Digging into HSRP
This section provides detailed information on HSRP (as described in RFC 2281 and extensions implemented by Cisco). HSRP is actually simple. Routers participating in
HSRP exchange HSRP messages to discover each other, to elect the active router, and to check the active router's health. A standby router becomes active when
• It receives no more HSRP hello messages from the active router.
• The active router explicitly wants to become standby. (For example, it just lost its WAN connectivity.)
There is the possibility for a standby router to immediately take over the role of the active router. The HSRP message indicates this coup.
HSRP runs on top of User Datagram Protocol (UDP) on port number 1985 for IPv4 and on port 2029 for IPv6. Packets are sent to multicast address 224.0.0.2 or 224.0.0.102 with TTL 1. Routers use their actual IP address as the source address for protocol packets, not the virtual IP address. This is so that the HSRP routers can identify each other. Standby routers use their own MAC addresses as source MAC, while the active router uses the virtual MAC address. Figure 9-2 shows the HSRP packet format.
Figure 9-2 HSRP Version 1 Packet Format
Version
Op code
State
Holdtime
Priority
Group
Reserved
Authentication Data
Authentication Data
Virtual IP Address
The Authentication Data field is used for authentication. In RFC 2281, authentication is simply a password sent in the clear. The default password is 63 69 73 63 6F 00 00 00. (This spells cisco with three trailing 0s.)
The Priority field elects the active and standby routers. When comparing the priorities of two different routers, the router with the numerically higher priority wins. In the case of routers with equal priority, the router with the higher IP address wins.
Continue reading here: Using Strong Authentication
Was this article helpful?