Course contents

Chapter 9: First-Hop RedundancyLesson 1 of 5

HSRP: Hot Standby Router Protocol

How HSRP elects an active router, its six states, Hellos and timers, priority, preempt and tracking, load sharing with two groups, IPv6, and the Cisco IOS configuration.

Intermediate · 18 min read

Technical definition

HSRP (Hot Standby Router Protocol) is a Cisco proprietary first-hop redundancy protocol. Routers in an HSRP group share one virtual IP address and one virtual MAC address. One router is active and forwards; another is standby and takes over if the active router stops sending Hellos.

Two WAN routers, and the office still goes offline

The office has two routers to the WAN, R1 and R2, so a single failure shouldn't cut everyone off. But every PC has one default gateway: R1's address. One morning R1's power supply dies. R2 is working perfectly, yet nobody can reach anything outside the LAN. The PCs keep sending to an address that no longer answers.

You could change the gateway on every PC by hand, but that is slow and DHCP leases would still hand out the old one. What you need is a gateway address that survives the loss of one router.

What a first-hop redundancy protocol is

A first-hop redundancy protocol (FHRP) lets two or more routers share one virtual IP address (VIP) and one virtual MAC address. Hosts use the virtual IP as their default gateway. The routers agree among themselves which one answers for it. If that router fails, another takes over the same IP and MAC, and the hosts don't notice.

"First hop" means the first router a packet meets when it leaves the LAN. There are three FHRPs on the CCNA exam, each with its own lesson:

  • HSRP (Hot Standby Router Protocol): Cisco proprietary, one active router. This lesson.
  • VRRP (Virtual Router Redundancy Protocol): open standard, one master router.
  • GLBP (Gateway Load Balancing Protocol): Cisco proprietary, several routers forward at once. See also the side-by-side comparison.
VIP 192.168.10.1Gi0/1Gi0/1PC1192.168.10.10 · GW .1SW1VLAN 10ActiveR1Gi0/0 .2 · pri 110StandbyR2Gi0/0 .3 · pri 100WAN / InternetSubnet 203.0.113.0/24

Device key: PC1 (computer) · SW1 (switch) · R1, R2 (router) · WAN / Internet (network / service)

Lines show the example’s network connections. The coloured path and envelope follow the current step; its text identifies the sender, receiver and traffic type. Blocked: forwarding prevented by a port or policy. Down: failed link. Read the step for the cause.

Reading the addresses

IP labels identify interfaces or destinations. Subnet labels identify networks; /n is the prefix length. A router ID (RID) identifies a routing process and need not be a reachable interface.

An IP address alone is not a URL. A web URL includes a scheme such as https://; an address on a router or printer does not imply a website.

  • PC1: 192.168.10.10 · GW .1
  • SW1: VLAN 10
  • R1: Gi0/0 .2 · pri 110
  • R2: Gi0/0 .3 · pri 100
  • WAN / Internet: Subnet 203.0.113.0/24
  1. 1. Normal operation. PC1 sends to the gateway 192.168.10.1. ARP gave it the virtual MAC, which R1 (active) owns, so R1 forwards the traffic.
  2. 2. The routers exchange Hellos. Every 3 seconds each router multicasts an HSRP Hello with its priority and state.
  3. 3. R1 fails. R2 hears no Hello from R1 for the hold time (10 s) and becomes active.
  4. 4. R2 takes over the virtual MAC. R2 sends a gratuitous ARP from the virtual MAC so SW1 moves that MAC to R2's port.
  5. 5. Traffic flows through R2. PC1 changed nothing: same gateway IP, same MAC in its ARP cache.

Why the MAC address moves with the gateway role

A host reaches its gateway in two steps: it uses ARP once to learn the gateway's MAC, then it sends every remote frame to that MAC. If a backup router took over the IP but kept its own MAC, every host would keep sending to the dead router's MAC until its ARP entry expired, which takes minutes on many hosts and hours on some devices.

That is why FHRPs use a virtual MAC as well as a virtual IP. The MAC moves with the role. The new active router sends a gratuitous ARP (an ARP reply nobody asked for) sourced from the virtual MAC. Switches update their MAC address tables to the new port, and the hosts' ARP caches are still correct.

