Cisco IOS HSRP Problem – More than one Active router


HSRP is commonly used as a router failover mechanism, where one router in the group is active and all other group members are in standby. A standby router will take over as the active router when connectivity to the active router is lost.

Today I encountered a strange problem where I had a HSRP group setup with two routers one active and one standby. I had used SVI interfaces (Vlan interfaces) to setup the HSRP and made sure that the active router has been setup with a higher priority as shown below:

Router 1

interface Vlan82
 ip address 10.1.82.3 255.255.255.0
 ip access-group ACL_VLAN82_IN in
 ip access-group ACL_VLAN82_OUT out
 standby 82 ip 10.1.82.1
 standby 82 priority 120
 standby 82 preempt

Router 2

interface Vlan82
 ip address 10.1.82.2 255.255.255.0
 ip access-group ACL_VLAN82_IN in
 ip access-group ACL_VLAN82_OUT out
 standby 82 ip 10.1.82.1

However, upon verifying the status of the HSRP instance on each of the SVIs by issuing

sh standby vlan 82

I noticed that both routers were in an active state!!

Vlan82 - Group 82
  State is Active
    1 state change, last state change 3d03h
  Virtual IP address is 10.1.82.1
  Active virtual MAC address is 0000.0c07.ac52
    Local virtual MAC address is 0000.0c07.ac52 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 2.208 secs
  Preemption enabled
  Active router is local
  Standby router is 10.1.82.2, priority 100 (expires in 10.208 sec)
  Priority 120 (configured 120)
  Group name is "hsrp-Vl82-82" (default)

Both routers had “Active router is Local” and were in “Active state” even though the active router has a higher priority.

This infact was a simple problem related to how HSRP members communicate. HSRP packets uses multicast address 224.0.0.2 and UDP port 1985 to communicate with peers.

When I had applied access-lists on the SVI, I had forgotten to permit HSRP multicast packets. This caused the members of the group to be have lost communication with each other and thus each router took an active state as the routers did not see it’s peer.

It is fundamentally important that HSRP peers are on the same network segment and are able to reach each other. Therefore if you were to implement ACLs on your interfaces, make sure you allow UDP multicast packets to 224.0.0.2 on port 1985!

Related Posts with Thumbnails

About the Author

Alfred Tong
Author and owner of this blog. A Networking enthusiast, full time networking and systems Engineer. Generally curious about all things IT.Certifications: GIAC GSEC, CCNP-S, CCNP, CCSP, CCDP, CCNA, RHCE, JNCIA - FWV