%HSRP-4-DIFFVIP1

Hi Experts,

I have a LAN network with 26 VLAN configured on Cisco switchs (6513). I have configured HSRP on the switches for redundancy.  Today I experienced this error %HSRP-4-DIFFVIP1 i n one of my vlans, which resulted to traffic between active and standby switch.

Quick search showed that this error is a result of virtual IP mismatch, which is not the case with my configs (see attached sample/below cfg).

What else could make this vlan flap between active and standby HSRP interfaces? The flapping vlan is 5.



switch01#
-------output omitted--------------------

interface Vlan1
 ip address 172.33.144.3 255.255.255.192
 standby 1 ip 172.33.144.1
!
interface Vlan2
 ip address 172.33.142.3 255.255.255.128
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.142.1
!
interface Vlan3
 ip address 172.33.142.131 255.255.255.128
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.142.129
!
interface Vlan4
 ip address 172.33.144.67 255.255.255.192
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.144.65
!
interface Vlan5
 ip address 172.33.136.3 255.255.254.0
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.136.1
!
interface Vlan6
  ip address 172.33.144.195 255.255.255.192
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.144.193
!



switch02#
-------output omitted--------------------

interface Vlan1
 ip address 172.33.144.2 255.255.255.192
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.144.1
 standby 1 priority 200
 standby 1 preempt
!
interface Vlan2
  ip address 172.33.142.2 255.255.255.128
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.142.1
 standby 1 priority 200
 standby 1 preempt
!
interface Vlan3
 ip address 172.33.142.130 255.255.255.128
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.142.129
 standby 1 priority 200
 standby 1 preempt
!
interface Vlan4
 ip address 172.33.144.66 255.255.255.192
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.144.65
 standby 1 priority 200
 standby 1 preempt
!
interface Vlan5
 ip address 172.33.136.2 255.255.254.0
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.136.1
 standby 1 priority 200
 standby 1 preempt
!

interface Vlan6
  ip address 172.33.144.194 255.255.255.192
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.144.193
 standby 1 priority 200

Open in new window

SeniAsked:
Who is Participating?
 
rfc1180Connect With a Mentor Commented:
>What else could make this vlan flap between active and standby HSRP interfaces? The flapping vlan is 5.

Explanation    The HSRP virtual IP address contained in the Hello message from the active router is different from the virtual IP address configured locally.

Recommended Action    Check the configuration on all HSRP routers in the group and ensure they are all configured with the same virtual IP address.

Easier said then done, huh

Well you are either running into a bug or a local attack from vlan5 or possibly an attack via vlan1 using a method called vlan hopping. First thing I would do is implement authentication for HSRP.

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t2/feature/guide/gthsrpau.html

You could also utilize Wireshark and SPAN vlan 5 to see what is going on from a packet perspective.

Billy

Well,
0
 
Marius GunnerudSenior Systems EngineerCommented:
When they say virtual ip mis match i believe they mean the IP addresses configured on the standby. So that the IP for Standby 1 should be the same on all routers that are configured for HSRP
0
 
Don JohnstonInstructorCommented:
And this was working fine until recently?

If so, what was changed prior to this error message?
0
Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
rochey2009Commented:
Hi,

Do you have any VLAN's which are leaking into one another, maybe on a temporary basis?

Example message:
*Mar  1 00:03:38.843: %HSRP-4-DIFFVIP1: FastEthernet0/0 Grp 1 active routers virtual IP address 192.168.1.3 is different to the locally configured address 192.168.0.3

What does the DIFFVIP1 error message tell you about the address that's in conflict.

(A temporary fix would be to change the hsrp group on VLAN 5.)
0
 
alienXenoCommented:
Can you get output of "show standby" from both the siwtches ? The error that you get is definately about different VIP on the Switches but HSRP can flap because of the Interface within that VLAN flapping.
0
 
Marius GunnerudSenior Systems EngineerCommented:
Here is your issue. you have the same standby group with different IP's. Standby 1 must have the same IP on all interfaces.  If that is not what you want you need to use a different group number for each vlan (standby 1, standby 2, standby 3...etc)

interface Vlan1
 ip address 172.33.144.3 255.255.255.192
 standby 1 ip 172.33.144.1!
interface Vlan2
 ip address 172.33.142.3 255.255.255.128
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.142.1!
interface Vlan3
 ip address 172.33.142.131 255.255.255.128
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.142.129!
interface Vlan4
 ip address 172.33.144.67 255.255.255.192
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.144.65!
interface Vlan5
 ip address 172.33.136.3 255.255.254.0
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.136.1!
interface Vlan6
  ip address 172.33.144.195 255.255.255.192
 ip helper-address 172.33.156.113
 standby 1 ip 172.33.144.193
0
 
Marius GunnerudSenior Systems EngineerCommented:
change the standby group numbers and you should be fine.
0
 
Don JohnstonInstructorCommented:
Actually, using the same group number on different interfaces is allowed. And in some situations, it's required (I think early 6500's could only have 16 groups. So you had to reuse group numbers if you had more than 16 interfaces.)
0
 
Marius GunnerudSenior Systems EngineerCommented:
Not so much talking about the group numbers, or the amount of same group numbers, as the group ip addresses. From my understanding all standby 1 groups should have the same virtual ip address.
0
 
Don JohnstonInstructorCommented:
No. The virtual IP address has to be consistent with the IP address of the interface. HSRP group numbers are significant only within the interface they are used on.
0
 
rfc1180Commented:
I agree wih don, should not have to change groups.

Billy
0
 
Craig BeckCommented:
don is correct.... the standby number can't be seen across different VLANs, only interfaces within the same VLAN, so the numbers are correct as they are.  Different numbers are generally used for clarity.

I also agree with rfc, implement authentication on VLAN5 between the two routers as I think its probably another router trying to use the same standby group number on VLAN5.
0
 
Craig BeckCommented:
Are you seeing this error for any other VLANs?  If you are this is just something else to check (as you are using the same group numbers for each VLAN I've seen this in the past)....

In the %HSRP-4-DIFFVIP1 message you may see the IP address of the 'rogue' router that is causing the issue.  If the IP address mentioned is the same as an IP address on one of your other VLANs you probably need to look at your STP config as there may be a loop.
0
 
rochey2009Commented:
Hi,

Do you have any VLAN's which are leaking into one another.

What does the DIFFVIP1 error message tell you about the address that's in conflict.
0
 
SeniAuthor Commented:
it was a bug in cisco ios
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.