How HSRP works, step by step

Roles and election

  • The active router answers ARP for the virtual IP and forwards traffic sent to the virtual MAC.
  • The standby router watches the active router and takes over if it disappears. Any other routers in the group stay in the listen state.
  • The router with the highest priority (0–255, default 100) wins. On a tie, the highest interface IP address wins.
  • Preemption is off by default in HSRP. Without it, a router with a higher priority that boots later does not take the active role back. You enable it with standby <group> preempt.
The six HSRP states, in the order a router passes through them
The six HSRP states, in the order a router passes through themAn HSRP router starts in Initial, moves to Learn if it does not yet know the virtual IP, then Listen, then Speak where it joins the election, and ends as Standby or Active. A third router stays in Listen.1 InitialThe interface just came up,or HSRP was just configured2 LearnNo virtual IP configured: waitsto learn it from the active router3 ListenKnows the virtual IP, hearsHellos, is not in the election4 SpeakSends Hellos and joins theelection for active and standby5 StandbyNext in line: takes over ifthe active router goes silent6 ActiveAnswers ARP for the VIP andforwards for the virtual MACListen → Speak happens when the hold timer for the active router expires, or the router has a better priority.A third router ends in Listen: it is neither active nor standby.
Most routers pass through these quickly. A router stuck in Learn has no virtual IP configured and has not heard it from the active router. A third router in the group stays in Listen.

Every HSRP router moves through these states. Active and Standby are the two that matter day to day; a router in Listen is a spare that waits for either of them to fail.

Hellos and failover

Step 1 of 5 · Hello (active, 110)
VLAN 10 · 192.168.10.0/24
R1
192.168.10.2 · pri 110
R2
192.168.10.3 · pri 100
SW1
MAC table
After failover
Active:
R2
Hosts' gateway:
192.168.10.1 (unchanged)
Gateway MAC:
0000.0c9f.f00a (unchanged)
Outage:
About the hold time: up to 10 s

Device key: R1, R2 (router) · SW1 (switch)

Arrows run from each message's sender to its receiver. Rows show message order, not separate cables or elapsed time to scale. Port numbers identify services or conversations, not physical switch sockets.

Reading the addresses

IP labels identify interfaces or destinations. Subnet labels identify networks; /n is the prefix length. A router ID (RID) identifies a routing process and need not be a reachable interface.

An IP address alone is not a URL. A web URL includes a scheme such as https://; an address on a router or printer does not imply a website.

  • R1: 192.168.10.2 · pri 110
  • R2: 192.168.10.3 · pri 100
  • SW1: MAC table
HSRP Hellos and a failover from R1 to R2.

HSRP versions and the virtual MAC

HSRPv1HSRPv2
Multicast address224.0.0.2224.0.0.102
Group numbers0–2550–4095
Virtual MAC0000.0c07.acXX (XX = group in hex)0000.0c9f.fXXX (XXX = group in hex)
IPv6 supportNoYes

Group 10 is 0a in hex, so its virtual MAC is 0000.0c07.ac0a with version 1 and 0000.0c9f.f00a with version 2. Both use UDP port 1985 for IPv4. Version 1 is the default on most IOS releases; both routers must run the same version.

How to configure HSRP on Cisco IOS

Commands are based on Cisco IOS / IOS XE documentation and haven't been run on a lab device here. On a Layer 3 switch the same commands go on the SVI (interface Vlan10).

! R1: should be active interface GigabitEthernet0/0 ip address 192.168.10.2 255.255.255.0 standby version 2 standby 10 ip 192.168.10.1 standby 10 priority 110 standby 10 preempt

Group 10 with virtual IP 192.168.10.1. Priority 110 beats R2's default 100, and preempt lets R1 take the role back after it recovers.

! R2: standby interface GigabitEthernet0/0 ip address 192.168.10.3 255.255.255.0 standby version 2 standby 10 ip 192.168.10.1 standby 10 preempt

Same group, same virtual IP, same version. R2 keeps the default priority of 100.

ip dhcp pool VLAN10 network 192.168.10.0 255.255.255.0 default-router 192.168.10.1

Hosts must use the virtual IP as their gateway, never .2 or .3. Wherever DHCP runs, hand out the VIP.

Tracking the uplink (good practice, beyond what the exam requires): if R1's WAN link fails, R1 is still alive and stays active, but it has nowhere to send traffic. Object tracking lowers its priority so R2 can preempt:

track 1 interface GigabitEthernet0/1 line-protocol interface GigabitEthernet0/0 standby 10 track 1 decrement 20

On R1: if Gi0/1 goes down, priority drops from 110 to 90, below R2's 100. R2 takes over because it has preempt configured.

