LESSON PURPOSE Build a practical understanding of how FHRPs provide a resilient default gateway for end hosts, how gateway failover occurs, and how Cisco HSRP and related FHRP concepts are configured, verified, and troubleshot. |
Lesson Overview
End devices normally use one default-gateway IP address. If that Layer 3 gateway fails, hosts can lose off-subnet connectivity even when redundant links and routing paths still exist. FHRP allows multiple routers or multilayer switches to present one logical gateway to hosts.
This lesson covers the virtual IP and virtual MAC, gateway roles, election and failover, priority and preemption, tracking, and the practical differences among HSRP, VRRP, and GLBP, with Cisco IOS verification and troubleshooting.
Learning Objectives
• Explain why a redundant Layer 3 network still needs first-hop default-gateway redundancy.
• Describe the virtual IP and virtual MAC and how hosts keep using the same gateway during failover.
• Explain HSRP roles and behavior, including Active, Standby, Listen, group number, hello/hold timers, priority, and preemption.
• Describe HSRP Active/Standby election and the effect of router, SVI, interface, or tracked-uplink failure.
• Configure basic HSRP on Cisco routers or multilayer switches, including virtual IP, priority, preempt, and tracking.
• Verify FHRP operation with show standby, show standby brief, interface checks, ping, and traceroute.
• Troubleshoot group/virtual-IP mismatches, missing preemption, incorrect priority, VLAN/SVI failures, and upstream reachability problems.
• Compare HSRP, VRRP, and GLBP at a practical CCNA level, including roles, standards/proprietary status, and load-sharing behavior.
CCNA ALIGNMENT — Supports the CCNA requirement to understand the purpose, functions, and concepts of first-hop redundancy, with emphasis on a resilient virtual default gateway, failover behavior, and basic configuration/verification. |
1. FHRP Overview and the Default-Gateway Problem
What problem does FHRP solve?
An end host normally has one configured default gateway. If that Layer 3 gateway fails, the host may still be connected to the LAN but cannot reach remote networks. First Hop Redundancy Protocols solve this single point of failure by presenting a virtual gateway identity shared by two or more routers or multilayer switches.
- Hosts configure a virtual IP (VIP) as the default gateway.
- The FHRP group also owns a virtual MAC address (or multiple virtual MACs in GLBP).
- One or more physical gateways cooperate using control messages.
- If the preferred gateway fails, another member takes over without requiring host reconfiguration.
- Tracking can make failover react to an upstream failure even when the LAN-facing SVI remains up.
FHRP replaces a single physical default gateway with a resilient virtual gateway.
Normal host packet flow
1. PC1 wants to reach a remote subnet and decides to send the packet to its default gateway, 192.168.10.1.
2. PC1 ARPs for 192.168.10.1. The FHRP owner answers with a virtual MAC address.
3. PC1 builds an Ethernet frame whose destination MAC is the FHRP virtual MAC.
4. The current forwarding FHRP device receives the frame and routes the IP packet upstream.
5. If the current gateway fails, another FHRP member begins forwarding traffic for the same virtual identity.
Common FHRP terminology
|
Term |
Meaning |
|
Virtual IP (VIP) |
The default-gateway address configured on end hosts. |
|
Virtual MAC |
Layer 2 identity associated with the virtual gateway. |
|
Group / Virtual Router ID |
Logical FHRP instance; allows multiple redundant gateways on one interface. |
|
Priority |
Election preference. Higher values are generally preferred. |
|
Preemption |
Allows a higher-priority device to reclaim the active/master/AVG role after it returns. |
|
Preempt delay |
Wait period before a recovered device takes the role back. |
|
Tracking |
Changes priority or forwarding eligibility when an interface/route/object fails. |
|
Hello / Advertisement |
Control packets used to maintain group state and detect peer failure. |
2. FHRP Message Transport and Quick Reference
The protocols all solve the first-hop gateway problem, but they use different control packets and transport methods.
|
Protocol |
Roles |
IPv4 Control Destination |
Transport |
Default Timer |
Default Preempt |
|
HSRPv1 |
Active / Standby |
224.0.0.2 |
UDP 1985 |
Hello 3 s / Hold 10 s |
Disabled |
|
HSRPv2 |
Active / Standby |
224.0.0.102 |
UDP 1985 |
Hello 3 s / Hold 10 s |
Disabled |
|
VRRP |
Master / Backup |
224.0.0.18 |
IP protocol 112 (no TCP/UDP port) |
Advertisement 1 s |
Enabled |
|
GLBP |
AVG + AVFs |
224.0.0.102 |
UDP 3222 |
Hello 3 s / Hold 10 s |
AVG preempt disabled |
|
IPv6 control-plane notes • HSRPv2 uses FF02::66 for IPv6 hello packets and UDP port 2029 on supported Cisco platforms. • VRRPv3 uses FF02::12 for IPv6 advertisements and still uses IP protocol 112. • GLBP support varies by platform; verify the specific IOS/IOS XE feature set when IPv6 is required. |
Useful packet-capture filters
Wireshark / capture filters
|
HSRP: udp.port == 1985 VRRP: ip.proto == 112 or ipv6.nxt == 112 GLBP: udp.port == 3222 |
3. HSRP - Hot Standby Router Protocol
Purpose and use case
HSRP is Cisco proprietary and is widely used when the network is predominantly Cisco. It provides a simple Active/Standby model: one device forwards traffic for the virtual gateway while one designated Standby is ready to take over.
HSRPv2 example using group 10 and VLAN 10.
HSRP versions
|
Feature |
HSRPv1 |
HSRPv2 |
|
IPv4 multicast |
224.0.0.2 |
224.0.0.102 |
|
IPv4 UDP port |
1985 |
1985 |
|
Group range |
0-255 |
0-4095 |
|
IPv4 virtual MAC |
0000.0c07.acXX |
0000.0c9f.fXXX |
|
Packet format |
Original format |
TLV-based enhancements |
|
IPv6 |
No |
Supported through HSRPv2 on capable platforms |
HSRP messages
|
Message |
Purpose |
|
Hello |
Advertises HSRP state, priority, timers, and group information. |
|
Coup |
Sent when a device wants to become Active, typically during preemption. |
|
Resign |
Sent by an Active device giving up the Active role. |
HSRP states
|
State |
Meaning |
|
Initial |
HSRP has not started or the interface is not usable. |
|
Learn |
Device has not yet learned all required group information. |
|
Listen |
Knows the virtual IP but is neither Active nor Standby. |
|
Speak |
Sends hellos and participates in election. |
|
Standby |
Ready to become Active if the Active device fails. |
|
Active |
Forwards packets sent to the virtual MAC and represents the virtual gateway. |
HSRP election process - step by step
1. HSRP members join the same group and exchange hello messages.
2. The device with the highest HSRP priority is preferred for the Active role.
3. If priorities tie, the device with the higher interface IPv4 address wins.
4. The next-best device becomes Standby; additional members normally remain in Listen state.
5. Hosts use only the virtual IP and virtual MAC; they do not care which physical device is Active.
Priority and preemption
Default HSRP priority: 100.
Preemption is disabled by default.
Without preemption, a recovered higher-priority device does not automatically take the Active role back.
With preemption enabled, a higher-priority device…