High-Availability Seamless Redundancy in the Factory Network
Introduction
In today's Internet of Things (IoT) world, manufacturing industries are adopting the vision of connecting devices and implementing a converged plant floor to reduce operational costs and increase productivity. Highly-available equipment requires a resilient network that minimizes downtime for the mission critical production cycle.
The High-availability Seamless Redundancy (HSR) protocol that is defined in IEC 62439-3 is designed to achieve zero recovery time in ring topologies, making it suitable for automation networks where the downtime of Industrial Automation and Control System (IACS) applications should be kept to a minimum.
HSR supports single fault in the ring with no downtime by sending each packet in both directions in the ring. The receiving node accepts the first packet and discards the second. In contrast, other ring redundancy protocols block one path and use only the primary one, dropping some packets during convergence.
The key advantages of HSR are:
- Zero convergence time when a node, link, or switch fails
- No single point of failure
- Easy to configure
This High-Availability Seamless Redundancy in the Factory Network Cisco Validated Design (CVD) provides a tested and validated architecture to deploy HSR in ring topologies in the factory Cell/Area zone, which is the area where the IACS and end devices (Levels 0-2) connect to the network. This document guides the reader through the high-level technology and architecture.
Organization
Cisco Connected Factory and Converged Network Architecture Overview
The constantly evolving manufacturing industry has massive challenges because of the constant demand to increase productivity and decrease operational costs year after year. The industry is also facing challenges such as increased regulation and compliance measures becoming mandatory on the plant floor. This means the industry needs to have complete and real-time visibility to the very end of plant floor devices (sensors and actuators) and network components.
Realizing or achieving these goals requires not only automation in the industries’ plant floor, but also a strong spinal network that runs through the different zones of the manufacturing industry, connecting all the devices and machines and data to provide real-time visibility of each component.
Manufacturing industries are in a much better place to adopt Industrial Ethernet, since the following capabilities and some of the problems it solves are known:
- Increased speed and distance (using Fiber Media)
- Better interoperability
- Primary-subordinate architecture instead of peer-to-peer
- Resilient network for equipment availability, minimizing downtime for the mission critical production cycle
The Connected Factory architecture is designed from the ground up to leverage Cisco’s industry-leading networking expertise and extend it to the factory floor where industrial machines, controls, and other devices require maximum resiliency, extremely low latency, compliance with industry standards, and ease of use for operations personnel. The architecture connects the plant floor network with the existing enterprise network, while the industrial DMZ protects mission critical data and machinery. This solution is designed to be easily scalable and repeatable so it can be easily deployed to a wide variety of manufacturing applications.
Using a converged network architecture based on the industry-standard Purdue Model for Control Hierarchy, Cisco addresses connectivity, security, and resiliency based on a layered approach. Cisco’s Industrial Ethernet (IE) switches provide plant floor level access to IACS, while Wireless Access Points (WAPs) and Wireless LAN Controllers (WLCs) provide mobile connectivity for other devices where a hardwired connection is not feasible or required. Multiple levels of redundancy are implemented using multiple physical links and aggregation switches, as well as industrial protocols like HSR. Security is also critical for industrial networks because a malicious or accidental change to an industrial device can cause considerable damage or downtime.
Figure 1 Connected Factory Architecture
Purdue Model for Control Hierarchy
The Cisco Connected Factory solution employs the commonly used industry-standard Purdue Model for Control Hierarchy to divide the plant into a logical framework, as shown in Purdue Model for Control Hierarchy.
Figure 2 Purdue Model for Control Hierarchy
Starting at the bottom of the model, the Cell/Area Zone contains three levels of equipment:
- Level 0—Process—Industrial sensors, drives, actuators, and similar devices that interact with the physical environment by taking measurements or performing actions like starting a motor or moving a robot arm.
- Level 1—Basic Control—Controllers, such as programmable logic controllers, distributed control system, and generically programmable automation controller, that communicate directly with the Level 0 devices, other controllers, and higher level control systems.
- Level 2—Area Supervisory Control—Operator interfaces including Human Machine Interface (HMI), alarm systems, and control room workstations.
The Industrial Zone contains (Level 0-3) systems that maintain site level control of the lower level IACS systems including reporting, scheduling, file and patch servers, and network services such as NTP, DNS, DHCP, and AD. One or more of the Cell/Area Zones (described above) actually reside within the Industrial Zone, as depicted in Purdue Model for Control Hierarchy.
