FHRP — HSRP, VRRP & GLBP

Mental model

Hosts on a LAN are configured with one default gateway — typically a single IP. If that gateway router dies, every host on the LAN is suddenly cut off until someone reconfigures the gateway. Bad.

FHRP (First-Hop Redundancy Protocol) is the workaround. Two physical routers share a virtual IP that hosts use as the gateway. The active router answers ARP for that virtual IP. The standby sits quietly watching. If the active fails, the standby takes over the virtual IP within seconds — hosts never know anything changed.

Three flavors you’ll meet:

For CCNA: HSRP is what gets tested most. VRRP is conceptually identical with different terminology. GLBP is mentioned but rarely deep.

HSRP — the dominant CCNA topic

Two routers form an HSRP group (numbered 1–255). The group has a virtual IP and virtual MAC. Hosts use the virtual IP as their gateway.

Priority + preemption — who’s active

Each router has an HSRP priority (1–255, default 100). Higher priority becomes active. If priorities tie, higher IP wins.

R1(config-if)# standby 1 priority 110

But just having higher priority isn’t enough — by default, HSRP doesn’t auto-fail-back. If R1 boots first and becomes active, then R2 boots and has higher priority, R2 won’t take over unless preemption is enabled:

R1(config-if)# standby 1 preempt

Set preempt on both routers, with priority on the preferred-active one.

States (the lifecycle)

A router moves through these as it joins:

Disabled → Init → Listen → Speak → Standby → Active

The two that matter day-to-day:

• Active — the router currently answering for the virtual IP
• Standby — the runner-up, ready to take over

If you see a router stuck in Listen or Speak permanently, it’s a misconfiguration (priority/preemption issue, group mismatch).

Commands — HSRP basic config

! On R1 (active)
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 10.0.0.2 255.255.255.0
R1(config-if)# standby version 2
R1(config-if)# standby 1 ip 10.0.0.1               ! the virtual IP
R1(config-if)# standby 1 priority 110              ! higher than default 100
R1(config-if)# standby 1 preempt

! On R2 (standby)
R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip address 10.0.0.3 255.255.255.0
R2(config-if)# standby version 2
R2(config-if)# standby 1 ip 10.0.0.1               ! same virtual IP, same group #
R2(config-if)# standby 1 priority 100              ! default — lower
R2(config-if)# standby 1 preempt

Always use standby version 2. Version 2 supports more groups and uses a different virtual MAC range — required for modern features.

Interface tracking — failover when an upstream link dies

What if R1’s WAN-facing interface dies but its LAN-facing interface is still up? Without help, R1 stays active — but it can’t actually reach the internet. Hosts pointing at the virtual IP get a black hole.

Object tracking monitors a tracked interface and adjusts priority when it goes down:

R1(config)# track 1 interface GigabitEthernet0/1 line-protocol

R1(config-if)# standby 1 track 1 decrement 20

If Gi0/1 goes down, R1’s HSRP priority drops by 20 (from 110 to 90) — below R2’s 100 — and R2 takes over.

Verification

R1# show standby
R1# show standby brief
R1# show standby vlan 10                 ! when running per-VLAN HSRP

show standby brief is the daily-driver — shows the group, virtual IP, current state, priority, and preempt status in one screen.

VRRP — same idea, open standard

R1(config-if)# ip address 10.0.0.2 255.255.255.0
R1(config-if)# vrrp 1 ip 10.0.0.1
R1(config-if)# vrrp 1 priority 110

VRRP differs from HSRP in three ways worth knowing:

1. The master uses the actual virtual IP as one of its real IPs by default. (HSRP uses a separate virtual IP.)
2. Multicast addresses differ (HSRP: 224.0.0.2, VRRP: 224.0.0.18).
3. Vendor-agnostic, so VRRP works between Cisco and non-Cisco routers.

GLBP — when you want load balancing

In HSRP/VRRP, the standby router sits doing nothing 99% of the time. GLBP fixes this: all routers in the group are active simultaneously, and hosts get different MACs for the same virtual IP — so traffic load-balances across the routers.

R1(config-if)# glbp 1 ip 10.0.0.1
R1(config-if)# glbp 1 priority 110

GLBP elects an AVG (Active Virtual Gateway) which assigns AVF (Active Virtual Forwarder) roles. Cisco-only. Less commonly tested on CCNA but worth recognizing.

