Skip to content
Log in Sign up My account

2.1 Campus High Availability

Blueprint 2.1: Campus high availability

  • 2.1.a First hop redundancy protocols
  • 2.1.b Platform abstraction techniques
  • 2.1.c Graceful restart
  • 2.1.d BFD

ENSLD asks you to choose the availability mechanism that meets a stated recovery requirement, and to predict what still breaks when a component fails. The mechanics of HSRP, VRRP, SSO and NSF are in ENCOR. This page covers which tool fits which failure, how the tools interact, and where designs commonly go wrong. For the basics see ENCOR Design and High Availability and ENCOR FHRP.

Think in failure domains and recovery targets

Every availability design starts with two questions: what can fail, and how fast must traffic recover? Different mechanisms cover different failures and recover at different speeds.

Failure Typical mechanism Recovery scale
Single link in a bundle EtherChannel (hardware rehash) Tens of milliseconds
Single routed link with an equal-cost alternative ECMP, carrier-down detection Tens of milliseconds to sub-second
Link that stays up but is unidirectional or the neighbour is dead BFD plus routing protocol Sub-second (hundreds of ms or less)
Default gateway router FHRP Seconds by default, sub-second when tuned or BFD-assisted
Supervisor or control plane SSO with NSF/NSR, graceful restart Forwarding continues, no neighbour reset
Entire chassis Stacking, StackWise Virtual, dual distribution Depends on the design
Planned software upgrade ISSU or stack rolling upgrade, where supported Minimal or no outage

The design target "five nines" or "no loss for voice" must be mapped to this table. A requirement of "sub-second failover of the gateway" cannot be met by HSRP with default 3 second hello and 10 second hold timers, no matter how redundant the hardware is.

graph TB
  subgraph "Distribution pair"
    D1["Dist 1<br/>HSRP active VLAN 10<br/>STP root VLAN 10"]
    D2["Dist 2<br/>HSRP standby VLAN 10<br/>STP secondary"]
  end
  D1 --- D2
  A1["Access 1"] --- D1
  A1 --- D2
  A2["Access 2"] --- D1
  A2 --- D2
  D1 --- C["Core"]
  D2 --- C

2.1.a First hop redundancy protocols

An FHRP gives hosts one virtual default gateway that survives the loss of a router. Choosing among the three is a design decision.

Consideration HSRP VRRP GLBP
Standards Cisco proprietary IETF open standard Cisco proprietary
Multivendor distribution layer No Yes No
Load sharing Per VLAN or per group, by alternating the active role Same Per host, built in, across the AVFs
Sub-second timers Yes (millisecond hello) VRRPv3 supports centisecond advertisement Yes
IPv6 Yes (HSRPv2) Yes (VRRPv3) Yes
Typical choice Cisco-only campus, the common default Mixed vendors or an open-standard requirement Rare today, since load sharing by VLAN is simpler to troubleshoot

Why GLBP is uncommon in modern campus designs

GLBP balances by handing out different virtual MACs to different hosts. That makes traffic paths harder to predict and troubleshoot, and it still depends on the underlying Layer 2 topology. Most designs balance by VLAN instead: odd VLANs are active on distribution 1, even VLANs on distribution 2.

Design rules for gateway redundancy

  1. Align the roles. For each VLAN the HSRP active router, the STP root and (with MST) the root for the matching instance should be the same switch. Otherwise upstream-bound frames cross the inter-distribution link.
  2. Balance by VLAN. Split VLANs across the two distribution switches so both are used and a failure moves only half the VLANs.
  3. Track upstream. If the uplinks to the core fail, the active gateway must give up the role, or hosts send traffic into a black hole. Use interface or object tracking to lower priority, and enable preemption so the better router takes the role back.
  4. Tune the timers only with a reason. Aggressive hellos on dozens of VLANs add CPU load and risk false failovers during a busy control plane. Where fast detection is needed, use BFD.
  5. Delay preemption after a reload. A rebooted router must not take over before routing has converged, or it becomes a black hole.
  6. Do not use an FHRP where there is no shared gateway. In a routed-access design each access switch is the gateway for its own VLANs, and in SD-Access the anycast gateway is the same address on every edge. Both remove the need for HSRP.
interface Vlan10
 ip address 10.10.10.2 255.255.255.0
 standby version 2
 standby 10 ip 10.10.10.1
 standby 10 priority 110
 standby 10 preempt delay minimum 180
 standby 10 track 1 decrement 20
 standby bfd
!
! global command to enable BFD peering for HSRP on all interfaces
standby bfd all-interfaces

show standby brief
show standby vlan 10
show track

Exam trap

Redundant hardware without a matching FHRP, STP and tracking design is not highly available. If a scenario says users lose connectivity even though both distribution switches are up, look for a misaligned HSRP and STP root, a missing uplink track, or a missing preempt delay.

