HSRP VS SSO HSRP (2024)

FAQs

How does SSO work with HSRP? ›

SSO HSRP alters the behavior of HSRP when a device with redundant Route Processors (RPs) is configured for stateful switchover (SSO) redundancy mode. When an RP is active and the other RP is standby, SSO enables the standby RP to take over if the active RP fails.

HSRP priority is a numeric value assigned to each router participating in the HSRP group. The router with the highest priority value becomes the active router, while the router with the second-highest priority value becomes the standby router. The priority value can range from 0 to 255, with 100 as the default value.

Thestandby preemptcommand enables the Hot Standby Router Protocol (HSRP) router with the highest priority to immediately become the active router. Priority is determined first by the configured priority value, and then by the IP address. In each case, a higher value is of greater priority.

Routers in standby mode will listen to the hello messages, if they don't receive anything from the active router, they will wait for the hold time to expire before taking over. The hold time is 10 seconds by default which is pretty slow; we'll see how to speed this up in a bit.

The most straightforward way to test this is to use a set of valid and invalid account information and use SSO to sign in. The ideal behavior is that SSO should be successful for valid data and unsuccessful for invalid data. Any deviation from ideal behavior is of serious concern and should be fixed on high priority.

Security and compliance benefits of SSO

Every time a user logs in to a new application, it's an opportunity for hackers. SSO reduces the number of attack surfaces because users only log in once each day and only use one set of credentials. Reducing login to one set of credentials improves enterprise security.

How Long Should I Delay HSRP Preempt? Cisco recommends taking the router boot time and divide by two. For instance, if your router's boot time is 120 seconds, then the preempt delay would be 60 seconds. That means your switch must be alive and healthy for 60 seconds before it takes over.

Where VRRP has true load balancing, with traffic split between the two devices, HSRP can only do load sharing. Since both routers have a unique IP, different hosts can be configured to use either one. This becomes problematic if either goes offline, as a subset of your hosts now can't reach their gateway.

HSRP allows you to configure two or more routers as standby routers and only a single router as an active router at a time.

HSRP does not function in a multivendor environment. HSRP does not have the capability to support IPv6 addresses. HSRP provides default gateway failover only when the active router fails. HSRP does not provide load balancing with multiple active routers.

Do HSRP timers need to match? ›

Both timers can be tuned in milliseconds to ensure fast failover. If the Standby router stops seeing hello packets from the Active it will assume it is down and will take over as the Active router. Timers on all routers must match. HSRP requires layer 2 connectivity between routers.

HSRP works by having a group of routers communicate with each other over a multicast address (224.0. 0.2) using User Datagram Protocol (UDP) port 1985.

Yes, HSRP can do load sharing/balancing and it will work. You must configure multiple HSRP groups each assigned to a different subnet/VLAN. Attached is a Cisco pdf on Load Sharing with HSRP.

The default is 0 seconds (no delay). reload: (Optional) Specifies the preemption delay, in seconds, after a reload only. This delay period applies only to the first interface-up event after the device has reloaded, if such an event occurs within 360 seconds from reload.

Kerberos Single Sign On (SSO)

Particularly as a consequence of Microsoft's use of Kerberos, Kerberos is very widely used for SSO. Kerberos SSO works by having the first application to authenticate (typically a client login process) share the Ticket Granting Ticket it obtains with other applications.

Single sign-on works by using a central server that all of the different applications will trust. Once you have logged in through this central server, each application gets redirected to the same server. This will access your login credentials, allowing you to only enter your details once.

This is somewhat like an SSO system: instead of establishing their identity over and over, a user establishes their identity once and can then access several different services. SSO is an important aspect of many identity and access management (IAM) or access control solutions.

Add LDAP as a SSO Provider in Harness. This step involves authenticating with your LDAP server and defining how Harness will query it for users and groups. Add a Harness User Group and link it to your LDAP directory. Harness syncs all the users in that LDAP user group automatically and manages user authorization.