ICND2 200-105

ICND2 200-105

Default Gateway Redundancy

The need for default gateway redundancy

Let's set up our problem here. Our PC has a default gateway address of 10.1.10.2. Folks, can you find out who the default gateway is for this PC? Looks to me like it's router A.

Gateway failure

Yeah, I'm just going to type in an ipconfig, and I'm going to see default gateway: 10.1.10.2. Router A might have failed, my connectivity to router A could have failed as well. Router B looks like it could route for my traffic. But we're pointing the client to that IP address and if it loses connectivity to that IP address, it can no longer ARP, short for Address Resolution Protocol, for it. And no one else is going to answer those ARP queries for the default gateway that the client can't connect up to. So now, the end-user calls up your IT help desk, the Internet is down.

No the Internet is not down. Now some of you might be saying right now, well I can configure multiple default gateways on my client. Yeah, operating system supports that. But how quickly will you fail over to the other default gateway? Depends. But a lot of times, it comes right down to the ARP process. I already know who I have to go to, it's 10.1.10.2. I'm going to try it. I'm going to use it. Is it there? Well maybe, maybe not. We have a better solution for this. Let's dive into the solution now.

Instead of pointing our clients to the IP address of something that lives and breathes and is physical, we want to point it to the virtual and have multiple devices participate in the presentation of that virtual entity. So we're going to have a virtual router and in fact, one of the names of the protocols that I mentioned: Virtual Router Redundancy Protocol - VRRP, it says it right there.

Redundancy with Virtual Router

Now VRRP may not be my favorite technology and we are going to look at HSRP, short for Hot Standby Router Protocol, first but they all share the same basic idea. Point clients to the virtual and then have a group of devices that will answer the call of people ARPing for the virtual router, and clients that are forwarding to the virtual router MAC address. Guess what? We're going to have a virtual router MAC address that both the routers involved here understand. And one of them, only one of them should be forwarding out traffic to that virtual MAC address.

This is great, but what happens when a failure occurs? Well we will fail over.

What do we mean by fail over? Well the other router that's participating in this group will not forward that traffic out to the Internet. So have we made any adjustments on our PC here at all? No. We're still pointing to the same virtual IP address, which means we still have the same virtual MAC address. But now it's a different router that's responsible for forwarding traffic. Clients are none the wiser. I send my traffic out, it arrives at the switch, off it goes to the correct default gateway and bye-bye, out to the Internet, out to the core, out to wherever it has to go.