HSRP Gateway Redundancy with Multilayer Switch Inter-VLAN Routing

Lab Overview

In this lab, I built a network where the multilayer switch (MLS) handles local VLAN routing, while two edge routers provide Internet access through separate ISP connections.

The MLS provides inter-VLAN routing for VLANs 10, 20, and 30 using SVIs. The two routers are connected to the MLS through a separate transit VLAN and use HSRP to provide a single virtual default gateway for the network.

Router-1 is configured as the preferred HSRP router with a higher priority. Router-2 operates as the standby router and takes over the traffic when Router-1 becomes unavailable. When Router-1 becomes available again, its higher priority and the preempt command allow it to automatically become the active HSRP router again.

This design provides gateway redundancy while keeping local LAN routing on the MLS. Each edge router also has its own ISP connection, allowing the network to use a separate Internet path when the active router is unavailable.

Objectives

The objectives of this lab were to:

• Create and manage VLANs 10, 20, and 30 on the MLS.

• Use VTP to distribute VLAN information to the access switches.

• Configure the MLS to perform inter-VLAN routing using SVIs.

• Configure trunk links between the MLS and access switches to carry the required VLANs.

• Use a separate transit VLAN for communication between the MLS and the two edge routers.

• Configure HSRP between Router-1 and Router-2 for gateway redundancy.

• Make Router-1 the preferred active HSRP router using a higher priority and preempt.

• Configure separate ISP connections for Router-1 and Router-2.

• Provide DHCP services for the client VLANs from the MLS.

• Verify local inter-VLAN communication and Internet connectivity.

• Verify that Router-2 can take over Internet traffic when Router-1 is unavailable.

Lab Scenario

This lab represents a section of a larger network where users are divided into multiple VLANs and need to communicate with each other through the MLS. The users also need access to external networks through two edge routers.

The MLS performs the routing between the local VLANs, so traffic between VLANs does not need to pass through the edge routers. The routers are mainly used to provide access to the external network.

Router-1 and Router-2 are connected to different ISPs. HSRP is configured between the routers on the transit network. They share the virtual IP address 172.16.10.1, which is used as the default route next hop on the MLS.

Router-1 has a higher HSRP priority, making it the preferred active router. Router-2 remains in the standby state and takes over when Router-1 is unavailable. When Router-1 becomes available again, it uses HSRP preemption to regain the active role.

Topology

                ISP-1               ISP-2

                     |                 |

                 Router-1           Router-2 

                     \                  /

                      \               /

                           MLS

                        /     \

                      SW-1     SW-2

IP Addressing and Network Plan

The network uses three data VLANs and one transit VLAN:

VLAN Purpose             Network Default Gateway

10 User VLAN         192.168.10.0/24 192.168.10.1

20    User VLAN         192.168.20.0/24 192.168.20.1

30    User VLAN         192.168.30.0/24 192.168.30.1

200  HSRP                  172.16.10.0/29 172.16.10.1

The MLS uses SVIs 192.168.10.1, 192.168.20.1, and 192.168.30.1 as the gateways for the three data VLANs.

VLAN 200 is used only for communication between the MLS and the two routers. The HSRP virtual IP is 172.16.10.1. Router-1 uses 172.16.10.2, Router-2 uses 172.16.10.3, and the MLS uses 172.16.10.4.

The MLS-to-access-switch links are configured as trunks and allow VLANs 10, 20, and 30. VLAN 200 is not carried over these trunk links because it is only required between the MLS and the routers.

The ISP connections use the following addressing:

Link Network Device IPs                                     

Router-1 ↔ ISP-1        10.1.1.0/30 Router-1: 10.1.1.2 / ISP-1: 10.1.1.1

Router-2 ↔ ISP-2        10.1.2.0/30       Router-2: 10.1.2.2 / ISP-2: 10.1.2.1

Requirements / Environment

The lab was performed in Cisco Packet Tracer v9, which provides the required IOS commands and devices for this scenario.

Configurations

The following configurations were used to build the lab.

