HSRP vs VRRP vs GLBP — Which First-Hop Redundancy for CCNA (and Real Networks)

Why FHRP exists at all

Every host on a LAN has one default gateway configured. When that gateway dies — router reload, uplink failure, hardware fault — hosts stop reaching everything off-subnet. There’s no backup, because ARP only ever resolved one MAC for the gateway IP.

FHRP (First-Hop Redundancy Protocol) solves this by putting two or more routers behind a virtual IP + virtual MAC. Hosts still point at one IP; multiple routers stand ready to answer for it. When the active router dies, another one silently takes over the virtual MAC and traffic keeps flowing — usually within a couple of seconds.

Three protocols do this on Cisco gear. The CCNA (200-301) expects you to compare them at a describe level; only HSRP is asked about at the config level.

HSRP vs VRRP vs GLBP — the comparison table

HSRP — the CCNA default

Cisco’s original, dates from 1994. If a Cisco book says “gateway redundancy” without qualification, it’s talking HSRP.

Roles:

• Active — answers ARP for the virtual IP, forwards traffic
• Standby — monitors the Active via hellos, takes over on failure
• Listen / Speak / Init — transient states during election

Election: highest priority wins (default 100, higher is better). If priorities tie, highest interface IP wins the tie-break. Preempt is OFF by default — meaning a router that comes back up won’t reclaim Active until the current Active dies. Almost always you want to turn preempt ON so your intended-active router runs the show.

Interface tracking: standby G track <if> decrements priority when the tracked link goes down. Common pattern: track the WAN uplink so if you lose the upstream ISP, HSRP fails over to the peer that still has connectivity.

VRRP — the standards-compliant sibling

IETF equivalent. If you have Cisco talking to Juniper, Arista, or a Fortinet cluster — you can’t use HSRP; use VRRP. Semantically almost identical:

• Master = Active (VRRP-speak)
• Backup = Standby
• Preempt is ON by default (opposite of HSRP)
• The Master can share the virtual IP with the interface’s real IP (HSRP always uses a separate virtual IP)
• Election: highest priority, but priority 255 has special meaning (“IP owner” — router whose real interface IP == virtual IP)

Cisco IOS speaks both HSRP and VRRP simultaneously — the choice is what you write in the config, not the platform.

GLBP — the load-balancing one

Cisco’s answer to HSRP’s “only one active” limitation. Multiple routers in a GLBP group all forward traffic concurrently — hosts on the LAN get different virtual MACs when they ARP for the gateway.

Roles:

• AVG (Active Virtual Gateway) — one per group, hands out MACs when hosts ARP
• AVF (Active Virtual Forwarder) — 1-4 per group, each owning a different virtual MAC and forwarding for the hosts assigned to them

Load-balancing methods: round-robin (default), weighted (bigger routers get more traffic), host-dependent (same host always uses same forwarder — sticky).

Rarely deployed in practice — most enterprises live with HSRP + link aggregation on the uplinks instead. Still on the exam because “the CCNA covers FHRPs” and GLBP is what makes Cisco’s FHRP story unique.

Real IOS config — the three side-by-side

HSRP on a Cisco L3 switch (the CCNA staple):

MLS1(config)# interface Vlan10
MLS1(config-if)# ip address 192.168.10.2 255.255.255.0
MLS1(config-if)# standby version 2
MLS1(config-if)# standby 10 ip 192.168.10.1
MLS1(config-if)# standby 10 priority 110
MLS1(config-if)# standby 10 preempt
MLS1(config-if)# standby 10 track GigabitEthernet0/1 decrement 20
MLS1(config-if)# standby 10 authentication md5 key-string SecretKey!

VRRP — same idea, different syntax:

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 192.168.10.2 255.255.255.0
R1(config-if)# vrrp 10 ip 192.168.10.1
R1(config-if)# vrrp 10 priority 110
R1(config-if)# vrrp 10 authentication text mysecret

GLBP — with round-robin load balancing:

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 192.168.10.2 255.255.255.0
R1(config-if)# glbp 1 ip 192.168.10.1
R1(config-if)# glbp 1 priority 150
R1(config-if)# glbp 1 preempt
R1(config-if)# glbp 1 load-balancing round-robin

Try any of these on our live console — the engine accepts all three FHRP families.

Verification commands

! HSRP
R1# show standby brief
R1# show standby GigabitEthernet0/0 10

! VRRP
R1# show vrrp brief
R1# show vrrp interface GigabitEthernet0/0

! GLBP
R1# show glbp brief
R1# show glbp GigabitEthernet0/0 1

Which one to pick — a decision tree

1. Cisco-only network? → HSRP. It’s the default, most documented, easiest to troubleshoot.
2. Mixed vendors on the same subnet? → VRRP. Only choice.
3. Need active/active load balancing? → GLBP (Cisco only) or a completely different design (anycast gateway, VRRP with routed active/active via BGP).
4. On the exam? → Read the question. If it says “Cisco proprietary” and asks about VIP+VMAC — HSRP. If “IETF standard” — VRRP. If “load-balancing FHRP” — GLBP.

The #1 mistake

Forgetting to enable preempt on HSRP. Default is OFF — meaning your “primary” router (the one with priority 110) can come back after a reload and sit in Standby while the “secondary” (priority 100) keeps running as Active. The primary won’t take back over until the secondary dies. Almost every real-world HSRP config wants standby G preempt. On VRRP this is on by default so it’s less of a trap there.

Related deep-dives

• HSRP walkthrough — how default gateway redundancy actually works — HSRP alone in more depth
• Inter-VLAN routing — SVIs vs Router-on-a-Stick — the L3-switch side of the same problem
• FHRP comparison — the topic page — reference table + lab scenarios