Sitting between the Industrial and Enterprise Zones is the Industrial Demilitarized Zone (IDMZ), which provides a layer of separation between the traditional Information Technology (IT) and Operational Technology (OT)-operated areas of the network, allowing only the absolutely required traffic to traverse the zone.
The Enterprise Zone, containing Level 4 and Level 5, provides access to the Internet and higher-order network applications including email, database, Business-to-Business (B2B) and Business-to-Consumer (B2C) applications, and other non-critical resources. This area is often seen as a source of security threats to the lower level resources and is typically managed by the IT department.
As shown in Connected Factory Architecture, the Cell/Area Zone is at the access layer of the network. In an industrial environment due to the physical layout of the plant floor, a ring topology is typically used to connect a series of access switches together. A ring topology allows every point in the ring to have multiple potential paths out of the ring, which is critical if a cable or device fails. If a failure in the ring occurs, the network must be able to keep forwarding traffic. In this deployment, Cisco IE switches use the HSR protocol to provide redundancy.
Cisco Industrial Network Portfolio
Cisco Industrial Ethernet Switches, which are designed from the ground up for the demanding environments and requirements of industrial networks, are fully tested and validated in IACS environments for the top protocols in use today, including Ethernet/IP, PROFINET, and CC-Link. Building on the years of class-leading experience in enterprise switching, these industrial-focused switches include additional software features and ruggedized hardware to deliver resilient, low-latency, and high speed performance. Cisco Industrial Ethernet Switches are available in a range of models, each with a variety of port configurations and sizes, including Cisco IE 1000, Cisco IE 2000, Cisco IE 3000, Cisco IE 4000, Cisco IE 4010, and Cisco IE 5000. Highlighted features of the switches include the following (not all features are available on all models):
- Industry-leading security including SUDI, ACT2, FIPS 140-2, TrustSec, and SGT/SGACL
- Port speeds ranging from 100 Mbps to 10 Gbps (copper and fiber available)
- DIN rail mount
- DC power supplies
- Alarm relays
- Industrial PoE and PoE+
- NetFlow Lite
- Support for industrial protocols including CIP, EtherNet I/P, and PROFINET
- Redundancy features including REP, PRP, MRP, EtherChannel, and Flex Links
- Horizontal stacking
The current implementation contains the following specific products:
- Cisco IE 4000 Series Switches—The industry’s first DIN rail-mounted 40 Gigabit Ethernet switch platform that offers high bandwidth and low latency. The Cisco IE 4000 is available in various models with up to 20 Gigabit Ethernet interfaces.
- Cisco IE 5000 Series Switches—A 19-inch, one-rack unit multi-10 Gbps aggregation switch equipped with 24 Gigabit Ethernet ports plus four 10-Gigabit or four 1-Gigabit ports, making it ideal for the aggregation layer or backbone in large-scale industrial networks.
Design Considerations
Resiliency Protocol Considerations
Resiliency protocols provide redundant paths in the network while avoiding loops to maximize uptime for devices running on the plant floor, such as Programmable Logic Controllers (PLCs), Remote I/O, Human Machine Interfaces (HMI), PC-Supervisor, sensors, actuators, and drives.
Resiliency protocols can be classified using the following criteria:
- Network Layer—Layer 2 Redundancy Protocols Comparison and Layer 3 Redundancy Protocols Comparison show a comparison of redundancy protocols by network layer (Layer 2 or Layer 3 redundancy).
- Topology—Some redundancy protocols are suited for ring or star topologies.
- Industry Standard—These resiliency protocols are based on industry standards and are ideal for multi-vendor deployments.
- Convergence Time—A protocol that meets the maximum convergence time for the application should be selected.
As Layer 2 Redundancy Protocols Comparison and Layer 3 Redundancy Protocols Comparison show, HSR is suitable for applications in ring topologies that require fast network convergence such as process automation. HSR is supported on Cisco IE 4000, Cisco IE 4010, and Cisco IE 5000.
Use Case Overview
HSR is used in HSR-SAN mode to provide redundancy in the access layer where IACS devices are connected. The access layer is aggregated by distribution switches that also provide a Layer 2/Layer 3 boundary and default gateway for the Layer 2 domain. At the distribution layer, Hot Standby Router Protocol (HSRP) is used to provides stateless redundancy for IP routing. The following are two possible HSR implementations in the Cell Area network.
