Skip to content

Intermediate · Routing: static routes and OSPF · topic 35 of 57 · 25 min

First hop redundancy: HSRP, VRRP and GLBP

Explanation

A PC has only one default gateway. If that router fails, the PC is cut off even when a second router is ready. First hop redundancy protocols let two or more routers share a virtual IP and virtual MAC address, so the gateway keeps working when one router dies. HSRP is Cisco's protocol, VRRP is the open standard, and GLBP also shares the load.

The single gateway problem

Every PC is configured, usually by DHCP, with one default gateway: the router address it sends all off-subnet traffic to. Suppose an office LAN 192.168.10.0/24 has two routers, R1 (192.168.10.2) and R2 (192.168.10.3), and the PCs use 192.168.10.2. If R1 fails, R2 is still working, but the PCs keep sending to 192.168.10.2 and lose the internet. Changing 200 PCs by hand is not an option.

A first hop redundancy protocol (FHRP) solves this. The routers share a virtual IP address, say 192.168.10.1, and a virtual MAC address. The PCs use the virtual IP as their gateway. One router answers for it; if that router fails, another takes over the same virtual IP and MAC within seconds. The PCs never notice, because their gateway address and the MAC in their ARP table do not change.

Think of it like this: Think of a hospital's duty doctor phone number. Patients always call the same number. Whichever doctor is on duty answers it. If that doctor is called away, the phone is handed to the next doctor. The number never changes, so patients need not know who is on duty.

HSRP: Hot Standby Router Protocol

HSRP is a Cisco protocol. Routers in the same HSRP group elect one active router, which forwards traffic for the virtual IP, and one standby router, which watches and takes over if the active router stops sending hellos. Other routers in the group listen.

  • Priority: default 100, range 0 to 255. The highest priority becomes active. A tie goes to the highest interface IP address.
  • Preempt: off by default. Without preempt, a router with a higher priority that comes back after a failure does NOT take back the active role. With standby 1 preempt, it does.
  • Virtual MAC: HSRP version 1 uses 0000.0c07.acXX, where XX is the group number in hexadecimal. Group 1 is 0000.0c07.ac01, group 10 is 0000.0c07.ac0a. HSRP version 2 uses 0000.0c9f.fXXX and allows group numbers up to 4095.
  • Timers: hellos every 3 seconds, hold time 10 seconds by default.
  • Messages: version 1 uses multicast 224.0.0.2, version 2 uses 224.0.0.102, both on UDP port 1985.

Configuring HSRP

output
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 192.168.10.2 255.255.255.0
R1(config-if)# standby 1 ip 192.168.10.1
R1(config-if)# standby 1 priority 110
R1(config-if)# standby 1 preempt

R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip address 192.168.10.3 255.255.255.0
R2(config-if)# standby 1 ip 192.168.10.1
R2(config-if)# standby 1 preempt
Cisco IOS: group 1, virtual IP 192.168.10.1. R1 has priority 110, R2 keeps the default 100.
output
R1# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State    Active          Standby         Virtual IP
Gi0/0       1    110 P Active   local           192.168.10.3    192.168.10.1
Cisco IOS: R1 is active, R2 (192.168.10.3) is standby, and the PCs use 192.168.10.1.

Give the PCs (or the DHCP pool) the virtual IP 192.168.10.1 as default gateway, never the real address of one router. Both routers must be in the same group number with the same virtual IP.

Tip: HSRP can also track an uplink: if R1's link to the internet goes down, R1 lowers its own priority so that R2 (with preempt) becomes active. The exact tracking commands depend on the IOS version; look up "HSRP object tracking" for your platform.

VRRP and GLBP

HSRPVRRPGLBP
OwnerCiscoOpen standard (IETF)Cisco
RolesActive and standbyMaster and backupOne AVG, up to four AVFs
Virtual MAC0000.0c07.acXX (v1)0000.5e00.01XX0007.b400.XXYY
Preempt by defaultNoYesNo
Load sharing in one groupNoNoYes

VRRP (Virtual Router Redundancy Protocol) works like HSRP but is an open standard, so it runs on routers from any vendor. GLBP (Gateway Load Balancing Protocol) shares the traffic: the AVG (active virtual gateway) answers ARP requests with different virtual MAC addresses, so some PCs send through R1 and others through R2. With HSRP and VRRP, one router does all the forwarding for a group while the other waits.

