FHRP — HSRP, VRRP & GLBP

Mental model

Hosts on a LAN are configured with one default gateway — typically a single IP. If that gateway router dies, every host on the LAN is suddenly cut off until someone reconfigures the gateway. Bad.

FHRP (First-Hop Redundancy Protocol) is the workaround. Two physical routers share a virtual IP that hosts use as the gateway. The active router answers ARP for that virtual IP. The standby sits quietly watching. If the active fails, the standby takes over the virtual IP within seconds — hosts never know anything changed.

Three flavors you’ll meet:

Protocol	Origin	Active routers	Load balancing
HSRP	Cisco-proprietary	1 active, others standby	No (unless you split groups)
VRRP	IETF open standard	1 master, others backup	No
GLBP	Cisco-proprietary	All active simultaneously	Yes — same virtual IP, different MACs

For CCNA: HSRP is what gets tested most. VRRP is conceptually identical with different terminology. GLBP is mentioned but rarely deep.

HSRP — the dominant CCNA topic

Two routers form an HSRP group (numbered 1–255). The group has a virtual IP and virtual MAC. Hosts use the virtual IP as their gateway.

Priority + preemption — who’s active

Each router has an HSRP priority (1–255, default 100). Higher priority becomes active. If priorities tie, higher IP wins.

R1(config-if)# standby 1 priority 110

But just having higher priority isn’t enough — by default, HSRP doesn’t auto-fail-back. If R1 boots first and becomes active, then R2 boots and has higher priority, R2 won’t take over unless preemption is enabled:

R1(config-if)# standby 1 preempt

Set preempt on both routers, with priority on the preferred-active one.

States (the lifecycle)

A router moves through these as it joins:

Disabled → Init → Listen → Speak → Standby → Active

The two that matter day-to-day:

• Active — the router currently answering for the virtual IP
• Standby — the runner-up, ready to take over

If you see a router stuck in Listen or Speak permanently, it’s a misconfiguration (priority/preemption issue, group mismatch).

Commands — HSRP basic config

! On R1 (active)
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 10.0.0.2 255.255.255.0
R1(config-if)# standby version 2
R1(config-if)# standby 1 ip 10.0.0.1               ! the virtual IP
R1(config-if)# standby 1 priority 110              ! higher than default 100
R1(config-if)# standby 1 preempt

! On R2 (standby)
R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip address 10.0.0.3 255.255.255.0
R2(config-if)# standby version 2
R2(config-if)# standby 1 ip 10.0.0.1               ! same virtual IP, same group #
R2(config-if)# standby 1 priority 100              ! default — lower
R2(config-if)# standby 1 preempt

Always use standby version 2. Version 2 supports more groups and uses a different virtual MAC range — required for modern features.

Interface tracking — failover when an upstream link dies

What if R1’s WAN-facing interface dies but its LAN-facing interface is still up? Without help, R1 stays active — but it can’t actually reach the internet. Hosts pointing at the virtual IP get a black hole.

Object tracking monitors a tracked interface and adjusts priority when it goes down:

R1(config)# track 1 interface GigabitEthernet0/1 line-protocol

R1(config-if)# standby 1 track 1 decrement 20

If Gi0/1 goes down, R1’s HSRP priority drops by 20 (from 110 to 90) — below R2’s 100 — and R2 takes over.

Verification

R1# show standby
R1# show standby brief
R1# show standby vlan 10                 ! when running per-VLAN HSRP

show standby brief is the daily-driver — shows the group, virtual IP, current state, priority, and preempt status in one screen.

VRRP — same idea, open standard

R1(config-if)# ip address 10.0.0.2 255.255.255.0
R1(config-if)# vrrp 1 ip 10.0.0.1
R1(config-if)# vrrp 1 priority 110

VRRP differs from HSRP in three ways worth knowing:

1. The master uses the actual virtual IP as one of its real IPs by default. (HSRP uses a separate virtual IP.)
2. Multicast addresses differ (HSRP: 224.0.0.2, VRRP: 224.0.0.18).
3. Vendor-agnostic, so VRRP works between Cisco and non-Cisco routers.

GLBP — when you want load balancing

In HSRP/VRRP, the standby router sits doing nothing 99% of the time. GLBP fixes this: all routers in the group are active simultaneously, and hosts get different MACs for the same virtual IP — so traffic load-balances across the routers.

R1(config-if)# glbp 1 ip 10.0.0.1
R1(config-if)# glbp 1 priority 110

GLBP elects an AVG (Active Virtual Gateway) which assigns AVF (Active Virtual Forwarder) roles. Cisco-only. Less commonly tested on CCNA but worth recognizing.

Common mistakes

1. Different HSRP groups on each router for the same VLAN. Both routers need to be in the same group (same number). Mismatch → both stay Active independently, hosts get inconsistent gateways.

2. Forgetting preempt. Configure priority but not preempt → router with priority 110 still doesn’t take over from a router with 100. Add preempt on both.

3. Different virtual IPs configured on the two routers. They must match exactly. Easy typo, hard to spot.

4. No tracking of upstream. Setting priority + preempt without tracking means HSRP fails over only when the actual LAN-facing interface dies — not when the WAN-facing interface dies. Always add tracking.

5. Using HSRP version 1 in 2026. Version 1 supports only 256 groups per interface and uses old virtual MAC formats. Always use standby version 2.

6. Different timers between routers. Hello / hold timers must match: standby 1 timers 1 3. Both ends.

Lab to try tonight

1. Two routers (R1, R2), one LAN switch, two PCs.
2. Configure both routers with IPs in 10.0.0.0/24 (R1=.2, R2=.3). Both reach the same upstream.
3. Configure HSRP group 1, virtual IP 10.0.0.1, R1 priority 110, R2 priority 100, preempt on both.
4. Set both PCs’ default gateway to 10.0.0.1. Ping anywhere external — works through R1.
5. Run show standby brief — R1 should be Active.
6. Shut R1’s LAN interface. Watch R2 take over within seconds. Pings continue.
7. Re-enable R1. Watch R2 give Active back to R1 (because of preempt + priority).
8. Bonus: configure object tracking on R1’s upstream interface. Shut it. Confirm R2 takes over (priority decrement working).

Cheat strip

Concept	Plain English
FHRP	First-Hop Redundancy Protocol — shared gateway IP for failover
HSRP	Cisco-proprietary. CCNA’s default FHRP topic.
VRRP	IETF open standard. Cross-vendor.
GLBP	Cisco-only. Load-balances by handing out different MACs.
Virtual IP	The IP hosts use as their gateway
Active / Standby	HSRP states (Master / Backup in VRRP)
Priority	1–255, higher wins (default 100)
Preempt	Required to actually let a higher-priority router take over
Tracking	Lower priority when an upstream interface dies
Version 2	Always use this on modern HSRP