Single HSR Ring Connected to Distribution Layer with Resilient Ethernet Protocol Segment
Figure 3 Single HSR Ring Connected to Distribution Layer with REP Segment
This topology combines hitless HSR topology in the Cell Area network with Resilient Ethernet Protocol (REP) in the uplinks to the aggregation to minimize the probability of HSRP and routing protocol convergence in the event of a failure in the uplinks. The only single event that would trigger an HSRP failover is the failure of the HSRP master node.
Single HSR Ring Connected to Isolated Distribution Switches
Figure 4 Single HSR Ring Connected to Isolated Distribution Switches
This topology has two distribution switches not directly connected to each other to achieve a loop free topology. Any failure in the uplink to the HSRP master results in an HSRP failover.
Choosing an HSR Implementation
Connecting the HSR to the distribution layer using REP, as shown in Single HSR Ring Connected to Distribution Layer with Resilient Ethernet Protocol Segment, is the recommended implementation since it provides the highest availability. Single HSR Ring Connected to Isolated Distribution Switches is given as an alternative for environments with mixed platforms that don't support REP.
Technology Overview
High-Availability Seamless Redundancy
High-availability Seamless Redundancy (HSR) is defined in International Standard IEC 62439-3-2016 clause 5. HSR is designed to work in a ring topology. The same standard defines PRP used in star topologies. HSR defines a ring with traffic in opposite directions. Port-A sends traffic counter clockwise in the ring and Port-B sends traffic clockwise in the ring.
To allow the switch to determine and discard duplicate packets, additional protocol specific information is sent with the data frame as part of what is called the HSR header. The HSR header contain a sequence number, which is the primary data used to determine if the received frame is the first instance or a duplicate instance.
The nodes connecting to the HSR ring are referred to as Doubly Attached Nodes implementing HSR (DANHs). Similar to PRP, Singly Attached Nodes (SANs) are attached to the HSR ring through a device called a Redundancy Box (RedBox). The RedBox acts as a DANH for all traffic for which it is the source or the destination. The Cisco IE 4000 switch implements RedBox functionality using Gigabit Ethernet port connections to the HSR ring.
Example of HSR Ring Carrying Unicast Traffic shows an example of an HSR ring as described in IEC 62439-3.
Figure 5 Example of HSR Ring Carrying Unicast Traffic
Devices that do not support HSR out of the box (for example, laptops and printers) cannot be attached to the HSR ring directly because an HSR device needs two ports. These nodes are attached to the HSR ring through a RedBox. As shown in Single HSR Ring Connected to Distribution Layer with REP Segment, the RedBox has two ports on the DANH side. Non-HSR SAN devices are attached to the upstream switch ports. The RedBox generates the supervision frames on behalf of these devices so that they are seen as DANH devices on the ring. Because the RedBox emulates these as DANH, they are called Virtual Doubly Attached Nodes (VDAN).
Loop Avoidance
To avoid loops and use network bandwidth effectively, the RedBox does not transmit frames that are already transmitted in the same direction. When a node injects a packet into the ring, the packet is handled as follows to avoid loops:
- Unicast packet with destination inside the ring—When the unicast packet reaches the destination node, the packet is consumed by the respective node and is not forwarded.
- Unicast packet with destination not inside the ring—Because this packet does not have a destination node in the ring, it is forwarded by every node in the ring until it reaches the originating node. Because every node has a record of the packet it sent, along with the direction in which it was sent, the originating node detects that packet has completed the loop and drops the packet.
- Multicast packet—A multicast packet is forwarded by each node because there can be more than one consumer of this packet. For this reason, a multicast packet always reaches the originating node. However, every node will check whether it has already forwarded the received packet through its outgoing interface. Once the packet reaches the originating node, the originating node determines that it already forwarded this packet and drops the packet instead of forwarding it again.
HSR RedBox Modes of Operation
An HSR RedBox can operate in one of the following modes that define how HSR handles packets in different scenarios:
- HSR-SAN—This is the most basic mode, in which the RedBox connects SAN devices to an HSR Ring. No other PRP or HSR network is involved in this configuration. In this mode, the traffic on the upstream switch port (the interlink port) does not have HSR/PRP tags and the RedBox represents the SAN device as a VDAN in the ring.
