Enabling An Interface Using IP SLA And EEM
I've been playing a lot with running HSRP for both IPv4 and IPv6. One thing I hadn't figured out was how to move my Hurricane Electric IPv6 tunnel from my primary router to the backup if the primary has an issue. I finally got it working using IP SLA, Embedded Event Manager (EEM) and DynDNS.
First step: create a DDNS update method. Hurricane Electric has a handy feature where you can use DynDNS updates to move your tunnel to a new IP. It's handy if you have a DHCP-enabled internet connection. This should be identical on both the primary and backup routers.
ip ddns update method HURRICANEELECTRIC-TUNNEL HTTP add http://yourusername:email@example.com/nic/update?hostname=yourhostnumber interval maximum 0 0 15 0 interval minimum 0 0 10 0
Next, create the tunnel interface on the backup router. Not going into too much depth, as it's all listed on Hurricane Electric's site. The important part here is that the interface is shut down and the DDNS update method is applied to the tunnel interface, not your router's WAN interface. It also needs an IPv4 address (something bogus), otherwise the DDNS update method will never be used.
interface tun6 shutdown ip address 10.10.2.1 255.255.255.254 ip ddns update HURRICANEELECTRIC-TUNNEL
Now create your IP SLA policy and the track object. This pings the LAN interface of the primary router.
ip sla 66 icmp-echo 10.10.10.253 timeout 50 ip sla schedule 66 life forever start-time now track 66 ip sla 66 reachability delay up 10
Finally, create your EEM scripts. The first script will no-shut the tunnel6 interface. This will in turn trigger a DDNS update, which will move the tunnel. The second script shuts down the tunnel6 interface.
event manager applet MOVE_IPv6_WHEN_PRIMARY_IS_DOWN event track 66 state down action 1.0 syslog msg "PING TO PRIMARY FAILED. MOVING IPv6." action 1.1 cli command "enable" action 1.2 cli command "config t" action 1.3 cli command "interface tun6" action 1.4 cli command "no shutdown" event manager applet RELEASE_IPv6_WHEN_PRIMARY_IS_UP event track 66 state up action 1.0 syslog msg "PING TO PRIMARY SUCCEEDED. MOVING IPv6 BACK." action 1.1 cli command "enable" action 1.2 cli command "config t" action 1.3 cli command "interface tun6" action 1.4 cli command "shutdown"
The key is that the primary router has likely already done its own DDNS update, and moved the tunnel and taken over as the HSRP active router. From my experience, I see a single ping drop when switching back to the primary.