1.2 实验环境和网络拓扑
![]()
1.3 完成标准
(1)按照拓扑图要求连接路由器、交换机和PC，在交换机上配置HSRP组，PC之间完成连通性;
(2) 关闭路由器任意一个接口或拔线，PC之间仍然能够连通。
1.4 实验设备说明：本实验完全是基于DynamipsGUI2.7版本上做的，增加了两台虚拟PC，用两台C3620来模拟路由器；再用两台C3640来模拟交换机（各增加1个NM-16ESW模块）。因为两台C3640路由器增加了交换模块，所以在实际配置时。完全不用为两台3640配置三层地址，可以当做一个三层交换机来使用。由于2.7版本增加了虚拟PC的功能，所有再不用桥接本地或虚拟机网卡的情况下最大支持9台虚拟PC。本实验使用了两台虚拟PC。
2．详细操作步骤
Step 1: 配置路由器的HSRP
(1) 配置路由器R1和R2的HSRP组和各自的优先级、占先权及端口跟踪
路由器R1配置如下：
Router>en
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#ho R1
R1(config)#interface f0/0
//配置接口IP
R1(config-if)#ip address 192.168.10.1 255.255.255.0
R1(config-if)#no shut
*Dec 12 20:16:19.683: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*Dec 12 20:16:20.683: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
R1(config-if)#duplex full
R1(config-if)#standby 10 ip 192.168.10.10
//配置group为10的HSRP地址
R1(config-if)#standby 10 priority 200
//配置group为10的优先权200
R1(config-if)#standby 10 preempt
//配置group为10的占先权
R1(config-if)#standby 10 track f1/1 100
//配置group为10的端口跟踪f1/1
R1(config-if)#
*Dec 12 20:17:27.427: %HSRP-6-STATECHANGE: FastEthernet0/0 Grp 10 state Standby
-> Active
//F0/0 group 10声明备份状态->活跃
R1(config-if)#interface f1/1
//配置接口IP
R1(config-if)#ip address 192.168.20.2 255.255.255.0
R1(config-if)#no shut
*Dec 12 20:18:00.423: %LINK-3-UPDOWN: Interface FastEthernet1/1, changed state to up
*Dec 12 20:18:01.423: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/1, changed state to up
R1(config-if)#standby 20 ip 192.168.20.20
//配置group为20的HSRP地址
R1(config-if)#standby 20 priority 150
//配置group为20的优先权150
R1(config-if)#standby 20 preempt
//配置group为20的占先权
//依据拓扑要求，此路由器只作为group20的备份路由器，此HSRP组有且仅有1台备份路由器，可以不用配置占先权，但实际网络中当活跃路由器停止工作后为防止备份路由器不能立即响应转换为活跃路由器，配置占先权将是转换过程更有保障！
*Dec 12 20:18:48.139: %HSRP-6-STATECHANGE: FastEthernet1/1 Grp 20 state Standby
-> Active
//F1/1 group 20声明备份状态->活跃
R1(config-if)#exit
R1(config)#
*Dec 12 20:20:27.231: %HSRP-6-STATECHANGE: FastEthernet1/1 Grp 20 state Active -
> Speak
//F1/1 group 20声明备份状态->发言
路由器R2配置如下：
Router>en
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#ho R2
R2(config)#interface f1/1
//配置接口IP
R2(config-if)#ip address 192.168.20.1 255.255.255.0
R2(config-if)#no shut
*Dec 12 20:19:43.059: %LINK-3-UPDOWN: Interface FastEthernet1/1, changed state to up
*Dec 12 20:19:44.059: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/1, changed state to up
R2(config-if)#standby 20 ip 192.168.20.20
//配置group为20的HSRP地址
R2(config-if)#standby 20 priority 200
//配置group为20的优先权200
R2(config-if)#standby 20 preempt
//配置group为20的占先权
R2(config-if)#standby 20 track f0/0 150
//配置group为20的端口跟踪f1/1
*Dec 12 20:20:27.047: %HSRP-6-STATECHANGE: FastEthernet1/1 Grp 20 state Standby
-> Active
//F1/1 group 20声明备份状态->活跃
*Dec 12 20:20:39.143: %HSRP-6-STATECHANGE: FastEthernet1/1 Grp 20 state Active -
> Speak
//F1/1 group 20声明备份状态->发言
R2(config-if)#interface f0/0
//配置接口IP
R2(config-if)#ip address 192.168.10.2 255.255.255.0
R2(config-if)#no shut
R2(config-if)#
*Dec 12 20:21:06.251: %HSRP-6-STATECHANGE: FastEthernet1/1 Grp 20 state Standby
-> Active
//F1/1 group 10声明备份状态->活跃
R2(config-if)#
*Dec 12 20:21:06.783: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*Dec 12 20:21:07.783: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
R2(config-if)#standby 10 ip 192.168.10.10
//配置group为10的HSRP地址
R2(config-if)#standby 10 priority 150