- HSR-PRP—This configuration is used to bridge HSR and PRP networks. Traffic on the interlink port (the RedBox interface that connects to the PRP network) is PRP tagged in this configuration. The RedBox extracts the data from the PRP frame and generates the HSR frame using this data and it performs the reverse operation for packets in the opposite direction. HSR-PRP mode is not used in this design. For more information, refer to High-Availability Seamless Redundancy (HSR) for Cisco IE 4000:
https://www.cisco.com/c/en/us/td/docs/switches/connectedgrid/cg-switch-sw-master/software/configuration/guide/hsr/b_hsr_ie4k.htmlHSR-SAN Mode
In HSR-SAN mode, the RedBox inserts the HSR tag on behalf of the host and forwards the ring traffic, except for frames sent by the node itself, duplicate frames, and frames for which the node is the unique destination. In this mode, packets are handled as follows:
- A source DANH sends a frame passed from its upper layers (“C” frame), prefixes it with an HSR tag to identify frame duplicates, and sends the frame over each port (“A” frame and “B” frame).
- A destination DANH receives two identical frames from each port within a certain interval. The destination DANH removes the HSR tag of the first frame before passing it to its upper layers and discards any duplicate.
- Each node in the HSR ring forwards frames received from one port to the other port of the HSR pair. A node will not forward frames received on one port to the other under the following conditions:
–
The received frame returns to the originating node in the ring.
–
–
Cisco Discovery Protocol and Link Layer Discovery Protocol for HSR
HSR supports the Cisco Discovery Protocol (CDP) and Link Layer Discovery Protocol (LLDP), which are Layer 2 neighbor discovery protocols. Both CDP and LLDP can provide information about nodes directly connected to the device. They also provide additional information such as the local and remote interface and device names.
When CDP or LLDP is enabled, you can use the CDP or LLDP information to find the adjacent nodes on an HSR ring and their status. You can then use the neighbor information from each node to determine the complete HSR network topology and debug and locate ring faults.
HSR Alarms
An HSR ring can generate the following two alarms:
- Partial Ring Fault—This fault is generated by an HSR RedBox when one of its physical ring ports/links is down. Because the packets can be sent using the redundant path, this is considered as a partial fault. However, this fault still requires user intervention to restore the ring. This is a minor fault and cannot be associated with an external hardware alarm relay.
- Full Ring Fault—This fault is generated by an HSR RedBox when both of its physical ring ports/links are down. This is a catastrophic failure and needs immediate attention. This is a major fault and can be associated with an external hardware alarm relay.
When an event that raises an alarm is generated, it can be associated with one or more of the following actions to notify the user:
HSR Guidelines and Limitations
- HSR is supported on the Cisco IE 4000, Cisco IE 4010, and Cisco IE 5000.
- A maximum of four ports support HSR/PRP. Using these four ports, you can create one of the following configurations:
- One HSR ring and one PRP channel
- The maximum number of nodes in the node table is 512. Nodes are all the DANH and VDAN devices that can be connected to the ring at same time.
- HSR ring ports can only be configured in Layer 2 mode.
- Ring 1 and Ring 2 can both be configured in HSR-SAN mode.
- MTU sizes up to 1998 are supported.
–
–
–
- STP and PTP are not supported on the HSR ring.
- By default, all modes of Spanning Tree Protocol (STP) will be disabled on the ring ports.
- PTP must be disabled manually. It is recommended to disable PTP manually before enabling the ring ports.
- Once a port is part of a ring, the media-type, speed, and duplex settings of the port cannot be changed. It is recommended to apply those settings before configuring ring membership.
- Once a port is part of ring, the port cannot be shut down.
- VLAN configuration such as trunk and access mode must be the same on both of the ports participating in the ring.
- After an interface is added in the HSR ring, only the primary interface counters are updated. You should not need to configure and check the status of individual physical interfaces after they are added to the HSR ring.
- As soon as you configure an HSR ring on two ports of a switch, MAC flaps will be observed on other switches where HSR configuration is yet to be applied. We recommend that you shut down the ports before configuring the ring on all switches and then re-enable them one by one as shown below.
- Physical interfaces are predefined for the rings and ports in HSR-SAN and HSR-PRP modes and cannot be changed. Port assignments for Cisco IE 4000 HSR-SAN mode are shown in Port Assignments for HSR Modes. For other devices or modes, refer to the relevant product documentation.
Note: Information in this guide is based on Cisco IE 4000 release 15.2.6E2a.
Hot Standby Redundancy Protocol
In the factory network architecture, the distribution switches are the Layer 2/ Layer 3 boundary and serve as gateways. Hot Standby Redundancy Protocol (HSRP) enables gateway redundancy that can be tuned to a failover time to the standby router in less than a second.
