HSRP vs VRRP vs GLBP: FHRP Compared

Mental model

Hosts on a LAN have one default gateway. If that gateway dies, the LAN is islanded, even if there’s a perfectly good second router on the same VLAN.

FHRPs (First Hop Redundancy Protocols) solve this by giving the gateway role a virtual IP that any of two or more physical routers can claim. Hosts only ever see the virtual IP; the protocol handles the failover under the hood.

If you haven’t already, read FHRP & HSRP basics first. This topic compares the three FHRPs at a deeper level.

At a glance

HSRP: Cisco’s everyday workhorse

SW1(config)# interface Vlan10
SW1(config-if)# ip address 192.168.10.2 255.255.255.0
SW1(config-if)# standby version 2
SW1(config-if)# standby 10 ip 192.168.10.1
SW1(config-if)# standby 10 priority 110
SW1(config-if)# standby 10 preempt
SW1(config-if)# standby 10 authentication md5 key-string SecretKey!
SW1(config-if)# standby 10 track Gi0/1

Three things to memorize:

1. standby <group> ip <virt-ip>: the virtual IP.
2. priority: default 100. Higher wins. Without explicit priority, the router with the highest IP becomes Active.
3. preempt: without this, a recovered higher-priority router does NOT take back the Active role. Most ops engineers forget this.

States: Initial → Learn → Listen → Speak → Standby → Active.

VRRP: same idea, open standard

SW1(config)# interface Vlan10
SW1(config-if)# ip address 192.168.10.2 255.255.255.0
SW1(config-if)# vrrp 10 ip 192.168.10.1
SW1(config-if)# vrrp 10 priority 110
SW1(config-if)# vrrp 10 authentication md5 key-string SecretKey!

Differences vs HSRP that you should remember:

• Preempt is on by default (you don’t need to type preempt).
• The Master can use a real interface IP as the virtual IP. So priority 255 (= “I own this IP”) means the owner is always master while it is up. If it fails, a backup still takes over.
• Standard means a Juniper or Arista box can run VRRP with the Cisco gear. Use it any time you have mixed vendors.

VRRPv3 (RFC 5798) covers both IPv4 and IPv6 with one protocol.

GLBP: the only active-active FHRP

HSRP and VRRP have one Active and N standbys. Standbys carry zero traffic. Wasteful if you spent money on two equally capable routers.

GLBP fixes this by load-sharing across multiple Active Virtual Forwarders (AVFs):

1. One router elected as AVG (Active Virtual Gateway) handles the ARP responses.
2. Multiple routers register as AVFs (Active Virtual Forwarders). Each owns a different virtual MAC.
3. When a host ARPs for the virtual IP, the AVG responds with a different virtual MAC each time, round-robin or weighted.
4. Different hosts get pointed at different physical routers. Both routers actively forward.

SW1(config)# interface Vlan10
SW1(config-if)# glbp 10 ip 192.168.10.1
SW1(config-if)# glbp 10 priority 110
SW1(config-if)# glbp 10 preempt
SW1(config-if)# glbp 10 load-balancing weighted

SW1(config-if)# glbp 10 weighting 100 lower 80 upper 95
SW1(config-if)# glbp 10 weighting track 1 decrement 30

GLBP load-balancing methods:

• round-robin: alternates virtual MACs per ARP response.
• weighted: proportional to each AVF’s weight value.
• host-dependent: same host always gets same AVF (stickiness).

Multiple AVFs means multiple paths used simultaneously, but it does NOT mean per-flow load-balance across routers. Each flow still sticks to one AVF for its lifetime (the host’s MAC table never changes mid-flow).

Object tracking: same on all three

You don’t want to remain Active if your upstream link died. Track the upstream interface:

! Define a tracked object
SW1(config)# track 1 interface Gi0/1 line-protocol

! Tie HSRP priority to it
SW1(config-if)# standby 10 track 1 decrement 30

! Or VRRP
SW1(config-if)# vrrp 10 track 1 decrement 30

! Or GLBP weighting
SW1(config-if)# glbp 10 weighting track 1 decrement 30

If Gi0/1 goes down, priority drops by 30. If the other router has higher effective priority, it takes over.

You can also track:

• IP route presence (track 2 ip route 10.0.0.0/8 reachability)
• IP SLA probe state (track 3 ip sla 1 reachability)
• Other object boolean combinations

Authentication: don’t skip it

All three protocols accept hellos by default from anyone on the segment. A malicious host can pretend to be a high-priority router and hijack the gateway.

• HSRP MD5: standby 10 authentication md5 key-string MyKey
• VRRP MD5 (v2 only): vrrp 10 authentication md5 key-string MyKey
• GLBP MD5: glbp 10 authentication md5 key-string MyKey

VRRPv3 caveat: RFC 5798 explicitly removed authentication from VRRPv3. The IETF concluded that VRRP’s threat model is better solved with IPsec or link-layer protections than with the weak shared-secret auth in v2. Cisco IOS still accepts authentication on VRRPv2 configurations; on VRRPv3 there is no native auth knob. Treat HSRP MD5 and GLBP MD5 as the “default-on” production controls; for VRRP, rely on the L2/L3 fabric being trusted.

