HSRP, VRRP and GLBP

A real-life situation

The office has two routers to the WAN, R1 and R2, so a single failure shouldn't cut everyone off. But every PC has one default gateway: R1's address. One morning R1's power supply dies. R2 is working perfectly, yet nobody can reach anything outside the LAN. The PCs keep sending to an address that no longer answers.

You could change the gateway on every PC by hand, but that is slow and DHCP leases would still hand out the old one. What you need is a gateway address that survives the loss of one router.

What a first-hop redundancy protocol is

A first-hop redundancy protocol (FHRP) lets two or more routers share one virtual IP address (VIP) and one virtual MAC address. Hosts use the virtual IP as their default gateway. The routers agree among themselves which one answers for it. If that router fails, another takes over the same IP and MAC, and the hosts don't notice.

"First hop" means the first router a packet meets when it leaves the LAN. There are three FHRPs on the CCNA exam:

• HSRP (Hot Standby Router Protocol): Cisco proprietary, one active router.
• VRRP (Virtual Router Redundancy Protocol): open standard, one master router.
• GLBP (Gateway Load Balancing Protocol): Cisco proprietary, several routers forward at once.

Why it works that way

A host reaches its gateway in two steps: it uses ARP once to learn the gateway's MAC, then it sends every remote frame to that MAC. If a backup router took over the IP but kept its own MAC, every host would keep sending to the dead router's MAC until its ARP entry expired, which can take hours.

That is why FHRPs use a virtual MAC as well as a virtual IP. The MAC moves with the role. The new active router sends a gratuitous ARP (an ARP reply nobody asked for) sourced from the virtual MAC. Switches update their MAC address tables to the new port, and the hosts' ARP caches are still correct.

How HSRP works, step by step

Roles and election

• The active router answers ARP for the virtual IP and forwards traffic sent to the virtual MAC.
• The standby router watches the active router and takes over if it disappears. Any other routers in the group stay in the listen state.
• The router with the highest priority (0–255, default 100) wins. On a tie, the highest interface IP address wins.
• Preemption is off by default in HSRP. Without it, a router with a higher priority that boots later does not take the active role back. You enable it with standby <group> preempt.

Hellos and failover

HSRP versions and the virtual MAC

Group 10 is 0a in hex, so its virtual MAC is 0000.0c07.ac0a with version 1 and 0000.0c9f.f00a with version 2. Both use UDP port 1985. Version 1 is the default on most IOS releases; both routers must run the same version.

How to configure HSRP on Cisco IOS

⚠️ Commands are based on Cisco IOS / IOS XE documentation and haven't been run on a lab device here. On a Layer 3 switch the same commands go on the SVI (interface Vlan10).

Tracking the uplink (good practice, beyond what the exam requires): if R1's WAN link fails, R1 is still alive and stays active, but it has nowhere to send traffic. Object tracking lowers its priority so R2 can preempt:

How to verify it

R1#show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Gi0/0       10   110 P Active  local           192.168.10.3    192.168.10.1

R1#show standby GigabitEthernet0/0
GigabitEthernet0/0 - Group 10 (version 2)
  State is Active
    2 state changes, last state change 00:12:41
  Virtual IP address is 192.168.10.1
  Active virtual MAC address is 0000.0c9f.f00a (MAC In Use)
    Local virtual MAC address is 0000.0c9f.f00a (v2 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 1.264 secs
  Preemption enabled
  Active router is local
  Standby router is 192.168.10.3, priority 100 (expires in 9.312 sec)
  Priority 110 (configured 110)
  Group name is "hsrp-Gi0/0-10" (default)

%HSRP-5-STATECHANGE: GigabitEthernet0/0 Grp 10 state Standby -> Active

What goes wrong and how to troubleshoot it

HSRP vs. VRRP vs. GLBP

VRRP works almost like HSRP. Use it when routers from different vendors share a gateway. The basic classic-IOS command is vrrp 10 ip 192.168.10.1; newer IOS XE releases use VRRPv3 with fhrp version vrrp v3 and a slightly different syntax.

GLBP elects one AVG (Active Virtual Gateway). The AVG gives each router, called an AVF (Active Virtual Forwarder), its own virtual MAC. When hosts ARP for the single virtual IP, the AVG replies with a different AVF MAC each time (round robin by default). Every router carries part of the traffic, with no extra groups to plan. Basic command: glbp 10 ip 192.168.10.1.

Common mistakes

• Forgetting preempt, then wondering why a higher priority router stays standby.
• Mismatched group numbers or HSRP versions between the routers.
• Using a virtual IP that is already assigned to a host or an interface.
• Handing out a physical router address as the default gateway.
• Thinking HSRP shares load within a group. Only the active router forwards.

Key takeaways

• An FHRP gives hosts one virtual gateway IP and MAC shared by several routers.
• HSRP: active forwards, standby waits. Highest priority wins (default 100), preempt off by default.
• On failover the new active router sends a gratuitous ARP so switches learn the virtual MAC on its port.
• VRRP is the open-standard equivalent; GLBP load balances with up to four forwarders.
• Verify with show standby brief and show standby.

Check yourself