description to Dell Server

Coreswitch2(config-if-range)#switchport mode access

Coreswitch2(config-if-range)#switchport access vlan 10

Coreswitch2(config-if-range)#No Shutdown

Coreswitch2(config)#interface range fastEthernet 1/0/21-25

Coreswitch2(config-if)#description to Mangnt port

Coreswitch2(config-if-range)#switchport mode access

Coreswitch2(config-if-range)#switchport access vlan 20

Coreswitch2(config-if-range)#No Shutdown

Coreswitch2(config)#interface Gigaethernet1/0/1

Coreswitch2(config-if)#description to Firewall

Coreswitch2(config-if)#switchport mode trunk

Coreswitch2(config-if)#switchport trunk encapsulation dot1q

Coreswitch2(config-if)#switchport trunk allowed vlan all

Coreswitch2(config)#interface Gigaethernet1/0/2

Coreswitch2(config-if)#description to Coreswitch1

Coreswitch2(config-if)#switchport mode trunk

Coreswitch2(config-if)#switchport trunk encapsulation dot1q

Coreswitch2(config-if)#switchport trunk allowed vlan all

Coreswitch2(config)#interface Gigaethernet1/0/3

Coreswitch2(config-if)#description to Access Switch

Coreswitch2(config-if)#switchport mode trunk

Coreswitch2(config-if)#switchport trunk encapsulation dot1q

Coreswitch2(config-if)#switchport trunk allowed vlan all

Coreswitch2(config)#interface port-channel 1

Coreswitch2(config-if)#description to Dell Server

Coreswitch2(config-if)#no ip address

Coreswitch2(config-if)#logging event link-status

Coreswitch2(config-if)#switchport

Coreswitch2(config-if)#switchport access vlan 10

Coreswitch2(config)#interface  range fastEthernet 1/0/4 – 20

Coreswitch2(config-if)#no ip address

Coreswitch2(config-if)#logging event link-status

Coreswitch2(config-if)#channel-group 1 mode active

Coreswitch2(config)#spanning-tree mode rapid-pvst

Coreswitch2(config)#spanning-tree loopguard default

Coreswitch2(config)#no spanning-tree optimize bpdu transmission

Coreswitch2(config)#spanning-tree extend system-id

Coreswitch2(config)#spanning-tree pathcost method long

Coreswitch2(config)#interface Vlan10

Coreswitch2(config-if)#Ip address 172.16.1.252 255.255.255.0

Coreswitch2(config-if)#standby 1 ip 172.16.1.254

Coreswitch2(config-if)#standby 1 priority 102

Coreswitch2(config-if)#standby 1 preempt

Coreswitch2(config-if)#standby 1 timers 1 4

Coreswitch2(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch2(config)#interface Vlan20

Coreswitch2(config-if)# Ip address 172.16.2.28 255.255.255.224

Coreswitch2(config-if)#standby 1 ip 172.16.2.30

Coreswitch2(config-if)#standby 1 priority 103

Coreswitch2(config-if)#standby 1 preempt

Coreswitch2(config-if)#standby 1 timers 1 4

Coreswitch2(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch2(config)#interface Vlan30

Coreswitch2(config-if)# Ip address 172.16.2.60 255.255.255.224

Coreswitch2(config-if)#standby 1 ip 172.16.2.62

Coreswitch2(config-if)#standby 1 priority 104

Coreswitch2(config-if)#standby 1 preempt

Coreswitch2(config-if)#standby 1 timers 1 4

Coreswitch2(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch2(config)#interface Vlan40

Coreswitch2(config-if)# Ip address 172.16.2.92 255.255.255.224

Coreswitch2(config-if)#standby 1 ip 172.16.2.94

Coreswitch2(config-if)#standby 1 priority 105

Coreswitch2(config-if)#standby 1 preempt

Coreswitch2(config-if)#standby 1 timers 1 4

Coreswitch2(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch2(config)#interface Vlan50