With a single logical gateway

StackWise Virtual and VSS make two chassis act as one switch, so there is one SVI and one default gateway. No FHRP is needed for gateway failover, because there is nothing to elect. Access switches see a single neighbour and use a multichassis EtherChannel to it. The trade-off is that the two chassis share one control plane, so a software fault or bad configuration can affect both halves.

2.1.b Platform abstraction techniques

"Platform abstraction" means presenting several physical devices as one logical device, or hiding hardware failures from the network. The exam wants you to match the technique to the scale and the failure it hides.

Technique What it does Best for Watch out for
Stacking (StackWise) Several access switches act as one, one control plane, cross-stack EtherChannel Access layer closets Stack cabling and stack member count limits, one control plane
StackWise Virtual / VSS Two chassis in distribution or core act as one switch, multichassis EtherChannel to the access Distribution, small core, no STP blocked links Split-brain if the virtual link fails, so configure dual-active detection
Dual supervisors with SSO Standby supervisor mirrors the active one in the same chassis Modular chassis in distribution and core Protects against supervisor failure only, not chassis or power
ISSU / rolling upgrade Upgrade software with little or no downtime Chassis with redundant supervisors Platform and version support, so check the compatibility matrix
Routed access Moves the L2/L3 boundary to the access switch Campuses that want to avoid STP and FHRP VLANs cannot span closets without an overlay

Dual-active detection. In StackWise Virtual the two chassis are joined by one or more StackWise Virtual Links (SVL). If the SVL fails but both chassis stay up, each might believe it is the only active one, with the same IP addresses and router IDs. That is a split-brain. Dual-active detection (DAD) uses a second path, such as a fast-hello link or enhanced PAgP through an access switch, so the former standby shuts down its ports instead of becoming a second active.

graph LR
  subgraph "StackWise Virtual pair"
    S1["Chassis 1<br/>active"] ==="SVL" === S2["Chassis 2<br/>standby"]
    S1 -. "DAD fast-hello" .- S2
  end
  AC["Access switch"] --- S1
  AC --- S2

Exam trap

A virtual switch pair removes spanning-tree blocked links and the FHRP, but it concentrates the control plane. A question about "protecting against a software fault that affects the whole distribution layer" is not answered by StackWise Virtual. Two independent distribution switches are.

2.1.c Graceful restart

When a supervisor switches over or a routing process restarts, neighbours normally tear down the adjacency and withdraw routes, which causes an outage even though the hardware is still forwarding. Graceful restart lets the data plane keep forwarding on the last known FIB while the control plane recovers.

Term Meaning
NSF The restarting device keeps forwarding while its routing tables rebuild
Graceful restart (GR) The protocol extension that tells neighbours to hold routes: OSPF (RFC 3623 and a Cisco LLS-based method), EIGRP, IS-IS, BGP (RFC 4724)
Restarting device Must be NSF-capable, usually a dual-supervisor system running SSO
Helper device A neighbour that holds routes during the restart. It only needs to be NSF-aware
NSR The standby keeps full protocol state, so neighbours need no special support

Design points to know:

  • GR is only useful when the restarting device is a redundant system. A single-supervisor switch has nothing to switch over to.
  • GR needs neighbours that cooperate. In a mixed-vendor network confirm that the helper side supports the same GR variant.
  • The grace period is a trade-off. A long grace period gives the restart time to finish, but it also keeps traffic flowing toward a router that may really be dead. Pick it for the platform's real recovery time.
  • GR and fast failure detection pull in opposite directions. If BFD declares a neighbour dead quickly, the helper tears down the session and GR is defeated. On platforms where BFD runs in the data plane, BFD can survive a supervisor switchover, so the two can coexist. On platforms where it cannot, choose one for that neighbour.
  • Routed access with non-stop forwarding is the preferred combination when you also need ECMP convergence, because most single failures are handled by the loss of one equal-cost path instead.

Exam trap

SSO by itself does not stop routing neighbours from resetting. It synchronises the standby supervisor. NSF with graceful restart, or NSR, is what hides the switchover from the neighbours.

