Course contents

Chapter 9: First-Hop RedundancyLesson 3 of 5

GLBP: Gateway Load Balancing Protocol

One virtual IP and every router forwarding: the AVG and AVF roles, forwarder MACs, load-balancing methods, failure timers, weighting and show glbp.

Intermediate · 14 min read

Technical definition

GLBP (Gateway Load Balancing Protocol) is a Cisco proprietary first-hop redundancy protocol that load balances inside one group. Routers share one virtual IP address, one router acts as the Active Virtual Gateway (AVG), and up to four routers act as Active Virtual Forwarders (AVFs), each with its own virtual MAC address.

The problem GLBP solves

With HSRP or VRRP, one router forwards and the other waits. The standby router and its uplink sit idle until a failure. You can share the load by running two groups with swapped priorities, but that means two gateway addresses, two DHCP pools and manual planning. GLBP puts the load balancing inside one group: one virtual IP, every router forwarding.

AVG and AVF: the two GLBP roles

GLBP: the AVG hands out a different forwarder MAC to each host
GLBP: the AVG hands out a different forwarder MAC to each hostThree routers share virtual IP 192.168.10.1 in GLBP group 10. R1 is the active virtual gateway and also forwarder 1. R2 and R3 are forwarders 2 and 3. Each forwarder has its own virtual MAC. The AVG answers each host's ARP request for the virtual IP with a different forwarder MAC, so the three hosts send through three different routers.Host 1ARP reply: …0a01Host 2ARP reply: …0a02Host 3ARP reply: …0a03SW1R1AVG + AVF 10007.b400.0a01R2AVF 20007.b400.0a02R3AVF 30007.b400.0a03The AVG (R1) is elected by priority, like HSRP. R2 and R3 learn they are forwarders from the AVG.
All three hosts have the same gateway IP, 192.168.10.1. Only the MAC in their ARP cache differs, and that decides which router forwards for them. Group 10 is 0a in hex; the last byte is the forwarder number.
  • The AVG (Active Virtual Gateway) is elected in the group. It owns the virtual IP, answers ARP requests for it, and assigns a virtual MAC address to each forwarder.
  • An AVF (Active Virtual Forwarder) is a router that forwards traffic sent to its virtual MAC. The AVG is also an AVF. A group has up to four active AVFs, numbered 1 to 4. Extra routers wait in the listen state.
  • Forwarder virtual MACs are 0007.b400.XXYY: XX is the group number in hex (group 10 is 0a) and YY is the forwarder number. Forwarder 2 of group 10 is 0007.b400.0a02.
  • The AVG is elected like an HSRP active router: highest priority (default 100), then highest IP address. Preempt for the AVG is off by default.
  • Hellos go to 224.0.0.102 on UDP port 3222, every 3 seconds with a hold time of 10 seconds by default.

How a host ends up at a particular router

  1. Host 1 ARPs for the gateway 192.168.10.1. The AVG replies with forwarder 1's MAC, 0007.b400.0a01.
  2. Host 2 ARPs for the same IP. The AVG replies with forwarder 2's MAC, 0007.b400.0a02.
  3. Host 3 gets forwarder 3's MAC the same way.
  4. Each host sends its off-subnet frames to the MAC it was given, so each router carries a share. The hosts have no idea GLBP exists.

Only the choice of MAC in the ARP reply is balanced. A host keeps the MAC for as long as its ARP entry lives, so balancing is per host, not per flow or per packet.

Load-balancing methods

Three ways the AVG shares hosts across forwarders
Three ways the AVG shares hosts across forwardersGLBP load balancing: round robin gives each ARP reply the next forwarder MAC in turn and is the default; weighted gives replies in proportion to each forwarder's weighting; host-dependent always gives the same host the same forwarder MAC.Round robinEach ARP reply gets thenext forwarder MAC in turn.Default. Even split whenrouters are equal.WeightedReplies in proportion toeach forwarder's weighting.Use when one uplink orrouter is bigger.Host-dependentThe same host always getsthe same forwarder MAC.Use when a flow must keepone path, e.g. stateful NAT.
Commands: glbp 10 load-balancing round-robin, weighted or host-dependent. The choice only decides which MAC is in an ARP reply; the hosts do not know GLBP exists.