Reading show standby

Example output · based on Cisco documentation; exact format varies by platform and software version
R1#show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Gi0/0       10   110 P Active  local           192.168.10.3    192.168.10.1
R1 is Active ("local" means this router), R2 at .3 is standby, and P shows preemption is on. On R2 the State column shows Standby and the Standby column says local.
Example output · based on Cisco documentation; exact format varies by platform and software version
R1#show standby GigabitEthernet0/0
GigabitEthernet0/0 - Group 10 (version 2)
  State is Active
    2 state changes, last state change 00:12:41
  Virtual IP address is 192.168.10.1
  Active virtual MAC address is 0000.0c9f.f00a (MAC In Use)
    Local virtual MAC address is 0000.0c9f.f00a (v2 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 1.264 secs
  Preemption enabled
  Active router is local
  Standby router is 192.168.10.3, priority 100 (expires in 9.312 sec)
  Priority 110 (configured 110)
  Group name is "hsrp-Gi0/0-10" (default)
Check the virtual IP and MAC, the timers, who is active and standby, and the priority. If tracking has lowered the priority, the line reads something like "Priority 90 (configured 110)".
Example output · based on Cisco documentation; exact format varies by platform and software version
%HSRP-5-STATECHANGE: GigabitEthernet0/0 Grp 10 state Standby -> Active
The log message on R2 when R1 fails. When R1 comes back with preempt, R2 logs Active -> Speak and then settles in Standby.

A redundant gateway that has never failed over is untested. In a maintenance window, unplug the active router's LAN link and watch a continuous ping from a PC: a few lost replies, then recovery, is what success looks like.

Two active routers, and other HSRP faults

Two active routers, and other HSRP faults
Two active routers, and other HSRP faultsSymptom; Likely cause; Check / fix. Both routers show Active: They can't hear each other's Hellos: wrong VLAN, a down trunk, or an ACL blocking UDP 1985 show standby brief on both; ping between .2 and .3; check the switch ports. Two separate groups instead of one: Different group numbers or versions on the two routers Group number, version and virtual IP must match. R1 recovers but R2 stays active: No preempt on R1 Add standby 10 preempt on the router that should be active. Hosts lose access when one router fails: Hosts use a physical address (.2) as gateway Point hosts and DHCP default-router at the VIP. WAN down, but traffic still goes to R1 and is dropped: No tracking: R1 stays active Track the uplink and decrement the priority below the standby's.SymptomLikely causeCheck / fixBoth routers showActiveThey can't hear each other's Hellos:wrong VLAN, a down trunk, or an ACLblocking UDP 1985show standby brief on both; pingbetween .2 and .3; check the switchports.Two separate groupsinstead of oneDifferent group numbers or versionson the two routersGroup number, version and virtual IPmust match.R1 recovers but R2stays activeNo preempt on R1Add standby 10 preempt on the routerthat should be active.Hosts lose access whenone router failsHosts use a physical address (.2) asgatewayPoint hosts and DHCP default-routerat the VIP.WAN down, but trafficstill goes to R1 and isdroppedNo tracking: R1 stays activeTrack the uplink and decrement thepriority below the standby's.

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

Timers, preempt delay and authentication

HSRP routers send a Hello every 3 seconds and wait a hold time of 10 seconds before declaring the active router dead. That is the default failover time. You can shorten it, but the hold time must stay at least three times the Hello interval, and very short timers cost CPU and can cause flapping on a busy router.

interface GigabitEthernet0/0 standby 10 timers 1 3 standby 10 preempt delay minimum 60 standby 10 authentication md5 key-string S3cretKey

Hello every 1 s, hold time 3 s. After a reload, R1 waits 60 s before preempting, so its routing protocol and uplinks are ready before it takes the active role. MD5 authentication stops an unknown device from joining the group and winning the election.

The preempt delay matters more than it looks. A router that reboots and preempts the instant its interface comes up becomes active before it has learned its routes, and traffic is black-holed. Without authentication the default is a plain-text key (cisco) that anyone on the VLAN can send, so use MD5 on any LAN where you do not control every port.

Tracking, priority and preempt together

HSRP only watches the LAN. If R1's uplink fails but its LAN interface is fine, R1 keeps sending Hellos and stays active while dropping everything. Tracking connects the uplink to the priority.

Tracking the uplink: priority drops, the standby router preempts
Tracking the uplink: priority drops, the standby router preemptsBefore the failure R1 has priority 110 and is active, R2 has 100 and is standby. When R1's uplink goes down, tracking subtracts 20 from R1's priority, so it becomes 90. R2 at 100 is now higher, and because preempt is on, R2 becomes active.Normal: both uplinks upR1priority 110 · ActiveR2priority 100 · StandbyR1 Gi0/1 goes down: track 1 decrement 20R1priority 90 · StandbyR2priority 100 · Activedashed: the 20 points removed by trackingNeeds: standby preempt on R2, and track 1 on R1 with a decrement larger than the 10-point gap.
Tracking changes the priority; preempt is what lets the better router take the role. Without preempt on R2, the lower priority on R1 would change nothing.

Three settings must agree: R1's decrement has to be big enough to push its priority below R2's (110 − 20 = 90 is below 100), R2 needs preempt so it takes the role when it has the higher priority, and R1 needs preempt too so it takes the role back when the uplink returns.

Load sharing with two HSRP groups

One group means one forwarding router. To use both routers, create a second group on the same VLAN with the priorities swapped, and give half the hosts the second virtual IP as their gateway.