HSRP is Cisco’s standard method of providing high network availability by providing first-hop redundancy for IP hosts on an IEEE 802 LAN configured with a default gateway IP address. HSRP routes IP traffic without relying on the availability of any single router. It enables a set of router interfaces to work together to present the appearance of a single virtual router or default gateway to the hosts on a LAN. When HSRP is configured on a network or segment, it provides a virtual Media Access Control (MAC) address and an IP address that is shared among a group of configured routers. HSRP allows two or more HSRP-configured routers to use the MAC address and IP network address of a virtual router. The virtual router does not exist; it represents the common target for routers that are configured to provide backup to each other. One of the routers is selected to be the active router and another to be the standby router, which assumes control of the group MAC address and IP address should the designated active router fail.
Resilient Ethernet Protocol
REP is a Cisco proprietary protocol that provides an alternative to Spanning Tree Protocol (STP). REP provides a way to avoid network loops, handle link failures, and improve convergence time. It controls a group of ports connected in a segment, ensures that the segment does not create any bridging loops, and responds to link failures within the segment.
A REP segment is a chain of ports connected to each other and configured with a segment ID. Each segment consists of standard (non-edge) segment ports and two user-configured edge ports. A switch can have no more than two ports that belong to the same segment and each port can have only one external neighbor. A segment can go through a shared medium, but on any link, only two ports can belong to the same segment.
REP Segment shows an example of a segment consisting of eight ports spread across five switches. Ports A and B are configured as edge ports. When all ports are operational, a single port is blocked, as shown by the diagonal line. When a failure exists in the network, the blocked port returns to the forwarding state to minimize network disruption.
With REP, at least one port is always blocked in any given segment: that is, the alternate port. The blocked port helps ensure that the traffic within the segment is loop-free by requiring traffic flow to exit only one of the edge ports and not both. So when a failure occurs in the segment, REP opens the alternate port so traffic can reach the edge of the segment.
Internet Group Management Protocol Snooping
Internet Group Management Protocol (IGMP) snooping software examines multi-cast group messages within a VLAN to discover which interfaces are connected to hosts or other devices interested in receiving this traffic. Using the interface information, IGMP snooping can reduce bandwidth consumption in a multi-access LAN environment to avoid flooding multicast traffic to the entire VLAN. The IGMP snooping feature tracks which ports are attached to multicast-capable routers to help it manage the forwarding of IGMP membership reports. As the name implies, IGMP snooping requires the LAN switch to snoop on the IGMP transmissions between the host and the router and to keep track of multicast groups and member ports. When the switch receives an IGMP report from a host for a particular multicast group, the switch adds the host port number to the forwarding table entry; when it receives an IGMP Leave Group message from a host, it removes the host port from the table entry. It also periodically deletes entries if it does not receive IGMP membership reports from the multicast clients.
The multicast router sends out periodic general queries to all VLANs. All hosts interested in this multicast traffic send join requests and are added to the forwarding table entry. The switch creates one entry per VLAN in the IGMP snooping IP multicast forwarding table for each group from which it receives an IGMP join request.
Deploying High-Availability Seamless Redundancy in the Factory Network
The factory network follows a hierarchical design that includes three main layers:
- Access Layer—Provides endpoints and users with direct access to the network. IACS devices are connected to this layer. In the current implementation, this layer consists of Cisco IE 4000 switches in a ring topology deployed in HSR-SAN mode. The HSR ring can be attached to the distribution switch in two ways:
–
–
- Distribution Layer—Aggregates access layers and provides connectivity to services. It acts as a Layer 2/Layer 3 boundary and default gateway for the Layer 2 domains. In this implementation, this layer consists of Cisco IE 5000 switches running HSRP for Layer 3 redundancy.
- Core Layer—Provides connectivity between distribution layers for large LAN environments.
Access to Distribution Connectivity
As mentioned before, the difference between deployments shown in Single HSR Ring Connected to Distribution Layer with REP Segment and Single HSR Ring Connected to Isolated Distribution Switches is the way the access layer is connected to the distribution layer. In the first scenario a REP segment is formed with two switches in the HSR ring and the distribution as shown in REP Segment to Distribution. It is recommended to use REP to connect to the distribution layer since it minimizes the probability of HSRP failover, Deployment without REP should be considered only if interoperability is a concern.