Round robin is the default and works for most LANs. Weighted uses each forwarder's weight (default 100), so a router with weight 200 gets twice as many hosts as one with 100. Host-dependent keeps one host on one forwarder, which suits designs where a stateful device such as a NAT router or firewall sits behind each gateway and must see both directions of a conversation.

What happens when a forwarder fails

When a GLBP forwarder fails: three timers
When a GLBP forwarder fails: three timersWhen forwarder R2 fails, after the hold time of 10 seconds another router takes over R2's virtual MAC so hosts that cached it recover. After the redirect timer of 10 minutes the AVG stops handing out R2's MAC in ARP replies. After the timeout of 4 hours the AVG removes R2's forwarder from the group.0 sR2 failsforwarder 2.hold time (10 s)Another router takes overR2's MAC, hosts recover.redirect (10 min)AVG stops giving outR2's MAC in ARP replies.timeout (4 hours)AVG removes R2'sMAC from the group.Hosts that already cached R2's MAC are never left pointing at a dead router.New ARP requests stop getting that MAC after the redirect timer.
Defaults: hold time 10 s, redirect timer 600 s, timeout 14400 s. The long timeout is deliberate: it keeps the MAC reserved in case the router comes back.

The failure of a forwarder is handled in three steps. First, after the hold time, another router (a secondary forwarder in listen state) takes over the failed router's virtual MAC, so hosts that already cached it keep working. Second, after the redirect timer (10 minutes by default) the AVG stops answering ARP requests with the failed router's MAC. Third, after the timeout (4 hours) the AVG removes it from the group.

If the AVG fails, the standby AVG takes over the virtual IP and the AVG role. The forwarders keep forwarding throughout.

Weighting and tracking

An AVF has a weight (default 100). You can reduce it when an uplink fails. Two thresholds control what happens: if the weight falls below the lower threshold the router stops forwarding, and it resumes when the weight rises above the upper threshold. This is GLBP's version of HSRP tracking: it stops the router from keeping hosts that would be forwarded into a dead uplink.

How to configure GLBP on Cisco IOS

Commands are based on Cisco IOS / IOS XE documentation and haven't been run on a lab device here. GLBP is not available on every platform; check your hardware.

! R1: AVG interface GigabitEthernet0/0 ip address 192.168.10.2 255.255.255.0 glbp 10 ip 192.168.10.1 glbp 10 priority 110 glbp 10 preempt glbp 10 load-balancing round-robin

Group 10, virtual IP .1. R1's higher priority makes it the AVG, and preempt lets it take the role back. Round robin is the default; it is written out for clarity.

! R2 and R3 (use .3 and .4) interface GigabitEthernet0/0 ip address 192.168.10.3 255.255.255.0 glbp 10 ip 192.168.10.1

Same group and virtual IP. R2 and R3 learn the group from the AVG; they need no priority unless one should be the standby AVG.

track 1 interface GigabitEthernet0/1 line-protocol interface GigabitEthernet0/0 glbp 10 weighting 100 lower 70 upper 90 glbp 10 weighting track 1 decrement 40

If the uplink fails, the weight drops from 100 to 60. That is below the lower threshold of 70, so this router stops forwarding until the uplink returns and the weight climbs above 90.

Hosts must use the virtual IP, 192.168.10.1, as their default gateway, exactly as with the other FHRPs.

Reading show glbp brief

Example output · based on Cisco documentation; exact format varies by platform and software version
R1#show glbp brief
Interface   Grp  Fwd Pri State    Address         Active router   Standby router
Gi0/0       10   -   110 Active   192.168.10.1    local           192.168.10.3
Gi0/0       10   1   -   Active   0007.b400.0a01  local           -
Gi0/0       10   2   -   Listen   0007.b400.0a02  192.168.10.3    -
Gi0/0       10   3   -   Listen   0007.b400.0a03  192.168.10.4    -
Example output from the AVG, R1. The first row is the group itself: R1 is the Active AVG and 192.168.10.3 is the standby AVG. The numbered rows are the forwarders: R1 is Active for forwarder 1, and forwarders 2 and 3 are owned by the routers listed in the Active router column. Run show glbp for the timers, load-balancing method and counts of hosts per forwarder.