Sharing load with two HSRP groups on one VLAN
Sharing load with two HSRP groups on one VLANVLAN 10 runs two HSRP groups. Group 10 has virtual IP .1 with R1 active. Group 20 has virtual IP .254 with R2 active. Half the hosts use .1 as their gateway and half use .254, so each router forwards for one half and backs up the other.Hosts Agateway .1Hosts Bgateway .254SW1VLAN 10R1Gi0/0 .2R2Gi0/0 .3Group 10 (.1): Active, 110Group 20 (.254): Standby, 100Group 20 (.254): Active, 110Group 10 (.1): Standby, 100If either router fails, the other becomes active for both groups and carries everyone.
HSRP never load balances inside one group. The trick is two groups with opposite priorities, and DHCP or static settings that split the hosts between the two virtual IPs.
! R1 interface GigabitEthernet0/0 standby 10 ip 192.168.10.1 standby 10 priority 110 standby 10 preempt standby 20 ip 192.168.10.254 standby 20 preempt ! R2 interface GigabitEthernet0/0 standby 10 ip 192.168.10.1 standby 10 preempt standby 20 ip 192.168.10.254 standby 20 priority 110 standby 20 preempt

R1 is active for group 10 (.1), R2 is active for group 20 (.254). Split the hosts with two DHCP pools or by VLAN. If one router fails, the other becomes active for both groups.

HSRP for IPv6

IPv6 needs HSRP version 2. The group uses a virtual link-local address, which hosts learn from the router advertisements, instead of a configured virtual IP.

interface GigabitEthernet0/0 standby version 2 standby 110 ipv6 autoconfig standby 110 priority 110 standby 110 preempt

autoconfig builds the virtual link-local address from the group's virtual MAC. Keep the IPv6 group number different from the IPv4 group on the same interface.

Next: VRRP does the same job as an open standard, and GLBP spreads hosts across all its routers. The comparison page lines the three up side by side.

Where HSRP setups usually break

  • Forgetting preempt, then wondering why a higher priority router stays standby.
  • Mismatched group numbers or HSRP versions between the routers.
  • Using a virtual IP that is already assigned to a host or an interface.
  • Handing out a physical router address as the default gateway.
  • Thinking HSRP shares load within a group. Only the active router forwards.

Exam tip: CCNA 200-301 asks you to describe FHRPs, not configure all three. Know the purpose (a resilient default gateway), the roles (active/standby, master/backup, AVG/AVF), which ones are Cisco proprietary (HSRP, GLBP) and which is open (VRRP), which one load balances in a single group (GLBP), default priority 100, highest priority wins, and that HSRP needs preempt to take the role back. Recognise the HSRP virtual MAC formats and show standby brief.

HSRP facts for the exam

  • An FHRP gives hosts one virtual gateway IP and MAC shared by several routers.
  • HSRP: active forwards, standby waits. Highest priority wins (default 100), preempt off by default.
  • On failover the new active router sends a gratuitous ARP so switches learn the virtual MAC on its port.
  • Hello 3 s, hold 10 s by default; MD5 authentication and preempt delay are good practice.
  • Tracking lowers the priority when an uplink fails; preempt lets the standby router take over.
  • Load sharing needs two groups with swapped priorities; HSRP does not load balance within a group.
  • Verify with show standby brief and show standby.

Test yourself on HSRP

Predict · scenario 1

R1 (priority 110) and R2 (priority 100) run HSRP. Neither has preempt. R1 reboots and comes back. Which router is active?

Predict · scenario 2

R1 has priority 110 and track 1 decrement 20. R2 has priority 100. Both have preempt. R1's tracked uplink goes down. Which router is active?

Predict · scenario 3

show standby brief on both routers shows State Active. What is the most likely cause?

Predict · scenario 4

What are the default HSRP Hello and hold timers?

Predict · scenario 5

An HSRPv1 group 10 is configured. Which virtual MAC address does it use?

FAQ

Why not just give hosts two default gateways?
Most hosts use a single default gateway and don't switch to a second one reliably when the first fails. A first-hop redundancy protocol hides the failure instead: the gateway address never changes, only the router answering for it does.
Is HSRP load balancing?
Not within one group: only the active router forwards. You can share load by running two groups on the same VLAN (or different groups on different VLANs) with each router active for one of them, and pointing half the hosts at each virtual IP. GLBP is the protocol that load balances inside a single group.
Which FHRP should I use with other vendors' routers?
VRRP. It is an open standard (RFC 5798 for VRRPv3), while HSRP and GLBP are Cisco proprietary.
Does the virtual IP address need to be in the same subnet as the routers' interfaces?
Yes. The virtual IP must be an unused address in the same subnet as the physical interface addresses, because it is the default gateway hosts on that subnet will use.