Feature history of Active-Passive HA

Feature history table
Release Feature Name Description

Active-Passive High Availability

Cisco IOS XE 26.2.1 Release

With this release active-passive high availability feature configurations are supported on Cisco Secure routers using Cisco Meraki Dashboard.

Active-passive High Availability

Active / Passive High Availability (HA) provides a redundant pair of eligible Cisco Secure Routers. One appliance is active and owns forwarding and service roles during normal operation; the other is passive and ready to take those roles when health or priority changes. The pair uses the Cisco Meraki Dashboard workflow and generates Cisco IOS-XE HA configuration for VRRP, health tracking, node-specific addressing, and stateful-service redundancy.

Active/Passive is the default HA behavior for Cisco Secure Routers. The Cisco Meraki Dashboard designates a primary and a secondary; these names describe the preferred roles. The feature is determined by VRRP and application-redundancy priorities and health. When the active role changes, the shared VRRP address remains the service address for the LAN or WAN interface, while the new active appliance responds for that address.

On failover, the new VRRP active appliance sends gratuitous ARP to update host ARP tables and intermediate Layer 2 switch MAC tables. WAN connectivity is tracked so that, when the required uplinks are unavailable, the backup device can take over. The source material describes the health decision as requiring the LAN side to be healthy and at least one WAN to be available. VRRP and the application redundancy group have different responsibilities. VRRP owns shared gateway or uplink IP addresses. The application redundancy group coordinates stateful services such as DHCP lease synchronization.

Prerequisites for Active-Passive High Availability

  • The devices in the HA setup must have the same PID or device model.
  • Both devices must be supported Cisco Secure Router and must be added to the Cisco Meraki Dashboard network.
  • The pair must have the required LAN and WAN connectivity for VRRP and redundancy-group communication.
  • The LAN subnets must have sufficient usable addresses for the shared VRRP address and the two node-specific addresses required by IOS-XE HA.
  • IPv6 and templates are not supported for HA.
  • Full Active/Active HA is not supported.
  • State synchronization for stateful features such as NAT and firewall state is not supported.
  • The Cisco Meraki Dashboard workflow may cause a brief connectivity loss on the primary while the HA configuration is initialized.
  • Cisco Meraki Dashboard uses reserved LAN addresses for HA and does not provide a user configurable editor for the two node-specific HA IP addresses.

Configure active-passive high availability

Choose one of the options to configure active-passive high availability:

Configure active-passive high availability from the Cisco Meraki Dashboard

For information on HA configuration on the Cisco Meraki Dashboard, refer to MX Warm Spare - High-Availability Pair.

Step 1

From the Cisco Meraki Dashboard, navigate to Security & SD-WAN > Monitor > Appliance status.

Step 2

Select Configure warm spare near the device name.

Step 3

Set warm spare to Enabled.

Step 4

Select the serial number of the secondary device.

The secondary device must be the same model/PID as the primary.

Step 5

Select the available uplink IP behavior: use the device uplink IPs or use virtual uplink IPs.

Step 6

Select Update to enable the warm-spare pair.

Active-passive high availability configuration on Cisco Secure Routers

 Note

The router configurations are not manually set on the router, instead, all the configurations are automatically pushed from the Cisco Meraki cloud.

Generated HA configuration

vrf definition CLOUD_DEFAULT_VRF
 rd 200:200
 route-target export 200:200
 route-target import 200:200
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
ip dhcp excluded-address vrf CLOUD_DEFAULT_VRF 192.168.1.1 192.168.1.3
ip dhcp excluded-address vrf CLOUD_DEFAULT_VRF 192.168.2.1 192.168.2.3
!
ip dhcp pool dhcp_pool_1
 vrf CLOUD_DEFAULT_VRF
 network 192.168.1.0 255.255.255.0
 default-router 192.168.1.1
 redundancy 1
!
ip dhcp pool dhcp_pool_2
 vrf CLOUD_DEFAULT_VRF
 network 192.168.2.0 255.255.255.0
 default-router 192.168.2.1
 redundancy 1
!
fhrp version vrrp v3
redundancy
 application redundancy
  group 1
   name rg1
   preempt
   priority 254
   control GigabitEthernet3 protocol 1
   data GigabitEthernet3
   track 10000 decrement 179
  protocol 1
   name rg1
track 801 interface GigabitEthernet5 ip vrrp 1
track 802 interface GigabitEthernet4 ip vrrp 2
!
track 1001 interface GigabitEthernet5 line-protocol
!
track 1002 interface GigabitEthernet4 line-protocol
!
track 1011 interface GigabitEthernet2 line-protocol
!
track 1012 interface GigabitEthernet1 line-protocol
!
track 1020 list boolean or
 object 1011
 object 1012
!
track 10000 list boolean and
 object 1001
 object 1002
 object 1020
!
track 32766 list boolean and
 object 801
 object 802
interface GigabitEthernet1
 description wan uplink2
 ip address 10.0.1.21 255.255.255.0
 no ip proxy-arp
 vrrp 12 address-family ipv4
  priority 254
  track 10000 decrement 179
  address 10.0.1.1 primary
  exit-vrrp
!
interface GigabitEthernet2
 description wan uplink1
 ip address 10.1.12.21 255.255.255.0
 no ip proxy-arp
 vrrp 11 address-family ipv4
  priority 254
  track 10000 decrement 179
  address 10.1.12.1 primary
  exit-vrrp
!
interface GigabitEthernet3
 description RG communication interface
 ip address 192.0.3.1 255.255.255.252
 no ip proxy-arp
!
interface GigabitEthernet4
 description lan2
 vrf forwarding CLOUD_DEFAULT_VRF
 ip address 192.168.2.2 255.255.255.0
 no ip proxy-arp
 vrrp 2 address-family ipv4
  priority 254
  track 10000 decrement 179
  address 192.168.2.1 primary
  exit-vrrp
!
interface GigabitEthernet5
 description lan1
 vrf forwarding CLOUD_DEFAULT_VRF
 ip address 192.168.1.2 255.255.255.0
 no ip proxy-arp
 vrrp 1 address-family ipv4
  priority 254
  track 10000 decrement 179
  address 192.168.1.1 primary
  exit-vrrp
 Note

In the above configuration, prefix 192.168.1.x and 192.168.2.x are derived from LAN interface address. RG communication interface Gi3 should be input from the Cisco Meraki Dashboard.

On primary router the priority of vrrp/rg is 254 and on secondary router the priority of vrrp/rg is 234.

Verify active-passive high availability

Use the following CLI commands to verify the redundancy group, role state, and DHCP lease state.

HA verification commands

show redundancy application group 1 
show ip dhcp binding