Always enable HSRP/GLBP authentication in production.

Which to pick: 2026 guidance

In real life, HSRP is the default in Cisco shops because it’s simple, well-understood, and the load-sharing benefit of GLBP is usually overrated. Most enterprise traffic is asymmetric anyway (uplink saturated, downlink less so).

Verification

! HSRP
SW1# show standby brief
SW1# show standby Vlan10 detail

! VRRP
SW1# show vrrp brief
SW1# show vrrp Vlan10 detail

! GLBP
SW1# show glbp brief
SW1# show glbp Vlan10 detail

brief is your default: it shows group, virtual IP, state, priority, preemption, active/standby routers in one line per group.

Reading HSRP and VRRP status output (CCNA v2.0 3.4)

The brief commands from the Verification section give one line per group. Here’s what that line looks like on IOS XE, using the lab addressing below (SW1 is .2, SW2 is .3, the virtual gateway is .1).

show standby brief

SW1# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Vl10        10   110 P Active  local           10.1.10.3       10.1.10.1

• Grp: HSRP group number. Must match on both routers.
• Pri: this router’s priority (default 100).
• P: preempt is configured. A blank means it isn’t.
• State: this router’s role. Active forwards for the virtual IP, Standby is next in line. Listen means a third router that is neither; Speak means an election is under way; Init means HSRP isn’t running yet.
• Active / Standby: who holds each role. local means this router.
• Virtual IP: the default gateway your hosts use.

show vrrp brief

SW1# show vrrp brief
Interface          Grp  A-F Pri  Time Own Pre State   Master addr/Group addr
Vl10                10 IPv4 110     0  N   Y  MASTER  10.1.10.2(local) 10.1.10.1

• A-F: address family, IPv4 or IPv6 (VRRPv3, enabled on Catalyst 9000 with fhrp version vrrp v3).
• Pri: priority (default 100).
• Own: Y if this router owns the virtual IP as its real interface address.
• Pre: Y means preempt is on. For VRRP that’s the default.
• State: MASTER forwards, BACKUP waits, INIT isn’t participating yet.
• Master addr/Group addr: the real address of the current master, then the virtual IP.

Three quick diagnoses

1. Both routers show Active (or both MASTER). They aren’t hearing each other’s hellos. Check that the group number, virtual IP and authentication match, and that there’s a working Layer 2 path between them: the VLAN exists and is allowed on every trunk in between.
2. The higher priority router is sitting in Standby. Preempt is missing: no P in the HSRP line. Add standby 10 preempt. On VRRP, check that someone didn’t turn preemption off, since it’s on by default.
3. State is Init. HSRP isn’t running on that interface. Confirm the interface or SVI is up/up (an SVI stays down until a port in its VLAN is up) and that the group’s virtual IP is in the same subnet as the interface address.

Common mistakes

1. Forgetting preempt on HSRP/GLBP. Configured priority 110, expected this router to be Active, but original Active never gave the role back after recovery.

2. VRRP virtual IP same as a real interface IP. Some platforms allow it, some don’t. Either commit to “virtual IP is its own address” or commit to “virtual IP is the master’s real address with priority 255”: don’t mix.

3. Missing version 2 on HSRP for IPv6. HSRPv1 only carries IPv4. HSRPv2 carries both.

4. GLBP load-balance method = round-robin in DHCP environments. Pairs of ARP-from-same-MAC requests can end up with different AVFs, works fine, but stateful flows can get confused if combined with NAT or PBR.

5. Tracking the wrong thing. Tracking interface line-protocol doesn’t catch a routing-protocol failure or a downstream IP SLA. Use the right track type per dependency.

6. Authentication mismatch. Different key on the two routers → both think they’re Active. Same VIP responds twice; hosts get inconsistent MACs. Always verify keys match.

7. No FHRP at all. A surprising number of campus networks rely on a single Layer-3 switch for VLAN gateways. One reload = one outage. Always at least HSRP, even between two stack members.

Lab to try tonight

1. Two L3 switches (or two routers), one VLAN with a host. Each switch has a real IP in VLAN 10 (.2 and .3), virtual gateway .1.
2. Configure HSRP group 10: priority 110 on SW1, default 100 on SW2. Verify with show standby brief: SW1 is Active.
3. From the host, ARP for .1. Note the virtual MAC starts with 0000.0c.
4. Shut down SW1’s interface. Verify SW2 becomes Active. Host keeps pinging (a couple of dropped packets at most).
5. Reload SW1. Without preempt, SW1 stays Standby. Add standby 10 preempt and watch it reclaim Active.
6. Convert the same VLAN to VRRP. Notice preempt is now on by default and the virtual MAC starts with 0000.5e.
7. Bonus: convert to GLBP. Add a second host. show glbp brief should show TWO AVFs forwarding. ARP from each host. See different virtual MACs.
8. Bonus: add interface tracking (track 1 interface Gi0/1 line-protocol), shut the uplink, watch the active role flip even though the LAN-side interface is still up.

Cheat strip