//配置group为10的优先权150
R2(config-if)#standby 10 preempt
//配置group为10的占先权
*Dec 12 20:21:48.511: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on Fast
Ethernet0/0 (not full duplex), with SW1 FastEthernet0/2 (full duplex).100
R2(config-if)#duplex full
*Dec 12 20:22:18.327: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthern
et1/1, changed state to down
//F1/1接口状态断开
*Dec 12 20:22:18.327: %HSRP-6-STATECHANGE: FastEthernet1/1 Grp 20 state Active -
> Init
//F1/1 group 20声明备份状态->初始
*Dec 12 20:22:20.335: %LINK-3-UPDOWN: Interface FastEthernet1/1, changed state to up
//F1/1 接口状态连接
*Dec 12 20:22:21.335: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/1, changed state to up
*Dec 12 20:22:41.275: %HSRP-6-STATECHANGE: FastEthernet1/1 Grp 20 state Standby
-> Active
//F1/1 group 20声明备份状态->活跃
R2(config-if)#exit
(2)配置PC机的IP地址和网关
V0/1:ip 192.168.10.11 192.168.10.10
V0/2:ip 192.168.20.22 192.168.20.20
注释：VPC的IP配置不能像模拟的路由器或交换机一样能以文件的形式将ios或配置文件保存到Flash或VMRAM中，所以关闭VPC cmd后下次使用时用show ip命令会发现上次的ip配置没有保存，所以下次使用实验包时记得再次配置下VPC，期待后续版本能修正这个缺点。
(3)验证HSRP配置和网络连通性
路由器R1配置如下：
R1(config)#do show standby brief
//显示备份摘要信息
P indicates configured to preempt.
//P说明被设置为占先权
|
Interface Grp Prio P State Active Standby Virtual IP
Fa0/0 10 200 P Active local 192.168.10.2 192.168.10.10
Fa1/1 20 150 P Standby 192.168.20.1 local 192.168.20.20
R1(config)#do show standby
//显示备份信息
FastEthernet0/0 - Group 10
//接口F0/0-Group 10
State is Active
//状态为活跃
2 state changes, last state change 00:08:03
//2次状态变化，最后张太变化8分33秒
Virtual IP address is 192.168.10.10
//虚拟IP地址192.168.10.10
Active virtual MAC address is 0000.0c07.ac0a
//活跃虚拟MAC地址0000.0c07.ac0a
Local virtual MAC address is 0000.0c07.ac0a (default)
//本地虚拟MAC地址0000.0c07.ac0a (默认)
Hello time 3 sec, hold time 10 sec
//握手间隔3秒，保持时间10秒
Next hello sent in 2.792 secs
//下次握手将在2.792秒后发送
Preemption enabled
//占先权开启
Active router is local
//活跃路由器是本地路由器
Standby router is 192.168.10.2, priority 150 (expires in 9.672 sec)
//备份路由器是192.168.10.2，优先权150（9.672秒后过期）
Priority 200 (configured 200)
//优先权200（配置为200）
Track interface FastEthernet1/1 state Up decrement 10
//跟踪端口F1/1 状态开启 优先权减少两100
IP redundancy name is "hsrp-Fa0/0-10" (default)
//IP冗余名字”hsrp-Fa0/0-10”(默认)
FastEthernet1/1 - Group 20
State is Standby
9 state changes, last state change 00:02:32
Virtual IP address is 192.168.20.20
Active virtual MAC address is 0000.0c07.ac14
Local virtual MAC address is 0000.0c07.ac14 (default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 0.796 secs
Preemption enabled
Active router is 192.168.20.1, priority 200 (expires in 8.224 sec)
Standby router is local
Priority 150 (configured 150)
Track interface FastEthernet0/0 state Up decrement 10
IP redundancy name is "hsrp-Fa1/1-20" (default)
路由器R2配置如下：
R2(config)#do show standby brief
P indicates configured to preempt.
|
Interface Grp Prio P State Active Standby Virtual IP
Fa0/0 10 150 P Standby 192.168.10.1 local 192.168.10.10
Fa1/1 20 200 P Active local 192.168.20.2 192.168.20.20
PC1连通性如下：
PC1(config)#do ping 192.168.20.22
//ping PC2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.22, timeout is 2 seconds:
....!
//初次连接会丢包部分
Success rate is 20 percent (1/5), round-trip min/avg/max = 220/220/220 ms
PC1(config)#do ping 192.168.20.22
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.22, timeout is 2 seconds:
!!!!!