2.1.d BFD

Routing protocol hellos are slow. OSPF defaults to 10 second hellos with a 40 second dead interval on broadcast links, and BGP keepalive and hold timers are far longer. Lowering them aggressively loads the control plane. BFD is a small, protocol-independent hello mechanism that runs fast, often in hardware, and tells routing protocols and FHRPs when a path has failed.

interface TenGigabitEthernet1/0/1
 ip address 10.1.1.1 255.255.255.252
 ip ospf network point-to-point
 bfd interval 300 min_rx 300 multiplier 3
!
router ospf 1
 bfd all-interfaces

With those timers a dead path is detected after about 900 milliseconds. Platforms can run lower intervals, but check the supported minimum on the exact model and the number of BFD sessions the line card can offload.

Design choice Guidance
Where BFD helps most Links that stay up at Layer 1 but fail to forward: Layer 2 intermediate hops, routed links over a service provider handoff, or an EtherChannel where only some members are dead
Where it is not needed Direct point-to-point fibre where loss of light already brings the interface down quickly
Echo mode Looped-back packets test the forwarding path with less load on the peer's control plane
Interval choice Too aggressive gives flaps on busy devices. Match it to what the CPU or hardware can sustain across all sessions
Clients OSPF, EIGRP, IS-IS, BGP, static routes, HSRP and others 
show bfd neighbors
show bfd neighbors details
show ip ospf neighbor

Exam trap

BFD only detects failure. It does not reroute anything. The routing protocol, FHRP or static route that registered with BFD does the failover. BFD also speeds up detection, not route calculation, so SPF throttle and LSA timers still affect total convergence.

See ENARSI BFD for session mechanics and configuration.

Design exercise

Scenario. A hospital campus has four buildings, each with a distribution pair, and a two-switch core. Requirements:

  • A gateway failure for clinical VLANs must be invisible to voice calls (target under one second).
  • Core switches are dual-supervisor chassis and must survive a supervisor failure without OSPF adjacencies resetting.
  • Software upgrades must not require a maintenance window on the core.
  • The security team will not accept a design where one software bug takes out both distribution switches of a building.

Constraints: all gear is Cisco, access switches are single-supervisor stacks, and fibre between buildings is dark fibre owned by the hospital.

Model answer

Distribution: two independent distribution switches per building running HSRPv2 with millisecond timers, per-VLAN active roles aligned with the STP root, and uplink tracking. Add BFD to the HSRP groups and to OSPF so detection is sub-second without lowering hellos on every VLAN. The access stacks connect to both distribution switches with one EtherChannel to each.

Core: dual-supervisor chassis with SSO and NSF, with graceful restart helper support on every neighbour. Use ISSU where the platform and versions allow it, so upgrades roll through one core switch at a time.

Rejected alternatives:

  • StackWise Virtual in the distribution. It removes the FHRP and STP blocked links, but one control plane would serve both halves of a building, which breaks the requirement that a single software fault must not take out both switches.
  • GLBP. It adds per-host paths that are harder to troubleshoot and gains nothing over VLAN-based load sharing here.
  • Aggressive OSPF and HSRP hello timers without BFD. They cost control plane CPU on every interface and still give coarser detection than BFD.
  • Dark-fibre-only link detection. Owned fibre brings loss of light up as an interface down, but a failed distribution CPU or a unidirectional fault would not be detected quickly, so keep BFD.

Quick check

A distribution switch loses all uplinks to the core but its access-facing ports stay up. HSRP is active on it. What happens without tracking?

It stays the HSRP active gateway, so hosts keep sending traffic to it and the traffic is dropped. Tracking the uplinks lowers its priority so the standby (with preempt) takes over.

Why can BFD and graceful restart conflict, and what is the design response?

BFD detects a dead neighbour quickly and brings the session down, which removes the routes that graceful restart was trying to keep. Use BFD in the data plane so it survives the switchover, or leave BFD off on the neighbour pairs that rely on NSF during a supervisor change.

Which technique removes the need for an FHRP at the distribution layer?

Either a single virtual switch (StackWise Virtual or VSS) that presents one gateway, or routed access where each access switch is the gateway for its own VLANs.

References

  • Cisco Campus LAN and Wireless LAN Solution Design Guide (CVD): search on cisco.com
  • Cisco Catalyst 9000 series StackWise Virtual configuration guide: search "StackWise Virtual" on cisco.com
  • RFC 5880 (BFD), RFC 3623 (OSPF graceful restart), RFC 4724 (BGP graceful restart), RFC 5798 (VRRPv3) at rfc-editor.org
  • Cisco Live On-Demand Library: search "campus high availability" and "BFD"