HSRP walkthrough — how default gateway redundancy actually works

Every device on a subnet has a default gateway. What happens when that gateway dies? Without redundancy, every host on the subnet loses its way out. Static-configured hosts don’t ARP for a new gateway. DHCP-configured hosts keep the old gateway IP in their lease. Either way, the LAN goes dark until an admin either fixes the router or manually points hosts at a different one.

HSRP (Hot Standby Router Protocol) solves this. Two (or more) routers share a virtual IP and virtual MAC that clients use as the default gateway. If the active router fails, the standby takes over the virtual IP and virtual MAC. Clients don’t notice. No ARP re-learning, no DHCP renewal, no downtime.

This post walks through the model, the show commands, priority and preempt, interface tracking, and the exact CCNA-favorite question about virtual MAC addresses.

The model — one virtual, two physical

Draw two routers on a diagram: R1 and R2. Both connect to the same LAN (VLAN 10, 10.0.10.0/24).

• R1’s real IP: 10.0.10.1
• R2’s real IP: 10.0.10.2
• HSRP virtual IP: 10.0.10.254
• HSRP virtual MAC: 0000.0c07.acXX (XX = HSRP group number in hex)

Every PC in VLAN 10 has default gateway 10.0.10.254. When a PC needs to reach the internet, it ARPs for 10.0.10.254. Whichever router is currently active answers with the virtual MAC. The PC sends its default-route traffic to that MAC. HSRP hands the frame to the active router’s OS.

If the active router dies, the standby detects it (via missed HSRP hellos), promotes itself to active, and starts answering ARPs and forwarding traffic under the virtual MAC. Clients see no change.

Priority and preempt — who’s boss

Each router in an HSRP group has a priority (default 100). Highest priority wins the active-router election. Ties broken by highest configured IP address.

To make R1 the preferred active:

R1(config)# interface g0/0
R1(config-if)# ip address 10.0.10.1 255.255.255.0
R1(config-if)# standby 1 ip 10.0.10.254
R1(config-if)# standby 1 priority 110
R1(config-if)# standby 1 preempt

Without preempt, priority only matters at the initial election. Once R2 becomes active because R1 is down, R1 comes back online but stays as standby forever unless it re-preempts. standby 1 preempt says “as soon as I have the higher priority, take over.”

This is the #1 HSRP gotcha in real deployments. Someone configures priority correctly, an outage happens, the standby takes over, the primary reboots and comes back — and traffic keeps flowing through what everyone assumes is the standby. Six months later, when the standby actually fails, everyone’s surprised the “primary” has no traffic. Always configure preempt.

Interface tracking — the WAN uplink matters, not the LAN

Priorities alone only detect complete router failure. But often the router’s LAN-side interface is fine while its WAN uplink is down — meaning HSRP thinks the router is healthy while it can’t actually forward traffic to the internet.

Interface tracking fixes this. Tell HSRP to decrement priority when a specific interface goes down:

R1(config-if)# standby 1 track 100 decrement 20
R1(config)# track 100 interface g0/1 line-protocol

Now if R1’s WAN link (g0/1) drops, R1’s HSRP priority drops from 110 to 90. R2 (priority 100, with preempt) takes over. When R1’s WAN comes back, priority returns to 110, and R1 re-preempts.

This is the mechanism that makes HSRP genuinely resilient — not just “detects a dead router” but “detects a router with no path out.”

The virtual MAC question that CCNA loves

Every HSRP group uses a specific virtual MAC address format. It’s not random — it’s derived from the group number.

• HSRPv1 (default): virtual MAC = 0000.0c07.acXX, where XX = group number in hex (0–255).
• HSRPv2: virtual MAC = 0000.0c9f.fXXX, where XXX = group number in hex (0–4095). HSRPv2 supports IPv6 and much larger group ranges.

For group 1, HSRPv1 virtual MAC = 0000.0c07.ac01.

The exam loves to give you a show standby output and ask “what is the virtual MAC” or “which HSRP version is this.” Memorize the two prefixes: 0000.0c07.ac (v1) and 0000.0c9f.f (v2).

The show commands

R1# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State    Active          Standby         Virtual IP
Gi0/0       1    110 P Active   local           10.0.10.2       10.0.10.254

R1# show standby g0/0
GigabitEthernet0/0 - Group 1
  State is Active
    12 state changes, last state change 04:23:19
  Virtual IP address is 10.0.10.254
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec
  Priority 110 (configured 110)
    Track object 100 state Up decrement 20
  Preemption enabled
  Active router is local
  Standby router is 10.0.10.2, priority 100 (expires in 8.192 sec)
  Priority tracking 1 objects
    Track object 100 (interface Gi0/1 line-protocol), Up

Read that output top-to-bottom on a real router and every HSRP concept is right there.

HSRP vs VRRP vs GLBP — the family

• HSRP is Cisco-proprietary. Simple, well-known.
• VRRP is an IETF open standard. Almost identical behavior. Works between Cisco and non-Cisco routers.
• GLBP is Cisco’s answer to “why should only one router forward at a time?” It load-balances client ARPs across multiple gateways in the same group, so both routers forward simultaneously. Great for high-throughput LANs — but rare on the CCNA exam.

CCNA scope: HSRP is the deep-dive one. VRRP shows up as a comparison. GLBP is a bullet point.

Common mistakes

1. Forgetting preempt. Priorities without preempt only matter at election time. Standby stays standby forever after the first failover.

2. Setting the virtual IP to a real interface IP. The virtual IP must be unused by any real interface. If R1’s real IP is .1 and you set the virtual IP to .1 too, HSRP breaks.

3. Not tracking the WAN uplink. Router alive, WAN dead — HSRP happily forwards traffic into a black hole.

4. Mixing HSRPv1 and HSRPv2 in the same group. They won’t talk. Match the version explicitly if you have interop concerns.

5. Trusting the standby to have the same config as the active. HSRP handles gateway-IP failover only. If R2 has different NAT, ACL, or routing config than R1, failover will surprise you. HSRP is not config replication.

Cheat strip

Concept	One-line meaning
Virtual IP	The gateway address clients use — floats between routers
Virtual MAC	0000.0c07.acXX (v1) or 0000.0c9f.fXXX (v2). XX = group
Priority default	100
Preempt	Take back active role when priority is highest again
Track / decrement	Drop priority when a tracked interface goes down
Hello / hold	3s / 10s default. Hold = time before standby takes over
Group number	Identifier — must match on both routers
HSRPv1	Legacy, up to 255 groups, IPv4 only
HSRPv2	Modern, up to 4095 groups, IPv6 support
Active / Standby / Init / Listen / Speak	The five states — Active is forwarding

Try it in your head first

Two routers, both up, R1 priority 110 with preempt, R2 priority 100 with preempt. What happens if R1’s LAN interface goes down?

• R1’s HSRP hellos stop.
• R2’s hold timer (10 seconds) expires.
• R2 promotes to Active. Clients ARP for the virtual IP, R2 answers.
• R1 comes back — its priority (110) beats R2 (100). Preempt fires. R1 becomes Active again.

Now: what if R1’s WAN interface goes down but LAN is fine, and there’s no tracking?

• R1 stays Active. All clients send their traffic to R1. R1 has no path out. Traffic drops.

Add standby 1 track 100 decrement 20, and R1’s priority drops to 90 when the WAN dies. R2 (100) beats it, preempts, takes over. Correct.

The whole thing takes 30 lines of config and gives you zero-downtime gateway. Under 2 seconds of failover. Worth every minute of the CCNA drill.