Coreswitch2(config-if)# Ip address 172.16.2.108 255.255.255.224

Coreswitch2(config-if)#standby 1 ip 172.16.2.110

Coreswitch2(config-if)#standby 1 priority 106

Coreswitch2(config-if)#standby 1 preempt

Coreswitch2(config-if)#standby 1 timers 1 4

Coreswitch2(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch2(config)#interface Vlan60

Coreswitch2(config-if)# Ip address 172.16.2.124 255.255.255.224

Coreswitch2(config-if)#standby 1 ip 172.16.2.126

Coreswitch2(config-if)#standby 1 priority 107

Coreswitch2(config-if)#standby 1 preempt

Coreswitch2(config-if)#standby 1 timers 1 4

Coreswitch2(config-if)#standby 1  track Gigaethernet1/0/2

Coreswitch2(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.1

Coreswitch2(config)#vtp mode server

Coreswitch2(config)#vtp domain KP

Coreswitch2(config)#vtp password Cisco

both switch connected through Ge1/0/2

0 Helpful

Go to solution
blau grana
Level 7
Level 7
In response to Sreejesh S

‎03-25-2013 08:19 AM

IP addressing looks good, but I do not get why did you configure same priority for both switches. You should prefer one switch over another, or maybe you can configure "load-balancing" -> half of vlans will be go over one switch and another half over other switch.

Also, I see no point of tracking interface Gigaethernet1/0/2 on both firewalls, both firewalls will send HSRP hellos via these interfaces (directly connected) so if interface or link fail, no hellos will be received and HSRP peer will be presumed dead.

You should rather track your uplink interfaces to internet, because there is no point to be a gateway for LAN if you do not have working uplink to internet.

Or you should configure IP SLA and track state of IP SLA [monitoring gateway] because sometimes uplink port is up/up but link is not working properly.

Best Regards

Please rate all helpful posts and close solved questions

Best Regards Please rate all helpful posts and close solved questions
0 Helpful

Go to solution
Sreejesh S
Level 1
Level 1
In response to blau grana

‎03-25-2013 08:56 PM

thanks for your inputs

1).regarding that priority its my mistake while configure it should be different because I am looking for Active/Standby mode

2).then could you please advice me how can configure IP SLA for G1/0/2 which one connected inbetween HSRP switches

3.) And need to configure  internet uplink which one conneted to G1/0/1 in both switch

thanks

Sreejesh

0 Helpful

Go to solution
blau grana
Level 7
Level 7
In response to Sreejesh S

‎03-26-2013 02:53 AM 

2).then could you please advice me how can configure IP SLA for G1/0/2 which one connected inbetween HSRP switches

ip sla 1

icmp-echo IP_ADDRESS_GW

ip sla schedule 1 life forever start-time now

track 1 ip sla 1 state

interface VlanXYZ

standby 1 track 1 decrement 50

You will track some IP [IP_ADDRESS_GW] which is only accessible via local uplink interface. IP SLA and TRACKing allow you to manipulate some parameters, delay, threshold, timeout so maybe you will play with these to tune failover.

If tracked IP will not be accessible, tracking state will change to DOWN, and standby priority will decrement by 50.

3.) And need to configure  internet uplink which one conneted to G1/0/1 in both switch

I can not help you with this, cause I do not know any details about your connection/ISP/IP addresses/where do you connect G1/0/1 port/etc...

Best Regards

Please rate all helpful posts and close solved questions

Best Regards Please rate all helpful posts and close solved questions
0 Helpful

Go to solution
Gregory Snipes
Level 4
Level 4
In response to Sreejesh S

‎03-20-2013 07:02 AM

Your diagram indicated these are checkpoint firewalls. I have no idea how those work but a quick Google search revealed this aministration guide. You would need to look under the failover section for information on how to do what you are looking for.

0 Helpful
Customers Also Viewed These Support Documents
Review Cisco Networking for a $25 gift card