HSRP - Configure the Hot Standby Routing Protocol

Redundancy Protocol, Cisco Proprietary.
Configuration is quite straight-forward, but there are many ways to tune it, in accordance with your needs:
interface FastEthernet0/0
 ip address 172.25.25.2 255.255.255.0
 standby 1 ip 172.25.25.22 <- Group 1 VIRTUAL IP Address
 standby 1 timers 5 15 <- Can also be done in miliseconds using "standby 1 timers msec 250 800"
 standby 1 priority 150 <- Default it 100, Default
 standby 1 preempt
 standby 1 authentication Cisco
 standby 1 name R2-Act
 standby 2 ip 172.25.25.55
 standby 2 timers 5 15
 standby 2 authentication Cisco
 standby 2 name R5-Act

"07-ac" is the SIGNARURE part of Virtual MAC Address of the HSRP:
#sh standby | i 07
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)


To check the current configuration, including the HSRP Status and whether
preempt is configured:
#sh standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp Prio P State    Active          Standby         Virtual IP
Fa0/0       1   100    Standby  172.25.25.2      local           172.25.25.22
Fa0/0       2   200  P Active   local           172.25.25.2      172.25.25.55

If you need to TRACK an interface, just add the interface line, and define for how much you want to decrease the
HSRP priority in order to fail over to the HSRP Peer:
(config-if)#standby 1 track serial 0/1/0.21 60

Configuring the DHCP Server

Using the DHCP Pool configured on a IOS device is somewhat obsolete, but in cases of smaller companies where this solution is inevitable (or in a case such as mine, preparations for a CCIE exam) - you should know how to configure a full DSCP on a Cisco Router:

Step 1: Enable DHCP Server on a Device:
(config)#service dhcp

Step 2: Configure global DHCP options:
(config)#ip dhcp pool Cisco
(config-dhcp)#network 172.25.185.0 255.255.255.0 <- Network Range
(config-dhcp)#netbios-note-type h-node <- If you're using WINS, set the HYBRID TYPE
(config-dhcp)#netbios-name-server 172.25.185.253 <- WINS Server IP
(config-dhcp)#dns-server 172.25.185.200 172.25.185.201 <- Primary and Secondary IPs
(config-dhcp)#lease 3 5 <- The duration of the DHCP Lease (3 days 5 hours)

Step 3: Configure the IP Exclusions (IPs) you do not want to lease, in the Global Config mode:
(config)#ip dhcp excluded-address 172.25.185.252 172.25.185.254

Step 4: Disable the DSCP Logging of the Conflicts, because quite a few are likely to occur, and your log file can
fill in the memory:
(config)#no ip dhcp conflict logging

Step 5: Static DHCP entries must be configured IN A SEPARATE POOL!!! This is a trick that you need to know by heart because there is no other (more intuitive) way to do it. So - create another DHCP pool, and assign the hosts IP and the MAC address (THIS HOST WILL INHERIT THE CONFIG FROM THE DEFAULT POOL):
(dhcp-config)#host 10.184.117.37
(dhcp-config)#hardware-address 0014.2526.ef46

Check if your manual entry was configured:
#sh ip dhcp binding
Bindings from all pools not associated with VRF:
IP address          Client-ID/              Lease expiration        Type
                    Hardware address/
                    User name
10.184.117.37       0014.2526.ef46          Infinite                Manual

Scalability for Stateful NAT (SNAT)

Scalability for Stateful NAT feature allows Stateful Network Address Translation (SNAT) to control the Hot Standby Router Protocol (HSRP) state change until the NAT information is completely exchanged. Reference:
http://www.cisco.com/en/US/docs/ios/12_4/12_4_mainline/snatsca.html

Step 1:
You need to create the SNAT group, and assign a unique identifier to each router within the group:
(config)#ip nat stateful id 1

Step 2:
In order to configure the Stateful Failover, you need to have the HSRP previously configured. Within the stateful
nat group configurarion, assign the HSRP redundancy name to the router:
(config-ipnat-snat)#redundancy HSRP-1

Step 3:
The Active HSRP Router sends the NAT Translation to the Standby Routers. This translation is assigned an ID,
which is called "mapping-id" and it MUST BE THE SAME ON THE ENTIRE GROUP.
(config-ipnat-snat-red)#mapping-id 1

Step 4:
Consider adding features such Asymetric queuing, or define a specific protocol for the redundancy group:
IP Stateful NAT Redundancy mode configuration commands:
  as-queuing  Disable asymmetric process for this redundancy group
  exit        Exit from IP Stateful NAT Redundancy config mode
  mapping-id  Configure mapping-id for this redundancy group
  no          Negate or set default values of a command
  protocol    Select transport protocol for this redundancy group