//再次连接完全正常
Success rate is 100 percent (5/5), round-trip min/avg/max = 184/282/336 ms
PC2连通性如下：
PC2(config)#do ping 192.168.10.11
//ping PC1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.10.11, timeout is 2 seconds:
!!!!!
//连通性正常
Success rate is 100 percent (5/5), round-trip min/avg/max = 140/233/468 ms
Step 2: 断开任意一个路由器接口的网络连通性
路由器R2配置如下：
R2(config)#interface f1/1
R2(config-if)#shutdown
//关闭接口F1/1
*Dec 12 20:26:49.067: %HSRP-6-STATECHANGE: FastEthernet1/1 Grp 20 state Active -
> Init
//F1/1 Group 20 状态 活跃->初始
*Dec 12 20:26:51.067: %LINK-5-CHANGED: Interface FastEthernet1/1, changed state
to administratively down
//接口F1/1，转变状态到管理性关闭
*Dec 12 20:26:52.067: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/1, changed state to down
R2(config-if)#exit
R2(config)#do show standby brief
P indicates configured to preempt.
|
Interface Grp Prio P State Active Standby Virtual IP
Fa0/0 10 50 P Standby 192.168.10.1 local 192.168.10.10
Fa1/1 20 200 P Init unknown unknown 192.168.20.20
// Fa1/1 状态为初始，活跃未知，备份未知
路由器R1配置如下：
*Dec 12 20:26:57.407: %HSRP-6-STATECHANGE: FastEthernet1/1 Grp 20 state Standby
-> Active
//R1的F1/1 Group 20状态备份->活跃
R1(config)#do show standby brief
P indicates configured to preempt.
|
Interface Grp Prio P State Active Standby Virtual IP
Fa0/0 10 200 P Active local 192.168.10.2 192.168.10.10
Fa1/1 20 150 P Active local unknown 192.168.20.20
//Fa1/1 状态活跃 活跃本地 备份未知
PC1连通性如下：
PC1(config)#do ping 192.168.20.22
//ping PC2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.22, timeout is 2 seconds:
!!!!!
//连通性良好
Success rate is 100 percent (5/5), round-trip min/avg/max = 76/124/172 ms
PC2连通性如下：
PC2(config)#do ping 192.168.10.11
//ping PC1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.10.11, timeout is 2 seconds:
!!!!!
//连通性良好
Success rate is 100 percent (5/5), round-trip min/avg/max = 64/105/184 ms
3．实验总结
热备份路由协议HSRP (Hot Standby Router Protocol) Cisco平台特有技术，确保了当网络边缘设备或接入链路出现故障时，用户通信能迅速并透明地恢复，并以此为IP网络提供冗余性和一定的负载分担能力。通过应用HSRP可是网络正常运行时间接近100%，从而满足用户对网络可靠性要求。知识点总结如下：
l 网络终端设备发现可用路由器有3种方式：默认网关(Default Gateway)；代理ARP(Proxy ARP)；ICMP路由器发现协议(ICMP Router Discovery Protocol, IRDP)
l HSRP组成员包括：一台活跃路由器、一台备份路由器、一台虚拟路由器和其他路由器
l HSRP工作状态依次有：初始状态；学习状态；监听状态；发言状态；备份状态；活跃状态。
l 通常HSRP计时器的保持时间会大于或等于Hello间隔时间。
l HSRP可建立8字符明文认证字符串以保证HSRP组正确性和提供一定程度的安全性，但明文密码容易被探测并重放到线路中。
附录：配置文件
==========================================================
R1的配置
interface f0/0
ip address 192.168.10.1 255.255.255.0
no shut
standby 10 ip 192.168.10.10
standby 10 priority 200
standby 10 preempt
standby 10 track f1/0 100
interface f1/0
ip address 192.168.20.2 255.255.255.0
no shut
standby 20 ip 192.168.20.20
standby 20 priority 150
standby 20 preempt
==========================================================
R2的配置
interface f0/0
ip address 192.168.10.2 255.255.255.0
no shut
standby 10 ip 192.168.10.10
standby 10 priority 150
standby 10 preempt
interface f1/0
ip address 192.168.20.1 255.255.255.0
no shut
standby 20 ip 192.168.20.20
standby 20 priority 200
standby 20 preempt
standby 20 track f0/0 150
==========================================================
VPC的配置
V0/1:ip 192.168.10.11 192.168.10.10
V0/2:ip 192.168.20.22 192.168.20.20
==========================================================
++++++++++++++++++++++++++++++++++++
config t
no ip domain-lookup
enable secret cisco
line console 0
password cisco
login
logging s
no exec-time
line vty 0 15
password cisco
login
logging s
no exec-time
exit
+++++++++++++++++++++++++++++++++++++
本文出自 51CTO.COM技术博客 