HSRP Mechanics
HSRP's role is to make a group of Layer 2 adjacent routers appear as a single virtual router. One physical router, known as the active router, actually works and forwards IP packets.
The other physical routers, known as standby routers, basically do nothing but keep the HSRP states. When the active router fails, a standby router automatically takes over the active role; that is, it starts forwarding the hosts' packets.
NOTE HSRP is not a routing protocol. Its main application is for hosts who rely on a static default route (for example, learned by DHCP).
Each physical router has its own MAC and IP addresses, but it also shares one MAC and one IP address for the virtual router. Figure 9-1 depicts such a topology when the HSRP group consists of two routers.
In Figure 9-1, the different IP addresses are as follows:
• 192.168.0.7. IP address of interface FastEthernet 0/0 of physical router A.
• 192.168.0.9. IP address of interface FastEthernet 0/0 of physical router B.
• 192.168.0.8. IP address of the interface of the virtual router. This is the shared IP address.
Figure 9-1 Typical HSRP Topology
Normal Hosts with a Default Route to 192.168.0.8
|
1 1 |
||||
|
r l —, ! |
B i " |
gt i ' |
HSRP Group 1 |
|
Router A Virtual Router Router B
IP: 192.168.0.7 IP: 192.168.0.8 IP: 192.168.0.9
MAC: From Hardware MAC: 0000.0C07.AC01 MAC: From Hardware
Router A Virtual Router Router B
IP: 192.168.0.7 IP: 192.168.0.8 IP: 192.168.0.9
MAC: From Hardware MAC: 0000.0C07.AC01 MAC: From Hardware
An additional IP multicast address is used as the destination of all HSRP messages. In version 1 of HSRP, this multicast address was 224.0.0.2 (all routers in the LAN) and, in version 2, it is 224.0.0.102 (all HSRP routers in the LAN). These two addresses are within the link local scope 224.0.0.0/24 of multicast addresses.
Link Local Scope
By definition, all group addresses in the link local scope are valid only within a link; that is, within the LAN. Packets destined to such a link local address are never routed outside the LAN. This also means that no attacker can ever send a forged HSRP packet to a target on a remote LAN because all routers in the path simply drop this packet.
The Time to Live (TTL) field of all HSRP messages is set to 1, so they are never forwarded outside of the local Ethernet segment.
NOTE Routers sending HSRP with a TTL of 1 does not prevent a remote attacker from sending HSRP with a TTL higher than 1. But the IP group multicast address has only a link local scope, so an attacker's HSRP packets addressed to the HSRP group address will never reach the target.
HSRP Mechanics 147
In Figure 9-1, three different MAC addresses are used:
• Actual MAC address of physical router A
• Actual MAC address of physical router B
• MAC address of the virtual router (in this specific configuration, 0000.0C07.AC01)
NOTE The virtual MAC address is always in this form:
• 0000.0C07.ACxx for HSRP version 1
• 0000.0C9F.Fxxx for HSRP version 2 for IPv4
• 0005.73A0.0xxx for HSRP version 2 for IPv6
xx is the HSRP group number. The group number is required to avoid MAC address conflict when multiple HSRP virtual routers exist on the same LAN or when a router participates in multiple HSRP groups (for example, when it has multiple VLAN interfaces and acts as HSRP routers in all VLANs).
All hosts and routers not participating in the HSRP pair never use the physical IP or MAC addresses of routers A and B. Instead, all Layer 2-adjacent hosts and routers use the virtual IP address and virtual MAC address. Because only the active router is sending the HSRP message by using the virtual MAC address, all switches have a content-addressable memory (CAM) entry for this MAC address already in place.
As soon as a standby router becomes active, it sends HSRP messages with the virtual MAC address as its source; therefore, all switches can immediately update their CAM tables.
NOTE The Address Resolution Protocol (ARP) tables of the hosts do not need to change because neither the IP address nor the MAC address of the router has changed. They are still the virtual IP address and MAC address. The difference when the standby router takes over is noticeable only by the switch: It sees the virtual MAC address on the port of the new active router. (This learning is then reflected in its CAM table.)
Continue reading here: Digging into HSRP
Was this article helpful?