Figure 7 REP Segment to Distribution
This topology combines hitless HSR topology in the cell area network with REP in the uplinks to minimize the probability of HSRP and routing protocol convergence in the event of a failure in the uplinks. The only single event that would trigger an HSRP failover would be the failure of the HSRP master node.
Configuration
This section describes how to configure HSR and related features:
Configuring an HSR Ring
HSR configuration applies to the Cisco IE 4000 switches in the ring.
Before configuring HSR, check if HSR is enabled; newer versions have it enabled by default.
If HSR is enabled, skip this step; otherwise, use the following command to enable:
For the change to take effect, the switch must be reloaded. Confirm the reload when prompted and wait for the switch to reload and boot. Verify that the HSR feature is activated.
Ensure that the member interfaces of a HSR ring are not participating in any redundancy protocols such as FlexLinks, EtherChannel, and REP before configuring a HSR ring.
Follow these steps to configure HSR:
1.
2.
3.
4.
6.
If the output shows no hsr-ring 1 fpgamode-DualUplinkEnhancement, issue the following command.
Follow these optional steps to configure CDP and LLDP to provide information about HSR ring nodes:
8.
9.
Follow these optional steps to enable HSR alarms:
10.
Configure a REP Segment
REP configuration applies to the switches on the REP segment, as shown in REP Segment to Distribution.
Configure Administrative VLAN
To avoid the delay introduced by relaying messages that are related to link-failures or VLAN-blocking notifications during VLAN load balancing, REP floods packets at the hardware flood layer (HFL) to a regular multicast address. These messages are flooded to the whole network and not just to the REP segment. You can control the flooding of these messages by configuring an administrative VLAN for the whole domain.
Follow these guidelines when configuring the REP administrative VLAN:
- Only one administrative VLAN can exist on a router and on a segment. However, the software does not enforce this.
- If you do not configure an administrative VLAN, the default is VLAN 1.
- If you want to configure REP on an interface, ensure that the REP administrative VLAN is part of the Trunk EFP encapsulation list:
Enable REP on Interfaces
For the REP operation, you must enable REP on each segment interface and identify the segment ID. This task is required and must be done before other REP configuration. You must also configure a primary and secondary edge port on each segment. All other steps are optional.
Edge Ports
To configure a port as an edge port, use the following command in interface configuration mode:
The primary keyword is optional and allows for manual selection of the primary edge. If the primary keyword is used, the other edge port becomes the secondary edge port (no keyword required). To configure the secondary edge port, omit the primary keyword as shown:
Non-Edge Ports
To configure a port as a member of the REP segment, use the following command in interface configuration mode:
Preemption
Preemption is done either manually with the rep preempt segment < ID > command, or automatically if you configure rep preempt delay < seconds > under the primary edge port.
When a segment heals after a link failure, one of the two ports adjacent to the failure comes up as the ALT port. Then, after preemption, the location of the ALT ports become the primary edge port unless additional configuration is done for load balancing and alternate port, which is not covered in this document. For more information, refer to Cisco Industrial Ethernet 4000, 4010 and 5000 Switch Software Configuration Guide:
https://www.cisco.com/c/en/us/td/docs/switches/lan/cisco_ie4010/software/release/15-2_4_EC/configuration/guide/scg-ie4010_5000.htmlConfiguring HSRP
HSRP configuration applies to the two distribution switches (Cisco IE 5000s). The standby ip interface configuration command activates HSRP on the configured interface. If an IP address is specified, that address is used as the designated address for the Hot Standby group. If no IP address is specified, the address is learned through the standby function. You must configure at least one Layer 3 port on the LAN with the designated address. Configuring an IP address always overrides another designated address currently in use. It is recommended to configure the lowest IP in the network as standby IP to guarantee that the master router will become the IGMP snooping querier.
In the current implementation, HSRP is configured in a Switch Virtual Interface (SVI). To configure HSRP, assign a virtual IP and group number to the interface. The following is an example of HSRP configuration in master peer:
The following is an example of the standby peer:
Note that virtual IP is the same while physical IP varies per peer.
Configuring HSRP Priority
When configuring HSRP priority, follow these guidelines:
- Assigning a priority allows you to select the active and standby routers. If preemption is enabled, the router with the highest priority becomes the active router again after recovering from a failure. If priorities are equal, the current active router does not change.
- The highest number (1 to 255) represents the highest priority (most likely to become the active router).
