HA / FAILOVER LAB
2SEC
Measured interruption when the active gateway lost power — not a theoretical spec.
A single switch failure shouldn't cost a trading desk its connection. Here's the redundant gateway that makes sure it doesn't.
The setup
Two Cisco 3560E switches share one virtual IP on VLAN 70 using HSRP. One is deterministically active, one is standby, and a client on the network never knows which physical switch is actually answering — it just points at the virtual address and keeps working.
Spanning Tree root is aligned to whichever switch is HSRP active, so Layer 2 and Layer 3 always agree on which device is the real center of the network — not two different switches pulling in different directions.
10.10.70.0/24 — VLAN 70
Virtual IP: 10.10.70.1
Cherwood-3560E ── trunk ── Financial-SW2
10.10.70.2 10.10.70.3
priority 150 priority 100
HSRP: ACTIVE HSRP: STANDBY
STP: root STP: root secondary
Hello / hold timers
1s / 3s
Preemption
Disabled, deliberately
The test
A continuous ping to the virtual IP was running from a real client before power was physically pulled on the active switch — the same failure a network actually experiences, not a config toggle simulating one.
T+0:00
Continuous ping to 10.10.70.1 running, stable at 1–5ms.
T+0:04
Power pulled on the active switch. Ping begins timing out.
T+0:06
Standby switch assumes the active role. Replies resume automatically — roughly 2 seconds of interruption, no manual intervention.
T+later
Power restored to the original switch. It rejoins as standby, not active — confirming preemption was correctly left off.
What actually broke along the way
Three real issues came up building this — a firewall scoping gap, a legacy IOS limitation, and a parsing bug in an already-shipped project that this hardware happened to expose. Full write-ups are in the repo.
Firewall silently blocked the new switch
A management-access policy was scoped to one specific IP, not a range — the new switch simply wasn't covered yet.
Older IOS train doesn't support key-based SSH
Same vendor, same switch family, different IOS version — no key auth support at all. Handled with a per-device fallback, not a workaround.
A long hostname broke a fixed-width parser
The topology-mapping pipeline misread a column when a hostname ran past 20 characters — wrong data, no error raised.