GLBP faults and what to check

GLBP faults and what to check
GLBP faults and what to checkSymptom; Likely cause; Check / fix. All hosts use one router: Hosts hold the same MAC from an old ARP entry, or one AVF is not active show glbp brief: are all forwarders Active? Clear ARP on a test host. Only some hosts lose access after a failure: They cached the failed router's MAC and no router took it over Check that a listening router is present; wait for the hold time. No forwarders other than the AVG: Routers cannot hear Hellos: UDP 3222 blocked or wrong VLAN Ping between real addresses; permit UDP 3222 to 224.0.0.102. Traffic to a stateful firewall breaks: Return traffic uses a different gateway than the request Use host-dependent load balancing, or share state between the devices. Router forwards into a dead uplink: No weighting track configured Track the uplink and set weighting thresholds.SymptomLikely causeCheck / fixAll hosts use onerouterHosts hold the same MAC from an oldARP entry, or one AVF is not activeshow glbp brief: are all forwardersActive? Clear ARP on a test host.Only some hosts loseaccess after a failureThey cached the failed router's MACand no router took it overCheck that a listening router ispresent; wait for the hold time.No forwarders otherthan the AVGRouters cannot hear Hellos: UDP 3222blocked or wrong VLANPing between real addresses; permitUDP 3222 to 224.0.0.102.Traffic to a statefulfirewall breaksReturn traffic uses a differentgateway than the requestUse host-dependent load balancing, orshare state between the devices.Router forwards into adead uplinkNo weighting track configuredTrack the uplink and set weightingthresholds.

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left column names the symptom, the others give the cause and the fix.

When GLBP is the wrong choice

  • Other vendors' routers must share the gateway: GLBP is Cisco only.
  • The platform does not support it, which is the case on several Layer 3 switch families.
  • Stateful devices behind the routers cannot cope with the same host's traffic arriving through different paths.
  • The routers have different uplink capacities and nobody will maintain the weights.

Exam tip: GLBP is the one that load balances in a single group. Know AVG and AVF, up to four forwarders, the 0007.b400.XXYY virtual MAC, that the AVG answers ARP with different forwarder MACs, round robin as the default method, and that it is Cisco proprietary.

GLBP facts for the exam

  • One virtual IP; the AVG answers ARP and assigns forwarder MACs.
  • Up to four active AVFs per group; virtual MAC 0007.b400.XXYY.
  • Hellos to 224.0.0.102, UDP 3222; hello 3 s, hold 10 s.
  • Load balancing: round robin (default), weighted, host-dependent.
  • Timers: redirect 10 minutes, timeout 4 hours.
  • Verify with show glbp brief.

Test yourself on GLBP

Predict · scenario 1

How does GLBP make different hosts use different routers while they all have the same default gateway IP?

Predict · scenario 2

How many AVFs can be active in one GLBP group?

Predict · scenario 3

Which virtual MAC could belong to GLBP group 10, forwarder 2?

Predict · scenario 4

Which GLBP load-balancing method always gives the same host the same forwarder?

Predict · scenario 5

A GLBP forwarder fails. After which timer does the AVG stop giving out its MAC in ARP replies?

FAQ

How can hosts share one gateway IP but use different routers?
Through ARP. Every host asks for the MAC address of 192.168.10.1, and the AVG answers with a different forwarder's virtual MAC each time. The host stores that MAC and sends all its off-subnet frames to it. The IP is shared; the MAC decides the router.
Is the AVG the only router that forwards?
No. The AVG also acts as one of the forwarders. Its extra job is to answer ARP requests and assign forwarder MACs to the other routers.
How many routers can forward in one GLBP group?
Up to four active forwarders. Additional routers in the group stay in a listening state as backups for the forwarders.
Is GLBP available on every Cisco platform?
No. It is supported on many routers, but several Layer 3 switch families do not support it. Check the platform's feature list before designing around GLBP.