Hot Standby Router Protocol (HSRP)

With this design, but no FHRP, host A can send packets off-subnet as long as connectivity exists from host A to R1. Similarly, host B can send packets off-subnet as long as host B has connectivity to router R2. Both routers can attach to the same LAN subnet, and basically ignore each other in relation to their roles as default router, because they do not use an FHRP option. When either router fails, the hosts using that router as default router have no means by which to fail over.

Of the available options, the only one that is correct is that R2 would be and remain the active HSRP router until it failed, was shut down, or was reloaded. Neither R1 nor R2 was configured with HSRP preemption (at least not for the appropriate HSRP group) and the priority configured on R2 is not the default priority (100).

Two HSRP misconfigurations cause both HSRP routers to attempt to use the same virtual IP address (VIP), at the same time, because both routers believe that they should be active. With a correct configuration other than mismatched group numbers, the two routers act independently, both using the VIP, resulting in the duplicate address message. The same kind of logic applies when the two routers have correct configuration other than a mismatched HSRP version: they do not act together, but act independently, both use the address, and then detect the duplicate use of the address. As for the incorrect answers, an ACL that prevents a router from even receiving the HSRP messages will prevent that router from noticing the duplicate use of the VIP, so it does not list the duplicate address log message. Finally, if the configuration mistake is that the two routers configure two different VIPs, then they are using different addresses, so there is no need to issue a message about using duplicate addresses.

R2 has a better priority because the priority value is higher. However, because R1 comes up first, R1 becomes HSRP active before R2 boots. R2 must then have preemption configured, otherwise it will not preempt R1 to become active. As for the wrong answers, R1’s preemption setting does not matter in this case. The other two wrong answers state that a router is active regardless of other settings, and the answer is dependent on other configuration.

The command, taken from R3, lists R3 as HSRP active. That means R3 currently takes on the role of the router with the virtual IP address, listed as 10.1.12.2. R3 will send back Address Resolution Protocol (ARP) Reply messages when hosts send ARP messages looking for 10.1.12.2, and process packets sent to the matching virtual MAC address. The 10.1.12.1 IP address is the interface IP address of the other router in the HSRP group, the one that is standing by to take over for Router R3. Finally, R3 does not configure the virtual IP address with the ip address interface command, but instead with the standby group ip virtual-address interface subcommand.

In HSRP, routers do not share the workload for a specific VLAN. If load balancing is wanted, a preference could be configured for each router to actively forward for a single subnet and provide standby service for the other VLANs. There is only one forwarder per VLAN per group in HSRP. Because the correct answer is one forwarder per VLAN/network, the other choices are not correct.

In this case the engineer didn’t provide any configuration information about either router. However, the question stem tell us that one router becomes active, and the other becomes standby, and that the standby becomes active when the active router (R1) fails). That tells us that the two routers are able to receive each others' HSRP messages, and that there isn’t a group or version conflict (ruling out two answers). For the other incorrect answer, the HSRP priority of the secondary router, regardless of how low it is configured, will not affect its ability to forward traffic should the primary router fail. The correct answer is the one answer that lists a failure reason that also allows the various symptoms: namely, that router R2 is configured with the wrong virtual IP address. Routers R1 and R2 can communicate with HSRP even with a mismatched virtual IP address setting, but when the secondary router takes over, it will change the virtual IP address. Because the hosts on the LAN have been configured with a single default gateway, they will no longer have a routing path off the local LAN.

The use of an FHRP in this design purposefully allows either router to fail and still support off-subnet traffic from all hosts in the subnet. Both routers can attach to the same LAN subnet per IPv4 addressing rules.

HSRP works in an active/standby configuration where only a single router is forwarding at the same time within the same HSRP group.

The command to configure an HSRP virtual IP address on an interface is standby group-number ip virtual-ip-address. For this question the correct command would be standby 10 ip 10.10.10.6.

HSRP uses a virtual IP address. The virtual IP address comes from the same subnet as the routers’ LAN interfaces, but is a different IP address than the router addresses configured with the ip address interface subcommand. As a result, the hosts will not point to 10.1.19.1 or 10.1.19.2 in this design. The other wrong answer lists an idea of using Domain Name System (DNS) to direct hosts to the right default router; although this idea exists in some other forms of network load balancing, it is not a part of any of the three FHRP protocols.

The standby group preempt command is used to enable HSRP preemption for a specific HSRP group.