Step 5:
Configure the Dynamic NAT, as described in my previous posts, and just attach the configured mapping-id:
(config)#ip nat inside source route-map ROUTE_MAP_MATCHING_ACL pool INSIDE_GLOBAL mapping-id 1

Step 6:
Check the translations
#sh ip snat distributed

Stateful NAT Connected Peers

No entries will appear until you perform a PING, and when you do, and do a debug, you'll see:
*Nov  7 14:47:12.081: SNAT (Add_node): Allocated database distributed-id 1
*Nov  7 14:47:12.081: SNAT (Add_node): Init RTree for distributed-id 1
*Nov  7 14:47:12.081: SNAT (Add_node): Allocate Node for nat-id 19, Router-id 1
*Nov  7 14:47:12.081: NAT: s=15.10.1.1->172.25.185.1, d=10.185.117.4 [271]
*Nov  7 14:47:12.081: NAT*: s=10.185.117.4, d=172.25.185.1->15.10.1.1 [271]
*Nov  7 14:47:12.085: NAT*: s=15.10.1.1->172.25.185.1, d=10.185.117.4 [272]
*Nov  7 14:47:12.085: NAT*: s=10.185.117.4, d=172.25.185.1->15.10.1.1 [272]
*Nov  7 14:47:12.085: NAT*: s=15.10.1.1->172.25.185.1, d=10.185.117.4 [273]
*Nov  7 14:47:12.085: NAT*: s=10.185.117.4, d=172.25.185.1->15.10.1.1 [273]
*Nov  7 14:47:12.089: NAT*: s=15.10.1.1->172.25.185.1, d=10.185.117.4 [274]
*Nov  7 14:47:12.089: NAT*: s=10.185.117.4, d=172.25.185.1->15.10.1.1 [274]
*Nov  7 14:47:12.089: NAT*: s=15.10.1.1->172.25.185.1, d=10.185.117.4 [275]
*Nov  7 14:47:12.089: NAT*: s=10.185.117.4, d=172.25.185.1->15.10.1.1 [275]

Static NAT redundancy with HSRP

This approach is used when you want to configure NAT and integrate it with HSRP (enable the same NAT on all the
routers that form the HSRP group). In order to do this, it's necessary to NAME each of the HSRP groups:

Step 1: Name the already configured HSRP group:
(config-if)#standby name HSRP-1 <- HSRP Group Name is HSRP-1

Step 2: Congigure NAT on the relevant interfaces
(config-if)#ip nat inside <- NAT inside interface

Step 3: Static NAT redundancy with HSRP
After you've named the HSRP group, configure the Redundancy NAT:
(config)#ip nat inside source static 10.185.117.1 152.168.13.9 redundancy HSRP-1

This means that the traffic originated from the IP 10.185.117.1 will be NAT-ed into 152.168.13.9

Tests:
In this example the router 10.185.117.1 is pinging the IP 200.1.1.4. The final router (232.32.32.4) does have the route back to 152.168.13.9
When the DEBUG is done on the router, the PING done from 10.185.117.1 gives the following display:
*Nov  7 11:34:02.606: NAT*: s=10.185.117.1->152.168.13.9, d=232.32.32.4 [226]
*Nov  7 11:34:02.606: NAT*: s=232.32.32.4, d=152.168.13.9->10.185.117.1 [226]
*Nov  7 11:34:02.610: NAT*: s=10.185.117.1->152.168.13.9, d=232.32.32.4 [227]
*Nov  7 11:34:04.606: NAT*: s=10.185.117.1->152.168.13.9, d=232.32.32.4 [228]
*Nov  7 11:34:04.606: NAT*: s=232.32.32.4, d=152.168.13.9->10.185.117.1 [228]
*Nov  7 11:34:04.606: NAT*: s=10.185.117.1->152.168.13.9, d=232.32.32.4 [229]
*Nov  7 11:34:04.606: NAT*: s=232.32.32.4, d=152.168.13.9->10.185.117.1 [229]
*Nov  7 11:34:04.610: NAT*: s=10.185.117.1->152.168.13.9, d=232.32.32.4 [230]
*Nov  7 11:34:04.610: NAT*: s=232.32.32.4, d=152.168.13.9->10.185.117.1 [230]

PAR - When you need to implement traffic redirections using NAT

You can define the traffic redirection using Static Entries, but there is a trick.
For example you want all the http traffic DESTINED FOR s0/0.5 to be REDIRECTED to the IP 10.1.123.3 instead.
You can configure this by defining the static NAT:
R1(config)#ip nat inside source static tcp 10.1.123.3 80 int s0/0.5 80

Make sure you understand how this command works, because it´s quite a complicated principle because it works a bit "upside down".