Common mistakes

1. Different HSRP groups on each router for the same VLAN. Both routers need to be in the same group (same number). Mismatch → both stay Active independently, hosts get inconsistent gateways.

2. Forgetting preempt. Configure priority but not preempt → router with priority 110 still doesn’t take over from a router with 100. Add preempt on both.

3. Different virtual IPs configured on the two routers. They must match exactly. Easy typo, hard to spot.

4. No tracking of upstream. Setting priority + preempt without tracking means HSRP fails over only when the actual LAN-facing interface dies — not when the WAN-facing interface dies. Always add tracking.

5. Using HSRP version 1 in 2026. Version 1 supports only 256 groups per interface and uses old virtual MAC formats. Always use standby version 2.

6. Different timers between routers. Hello / hold timers must match: standby 1 timers 1 3. Both ends.

Lab to try tonight

1. Two routers (R1, R2), one LAN switch, two PCs.
2. Configure both routers with IPs in 10.0.0.0/24 (R1=.2, R2=.3). Both reach the same upstream.
3. Configure HSRP group 1, virtual IP 10.0.0.1, R1 priority 110, R2 priority 100, preempt on both.
4. Set both PCs’ default gateway to 10.0.0.1. Ping anywhere external — works through R1.
5. Run show standby brief — R1 should be Active.
6. Shut R1’s LAN interface. Watch R2 take over within seconds. Pings continue.
7. Re-enable R1. Watch R2 give Active back to R1 (because of preempt + priority).
8. Bonus: configure object tracking on R1’s upstream interface. Shut it. Confirm R2 takes over (priority decrement working).

Cheat strip

Frequently asked questions

Q: What’s the actual difference between HSRP, VRRP, and GLBP? A: HSRP is Cisco-only. VRRP is the open IETF standard (RFC 5798) — works between Cisco, Juniper, Arista, etc. GLBP is Cisco-only and load-balances traffic across active routers (unlike HSRP/VRRP where one router is active). CCNA scope: HSRP is the deep-dive; VRRP + GLBP are recognition-level.

Q: Why does preempt matter so much? A: Without preempt, priority is only checked at initial election. If R1 (priority 110) is active and fails, R2 (priority 100) takes over. R1 recovers — but stays as standby forever unless preempt is enabled. Six months later when R2 actually fails, everyone’s surprised the “primary” has no traffic. Always configure preempt.

Q: What is HSRP interface tracking? A: It watches an interface (usually the WAN uplink); if the tracked interface goes down, HSRP drops the local priority by a configured amount. Perfect for “router alive but no path out” scenarios. Without tracking, HSRP happily forwards traffic into a black hole.

Q: What does the virtual MAC address tell me? A: HSRPv1 virtual MAC is 0000.0c07.acXX where XX = group number in hex. HSRPv2 is 0000.0c9f.fXXX. So 0000.0c07.ac01 = HSRPv1 group 1. This is a classic CCNA exam question — memorize the two prefixes.

Q: Should I use HSRPv1 or HSRPv2? A: HSRPv2 unless you have a specific reason to stay on v1. v2 supports IPv6, 4096 groups (vs 255 in v1), and cleaner MD5 authentication. On modern IOS, HSRPv2 is a one-line change: standby version 2.

Q: What is a common cause of HSRP flapping? A: Interface flap on a tracked interface, or hello timers set too aggressively. Also unicast issues if you skipped the standby 1 timers msec 250 750 and the LAN has any packet loss. Look at show standby brief and show standby internal for state-change history.

Q: How does HSRP compare to a Layer-3 anycast setup? A: Anycast (advertising the same IP from multiple routers via a routing protocol) is a modern data-center pattern that HSRP predates. In campus / branch, HSRP is still the default because clients don’t run routing protocols. Anycast in a hospital or data center is fine because everything routes.

What to learn next

• Deep-dive comparison: FHRP Comparison — HSRP vs VRRP vs GLBP.
• Try it live: HSRP Failover Simulator — kill routers + WAN uplinks and watch failover behavior in real time.
• Related blog: HSRP walkthrough — how default gateway redundancy actually works.
• Next topic: Static routing done right — often paired with HSRP for the outbound-from-HSRP path.