MLS

en

conf t

hostname MLS

vlan 10

vlan 20

vlan 30

vlan 200

 name Transit

exit

vtp mode server

vtp domain Test

vtp version 2

interface range gig1/0/1-2

 switchport mode access

 switchport access vlan 200

 exit

interface range gig1/0/3-4

 switchport mode trunk

 switchport trunk allowed vlan 10,20,30

 exit

interface vlan 10

 ip address 192.168.10.1 255.255.255.0

 no shutdown

 exit

interface vlan 20

 ip address 192.168.20.1 255.255.255.0

 no shutdown

 exit

interface vlan 30

 ip address 192.168.30.1 255.255.255.0

 no shutdown

 exit

interface vlan 200

 ip address 172.16.10.4 255.255.255.248

 no shutdown

 exit

ip routing

ip route 0.0.0.0 0.0.0.0 172.16.10.1

ip dhcp excluded-address 192.168.10.1 192.168.10.9

ip dhcp pool VLAN-10

 network 192.168.10.0 255.255.255.0

 default-router 192.168.10.1

 exit

ip dhcp excluded-address 192.168.20.1 192.168.20.9

ip dhcp pool VLAN-20

 network 192.168.20.0 255.255.255.0

 default-router 192.168.20.1

 exit

ip dhcp excluded-address 192.168.30.1 192.168.30.9

ip dhcp pool VLAN-30

 network 192.168.30.0 255.255.255.0

 default-router 192.168.30.1

 exit

do write

SW-1

en

conf t

hostname SW-1

vtp mode client

vtp domain Test

interface gig0/1

 switchport mode trunk

 exit

interface fast0/1

 switchport mode access

 switchport access vlan 10

 exit

interface fast0/2

 switchport mode access

 switchport access vlan 20

 exit

interface fast0/3

 switchport mode access

 switchport access vlan 30

 exit

do write

SW-2

en

conf t

hostname SW-2

vtp mode client

vtp domain Test

interface gig0/1

 switchport mode trunk

 exit

interface fast0/1

 switchport mode access

 switchport access vlan 10

 exit

interface fast0/2

 switchport mode access

 switchport access vlan 20

 exit

interface fast0/3

 switchport mode access

 switchport access vlan 30

 exit

do write

Router-1

en

conf t

hostname Router-1

interface gig0/0/0

 ip address 10.1.1.2 255.255.255.252

 no shutdown

 exit

interface gig0/0/1

 ip address 172.16.10.2 255.255.255.248

 standby 1 ip 172.16.10.1

 standby version 2

 standby 1 priority 110

 standby 1 preempt

 no shutdown

 exit

ip route 0.0.0.0 0.0.0.0 10.1.1.1

ip route 192.168.10.0 255.255.255.0 172.16.10.4

ip route 192.168.20.0 255.255.255.0 172.16.10.4

ip route 192.168.30.0 255.255.255.0 172.16.10.4

do write

Router-2

en

conf t

hostname Router-2

interface gig0/0/0

 ip address 10.1.2.2 255.255.255.252

 no shutdown

 exit

interface gig0/0/1

 ip address 172.16.10.3 255.255.255.248

 standby 1 ip 172.16.10.1

 standby version 2

 no shutdown

 exit

ip route 0.0.0.0 0.0.0.0 10.1.2.1

ip route 192.168.10.0 255.255.255.0 172.16.10.4

ip route 192.168.20.0 255.255.255.0 172.16.10.4

ip route 192.168.30.0 255.255.255.0 172.16.10.4

do write

Testing & Verification

I first verified connectivity from PCs in different VLANs by pinging 8.8.8.8. The pings were successful, confirming that the clients could reach the external network through the MLS and Router-1.

To test HSRP failover, I disconnected Router-1 from the MLS while continuously pinging 8.8.8.8. The first few packets timed out while HSRP detected that the active router was unavailable. After HSRP converged, Router-2 became active and the ping replies resumed. This confirmed that Router-2 could take over the external traffic without changing the clients' default gateway.

I then reconnected Router-1 to the MLS. Because Router-1 has a higher HSRP priority and preempt is configured, it became the active router again after returning to the HSRP group.

To verify this behavior, I disconnected Router-2 from the MLS after Router-1 had returned. The clients continued to successfully ping 8.8.8.8 without another failover interruption. This confirmed that Router-1 had regained the active HSRP role and was handling the traffic.

These tests verified both directions of HSRP failover: Router-2 can take over when Router-1 is unavailable, and Router-1 automatically becomes active again when it returns.

Troubleshooting

During the configuration, I initially configured the MLS interfaces connected to the routers as trunk ports. This caused a connectivity problem because the router interfaces in this topology were configured as regular Layer 3 interfaces and were not configured to process 802.1Q-tagged frames.

I changed the MLS interfaces connected to Router-1 and Router-2 to access ports. This matched the router configuration and allowed the devices to communicate correctly over the transit network. After the change, traffic was successfully forwarded through the routers to the ISPs.

Results

The lab successfully demonstrated a network where the MLS performs local VLAN and inter-VLAN routing while the edge routers provide external network access.

VLANs 10, 20, and 30 were created and distributed using VTP. The MLS provided the default gateways and DHCP services for these VLANs and performed the routing between them.

HSRP provided a redundant gateway between Router-1 and Router-2. Router-1 operated as the preferred active router, while Router-2 took over when Router-1 was disconnected. When Router-1 returned, its higher priority and preemption caused it to become active again.

The testing confirmed that clients could continue reaching the simulated external network through Router-2 during Router-1's failure and could return to Router-1 when it became available again.

Resources

The startup configurations for all devices and the complete Cisco Packet Tracer project file are available on my GitHub for reference.