Careful: Common mistakes: (1) setting the PCs' gateway to a real router address instead of the virtual IP; (2) a different group number or virtual IP on the two routers, so both become active; (3) forgetting preempt and wondering why the higher-priority router does not take over after it reboots; (4) blocking the hellos with an ACL so both routers think the other is dead.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

First hop redundancy: HSRP, VRRP and GLBP · 1/8

First hop redundancy

In this lesson you will learn how to keep the default gateway working when a router fails.

Prefer a video by a teacher? Find free videos on “hsrp configuration ccna first hop redundancy vrrp glbp” on YouTube ↗

In real life: A BPO floor that cannot go offline

A BPO in Noida runs a voice support floor of 300 agents in one VLAN. The two core routers run HSRP group 10 with virtual IP 10.10.10.1, which DHCP hands out as the gateway. R1 has priority 110 and preempt. During a planned IOS upgrade, the engineer reloads R1: R2 becomes active within a few seconds, calls continue, and when R1 comes back it takes over again because of preempt. The agents notice nothing.

Practice (0/3 done)

Task 1 · Code · Python

Write hsrp_mac(group) that returns the HSRP version 1 virtual MAC address for a group number (0 to 255), in Cisco format. It is 0000.0c07.ac followed by the group number as two lowercase hex digits. Example: hsrp_mac(10) returns "0000.0c07.ac0a".

Task 2 · Code · Python

Routers in an HSRP group are dicts like {"name": "R1", "priority": 100, "ip": "192.168.10.2"}. Write elect_active(routers) that returns the name of the router that becomes active when they all start together: the highest priority, and on a tie, the highest IP address. Compare IPs as addresses, not as text (use ipaddress).

Task 3 · Practice

Packet Tracer lab. Connect R1 G0/0 (192.168.10.2/24) and R2 G0/0 (192.168.10.3/24) to one switch with two PCs. Configure HSRP group 1 with virtual IP 192.168.10.1, R1 priority 110 with preempt, R2 default priority with preempt. Set the PCs' gateway to 192.168.10.1. Ping the gateway, then shut R1 G0/0 and ping again. Bring R1 back and watch it become active.

Quick quiz

Question 1

1.What is the default HSRP priority?

Question 2

2.Which virtual MAC does HSRP version 1 group 5 use?

Question 3

3.R1 (priority 120) fails, R2 becomes active. R1 comes back, but R2 stays active. Why?

Question 4

4.Which FHRP is an open standard?

Question 5

5.What should the PCs use as their default gateway when HSRP is running?

Read more (free)

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

What is the default HSRP priority?

Answer: 100

HSRP priority defaults to 100; the highest wins.

Which virtual MAC does HSRP version 1 group 5 use?

Answer: 0000.0c07.ac05

HSRPv1 is 0000.0c07.acXX with the group number in hex: 05. 0000.5e00.01XX is VRRP.

R1 (priority 120) fails, R2 becomes active. R1 comes back, but R2 stays active. Why?

Answer: Preempt is not configured on R1

Without preempt, a recovered router with a higher priority does not take back the active role.

Which FHRP is an open standard?

Answer: VRRP

VRRP is defined by the IETF. HSRP and GLBP are Cisco protocols; EIGRP is a routing protocol.

What should the PCs use as their default gateway when HSRP is running?

Answer: The virtual IP of the HSRP group

Only the virtual IP moves between routers, so the PCs must use it.

A PC at 192.168.1.10/24 sends a packet to 172.16.5.5. Which MAC address will the frame carry as its destination?Related

Answer: The MAC of the default gateway

172.16.5.5 is in another network, so the frame goes to the gateway.

From ARP, the default gateway and ping

Which pool command gives clients their default gateway?Related

Answer: default-router 192.168.10.1

Inside ip dhcp pool, default-router sets the gateway option.

From DHCP: automatic addresses

An IPv6 static route uses next hop fe80::2. What else must the command include?Related

Answer: The exit interface

Link-local addresses are valid only on one link, so the router needs the exit interface too.

From Static and default routes

R1 uses router ospf 1 and R2 uses router ospf 7. Can they become neighbours?Related

Answer: Yes, the process ID is only locally significant

The process ID is local to each router and is not sent in hellos.

From Configuring and verifying single-area OSPF

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: DHCP: automatic addresses →

Next steps

  1. This is the last topic of “Routing: static routes and OSPF”. The module exam comes next.
  2. Module 7 exam: static routes, OSPF and HSRP · 14 questions · 25 min, without help. 5 topics of this module still to finish first.
  3. Then the next module, IP services: DHCP, DNS, NAT and more. 57 topics left in the course before the final exam.

← Previous: Configuring and verifying single-area OSPF