- When routing is first enabled for the interface, it does not have a complete routing table. If it is configured to preempt, it becomes the active router, even though it is unable to provide adequate routing services. To solve this problem, configure a delay time to allow the router to update its routing table.
To configure priority in the desired active peer, add this line to the interface configuration (since default priority is 100, the configured number should be higher):
Configure the router to preempt, which means that when the local router has a higher priority than the active router, it assumes control as the active router. As an option a delay can be configured, which will cause the local router to postpone taking over the active role for the number of seconds shown:
HSRP uses two timers: hello interval and hold time. Hello interval defines the frequency that hello packets are sent to the other peer. Hold time indicates the amount of time to wait before marking the peer as down. The hold time should be three or more times greater than the hello interval. To configure those timers:
Internet Group Management Protocol Design Considerations
IGMP snooping should be configured to route multicast traffic only to those hosts that request traffic from the specific multicast group. IGMP snooping is configured by default in Cisco IE switches, but IGMP snooping querier should be configured in the distribution switches (Cisco IE 5000s) using the following command:
IGMP selects the querier with the lowest IP in the network, hence the importance of configuring the HSRP IP to be the lowest in the network.
Best Practices
- Configure preemption in HSRP for deterministic routing.
- If REP preemption is required, it is recommended to do manual preemption to avoid an unplanned downtime. REP preemption could cause a multicast tree re-convergence that affects nodes attached to the REP segment.
- For REP segment, the edge port in the Cisco IE 4000 connected directly to HSRP subordinate should be primary so it gets blocked by default in preemption.
- Enable BPDU filtering in ports connecting to end devices and distribution on the Cisco IE 4000 participating in HSR ring to avoid ports getting into a blocked state after topology changes.
- Avoid using access ports on the distribution switch for VLANs being used in the ring to avoid a HSRP split brain scenario. If connecting devices directly to the distribution switches, use a different VLAN.
Network and Ring Size Considerations
- The maximum number of nodes in the node table is 512. Nodes are all the DANH and VDAN devices that can be connected to the ring at same time.
- A maximum ring size of 24 switches is recommended. Given that HSR gives protection for a single failure in the ring, increasing the size would also increase the probability of more concurrent failures.
Validation Results
This section describes the convergence values observed during validation efforts.
Validation was done for a single HSR ring with the following characteristics:
- Single HSR ring with 24 nodes
- MAC scale up to 250 simulated devices connected to a single node
- 200 multicast groups
- Two VLANs in the ring
- Concurrent Multicast and Unicast traffic
- Intra VLAN traffic (Layer 2) and Inter VLAN traffic
- HSRP timers used (Hello interval = 200ms and hold time = 750ms)
- REP native VLAN
Convergence Values
The following tables show convergence times for traffic inside the HSR ring. Single Failure in HSR Ring refers to a disruption inside the ring. Single Failure in REP Segment shows how a disruption on the REP segment affects the traffic inside the ring. HSRP Failover shows how an HSRP failover affects the traffic inside the ring.
Troubleshooting
HSR Troubleshooting
The following CLI can be used to troubleshoot HSR:
- show hsr ring { 1 | 2 } [ detail ] displays configuration details and current state for the specified HSR ring:
- show hsr statistics displays statistics for HSR components. To clear HSR statistics information, enter the command clear hsr statistics.
- show hsr node-table displays all MAC addresses accessible to the switch using the HSR interface, including other nodes in the ring as well as devices attached to other nodes.
- show hsr vdan-table displays the HSR Virtual Doubly Attached Node (VDAN) table, which contains devices directly connected to the switch for whom the switch acts as proxy. This table is also known as the Proxy node table.
- show cdp neighbors and show lldp neighbors displays neighbor information for the switch, which is useful when troubleshooting connectivity issues.
- show alarm settings | begin hsr displays HSR alarm configuration. HSR Events lists the HSR events and their representations.
Related Documents
- Cisco Industrial Ethernet 4000 Series Switches
http://www.cisco.com/c/en/us/support/switches/industrial-ethernet-4000-series-switches/tsd-products-support-series-home.html- IEC 62439-3, Industrial communication networks-High availability automation networks-Part 3: Parallel Redundancy Protocol (PRP) and High-availability Seamless Redundancy (HSR)
https://webstore.iec.ch/publication/24447
High-Availability Seamless Redundancy in the Factory Network Design Guide
Bias-Free Language
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
- Updated:
- October 4, 2018
Feedback