1.1.b High availability techniques such as redundancy, FHRP, and SSO

What this objective tests

High availability means the network keeps forwarding during an expected failure. It does not mean every packet survives every event. The exam expects four tools: redundant links, redundant devices, a First Hop Redundancy Protocol (FHRP), and Stateful Switchover (SSO).

Redundancy

Redundancy gives traffic a second path. The common forms are dual uplinks, EtherChannel, dual supervisors, switch stacks, redundant power, and two WAN circuits.

Note: Redundancy is real only when the backup path is usable. Two uplinks in one conduit to one upstream device are not diverse.

Failure domain map:

Host gateway      FHRP (DIST1/DIST2 virtual IP)
Access uplink     Spanning Tree + EtherChannel
Distribution      Dual supervisors with SSO
WAN edge          Dual circuits + object tracking

Each layer covers different failures. No layer fixes all failures alone.

First Hop Redundancy Protocols

An FHRP gives hosts one virtual default gateway. Two devices share the virtual IP address. One device is active and forwards traffic. The other device waits in standby.

Example: HSRP for VLAN 10

Scenario: VLAN 10 users use gateway 10.10.10.1. DIST1 must be active. DIST1 must release the gateway when its uplink fails.

DIST1:

interface Vlan10
 description USERS gateway on DIST1
 ip address 10.10.10.2 255.255.255.0
 standby version 2
 standby 10 ip 10.10.10.1
 standby 10 priority 110
 standby 10 preempt
 standby 10 track GigabitEthernet1/0/48 30

DIST2:

interface Vlan10
 description USERS gateway on DIST2
 ip address 10.10.10.3 255.255.255.0
 standby version 2
 standby 10 ip 10.10.10.1
 standby 10 priority 100
 standby 10 preempt

Read the configuration this way:

• Both switches share virtual IP 10.10.10.1 in group 10.
• DIST1 wins with priority 110. Preempt lets DIST1 take the gateway back after a failure.
• When GigabitEthernet1/0/48 on DIST1 fails, the priority decreases by 30 to 80. DIST2 at 100 takes over.

Expected output on DIST1 in the normal state:

DIST1# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Vl10        10   110 P Active  local           10.10.10.3      10.10.10.1

When the uplink on DIST1 fails, DIST2 shows Active local. DIST1 shows priority 80 and state Standby.

Note: An FHRP protects only the default gateway. It does not repair a bad routing table or an upstream outage. The standby switch also needs a working path upstream.

SSO and NSF

Stateful Switchover (SSO) keeps a hot standby supervisor ready. The standby supervisor holds synchronized state. A supervisor failover then takes seconds, not minutes. Nonstop Forwarding (NSF) keeps packets moving while routing protocols rebuild neighbor state.

Verify SSO readiness:

show redundancy states
show platform
show logging | include REDUNDANCY|SSO|SWITCHOVER

The peer state in show redundancy states must be standby hot before you trust SSO.

Lab: prove gateway failover

Topology:

PC1 (10.10.10.50) -- [ASW1] -- [DIST1] --+
                      \                  [R1] loopback 192.0.2.1
                       ----- [DIST2] --+

Do these steps:

1. Configure VLAN 10 and the HSRP example on DIST1 and DIST2.
2. Verify with show standby brief that DIST1 is active.
3. Start a continuous ping from PC1 to 192.0.2.1.
4. Shut down GigabitEthernet1/0/48 on DIST1.
5. Watch show standby brief on DIST2 change to Active.
6. Count the lost pings during the failover.
7. Start the interface again and confirm DIST1 takes the gateway back.

The lab passes when you can name the event that caused the failover, the failover time, and the command that proves the new active gateway.

Exam traps

• Preempt is off by default in HSRP. A recovered switch stays standby without it.
• Tracking must decrease the priority below the standby priority. Check the math before the exam.
• FHRP protects the gateway only. It does not fix upstream routing.
• SSO needs a hot standby supervisor. Any other peer state means no stateful failover.

Pass check

You are ready when you can read an HA diagram and name the covered failures, the open failures, and the command that proves the active path.