HSRP disaster

I’ve got a customer that has lots of VLANs on a pair of 6509s, each with an HSRP gateway that is in group 0. They also have a Firewall Services Module (FWSM) in there, operating in transparent mode – but I *think* this might be irrelevant.

What happened recently was that some goon put a server in the server VLAN with the IP address of the HSRP gateway. What seemed to happen was that the HSRP failed over – for ALL the VLANs, not just the one the server was in.

Is this normal, do you think? If all standbys use the same group number, do they all need to fail over if there’s a problem?

Odd thing was that the logs show one VLAN’s HSRP saying that (once the failover had happened) the active HSRP master had a different IP address from the one configured – the IP address was from another VLAN. Almost as though there was some leakage between VLANs at layer-2 maybe – the common virtual MAC address might have been recognised as being the other partner in the HSRP pair maybe?

Would welcome any thoughts.

We’re considering different HSRP groups, and maybe ARP inspection/ACLs to protect the gateway, but can’t make ARP ACLs work right now.

Multicast frustration.

Ugh!   Just been doing some testing with PIM sparse mode and run up against what is probably a code issue.

The situation – two routers connected together over ethernet.  R1 has ‘ip igmp join-group 230.0.0.1′ on its ethernet interface – this makes it a listener for that group.   R2 is a PIM bootstrap router (BSR) and rendezvous point (RP).   Now, I should be able to ping 230.0.0.1 from R2 and receive a response, but I wasn’t getting anything.

IP SLA-dependent static routing

Just for reference really: I needed to have a static route whose presence depended on the IP reachability of a host. If the host wasn’t there, the static route should disappear, and default routing take over.

vlan.dat location in Dynamips

Well – just began my CCIE SP study in earnest today – after almost a year of procrastination!

I got a dedicated Ubuntu box, and run Dynamips there.  GNS3 is running on my Mac, leaving the dedicated machine doing the hard work.

Cisco launches the ASR 9000

Interesting news from Cisco this morning: they’ve just launched the new ASR 9000 – an aggregation services router aimed at providing scalable video delivery, increased mobile backhaul capacity and carrier ethernet services at the edge.

Trunking and sub-interfaces on the same switchport

For some reason, I never knew that you could trunk and use a sub-interface on the same port of a Catalyst 6500, so I’m recording it here for personal reference.

What I wanted to achieve was to connect two 7600 routers over an Ethernet pseudowire (E-Line, EoMPLS circuit, AToM circuit, Martini circuit – whatever it’s called these days).   The reason I needed to do so was that the interveninig 6500 routers were only getting a default route via BGP from the 7600s.

Configuration lock in IOS

Just read a really nice guide to exclusive configuration mode access in IOS, written by Joe Harris.

Its a useful way of stopping other people pulling the rug from under your feet (while you’re busy scratching your head about some route-map or other).

Really simple policy-routing in IOS

For some reason (and for quite a long time) policy routing seemed a bit of a scary subject.  I’ve noticed other people don’t like it very much either, but it is actually not all that bad.

MTU setting differences between 7600 and ME3750

Just for personal reference really:

The ME3750 has several ways of setting the MTU:

L2TPv3 revision notes – architecture

L2TPv3 has been designed to transport layer-2 frames of various types over a layer-3 backbone.  Some aspects of the configuration are similar to that of EoMPLS – just without the need to deploy MPLS!

Packets are tunneled across the layer-3 network completely transparently, such that the two devices appear to be connected together. In the case of ethernet tunneling, there is no learning of MAC addresses – what goes in one side, comes out the other. That includes CDP, Spanning Tree and so on.