So when you try to telnet R1s IP using the port 80, from the router on the s0/0.5 side (R4):
R4#telnet 131.1.14.1 80
Trying 131.1.14.1, 80 ... Open

You see the following debug:

*Nov  6 15:54:48.703: NAT*: s=131.1.14.4, d=131.1.14.1->10.1.123.3 [23053] <- 131.1.14.4: Router from where we telnet
*Nov  6 15:54:48.707: NAT*: s=10.1.123.3->131.1.14.1, d=131.1.14.4 [31747] <- NATed and FWD-ed to to 10.1.123.3
*Nov  6 15:54:48.735: NAT*: s=131.1.14.4, d=131.1.14.1->10.1.123.3 [23054]
*Nov  6 15:54:48.739: NAT*: s=131.1.14.4, d=131.1.14.1->10.1.123.3 [23055]
*Nov  6 15:55:48.739: NAT*: s=10.1.123.3->131.1.14.1, d=131.1.14.4 [31748]
*Nov  6 15:55:48.767: NAT*: s=131.1.14.4, d=131.1.14.1->10.1.123.3 [23056]
*Nov  6 15:56:48.763: NAT*: s=10.1.123.3->131.1.14.1, d=131.1.14.4 [31749]
*Nov  6 15:56:48.791: NAT*: s=131.1.14.4, d=131.1.14.1->10.1.123.3 [23057]
*Nov  6 15:57:12.959: NAT*: s=131.1.14.4, d=131.1.14.1->10.1.123.3 [23058]
*Nov  6 15:57:13.127: NAT*: s=131.1.14.4, d=131.1.14.1->10.1.123.3 [23059]
*Nov  6 15:57:13.155: NAT*: s=10.1.123.3->131.1.14.1, d=131.1.14.4 [31750]
*Nov  6 15:57:13.311: NAT*: s=131.1.14.4, d=131.1.14.1->10.1.123.3 [23060]
*Nov  6 15:57:13.507: NAT*: s=10.1.123.3->131.1.14.1, d=131.1.14.4 [31751]

PAT (NAT Overload)

Port Address Translation (PAT) means using PORTS in order to NAT various Inside Local IPs to 1 Inside Global IP.

Step 1: Create an ACL with all the Inside Local addresses:
 (config)#access-list 1 permit 10.2.2.0 0.0.0.7

Step 2: There are 2 ways to configure PAT, described in Steps 2.1 and 2.2:

Step 2.1: 
- Create the Inside Global IP Pool of any addresses from the Link towards the other Router:
 (config)#ip nat pool OVERLOAD 10.1.1.2 10.1.1.2 prefix-length 24

- Configure the NAT Overload with the defined pool:
 (config)#ip nat inside source list 1 pool TASK2 overload

Step 2.2:
Configure the NAT to point to the Interface you need the traffic to go out from:
 (config)#ip nat inside source list 1 interface s0/1/0.21

!!! The system adds "overload" argument:
 (config)#do sh run | i nat inside
  ip nat inside
  ip nat inside source list 1 interface Serial0/1/0.21 overload

Load Balancing using NAT

This is a configuration that I´ve never implemented in any production environment, but I see quite a few cases where it can be usefull.

Step 1: Create a POOL of all the INSIDE IPs, and define the pool type: "type rotary":
 (config)#ip nat pool TASK1 10.2.2.1 10.2.2.5 prefix-length 24 type rotary

Step 2: Define an ACL with the Inside Global IP (the one we´re NAT-ing into):
 (config)#access-list 1 permit 200.2.2.2

Step 3: Do the inside NAT with the ACL 1 as the DESTINATION list, and the POOL or LOCAL IPs:
 (config)#ip nat inside destination list 1 pool ?
   WORD  Pool name for local addresses

Step 4: Define the NAT inside and outside interfaces, exactly like in case of Static/Dynamic NAT:
 (config)#int lo0
 (config-if)#ip nat inside
 (config-if)#
 (config-if)#int s0/1/0.21
 (config-subif)#ip nat outside

!!!Be sure that the routing is in place (both, go and return path towards the NAT-ed IP, 200.2.2.2)!!!

Step 5: Make sure that the IP NAT Translations are correct, and that the sources VARY:
 #sh ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
tcp 200.2.2.2:23       10.2.2.1:23        131.1.12.1:20186   131.1.12.1:20186
tcp 200.2.2.2:23       10.2.2.2:23        131.1.12.1:25096   131.1.12.1:25096
tcp 200.2.2.2:23       10.2.2.3:23        131.1.12.1:20389   131.1.12.1:20389