HSRP and VRRP: first hop redundancy explained

The problem and the answer in one paragraph

Hosts have one default gateway address and cannot choose another when it dies. A First Hop Redundancy Protocol (FHRP) lets two or more routers share one virtual IP address (and a virtual MAC address), so the hosts keep pointing at the same gateway while the routers decide among themselves which one answers. HSRP (Hot Standby Router Protocol) is Cisco-proprietary and VRRP (Virtual Router Redundancy Protocol, RFC 5798) is the open standard. The decision rule: highest priority wins the active (HSRP) or master (VRRP) role, and a higher-priority router only takes the role back after a failure if preemption is on. Preemption is off by default in HSRP and on by default in VRRP, which is the detail exam questions love.

Side by side

Sources: Cisco’s HSRP configuration guide for the HSRP values, and RFC 5798 for VRRP multicast address, protocol number, MAC format and the default priority of 100. Cisco’s VRRP page gives the priority range as 1 to 254 with 255 reserved for the router that owns the virtual IP address, and says preemption is on by default. The table is a lookup, not something to memorise in full. The two items worth remembering are the preemption default and the open versus proprietary split.

GLBP, a third Cisco protocol, also load-balances across gateways. It is not named in the current outlines, so treat it as background.

How the election plays out, step by step

Take R1 (priority 110) and R2 (default 100) on one VLAN, sharing virtual IP 10.1.1.1, which hosts use as gateway.

1. Both routers come up and exchange hellos. R1 has the higher priority, so R1 becomes active and answers ARP for 10.1.1.1 with the virtual MAC. R2 becomes standby (VRRP: master and backup).
2. R1 fails or its link drops. R2 stops hearing hellos, the hold time expires, and R2 becomes active. Hosts keep their gateway configuration; their ARP entry for the virtual IP still maps to the virtual MAC, which R2 now serves.
3. R1 returns. In HSRP without standby preempt, R1 stays standby although its priority is higher. With preemption on, it takes the active role back. In VRRP preemption is on by default, so the master returns unless you ran no vrrp preempt.
4. If priorities tie, VRRP picks the backup with the higher IP address, per Cisco’s VRRP guide.

HSRP routers move through states: Init (or Disabled), Learn, Listen, Speak, Standby and Active. The exam rarely asks for the sequence; it asks what a router in a given state is doing, and the answer to remember is that exactly one router is active and one is standby.

Configuration you should recognise

interface Vlan10
 ip address 10.1.1.2 255.255.255.0
 standby version 2
 standby 10 ip 10.1.1.1
 standby 10 priority 110
 standby 10 preempt

standby 10 ip defines group 10 and its virtual IP; priority raises the router’s claim; preempt lets it reclaim the role. The physical address (10.1.1.2 here) differs per router, and only the virtual address is the hosts’ gateway. For the 2027 CCNA the outline word is “interpret the operational status”, so the skill is reading output such as show standby brief (Cisco’s guide describes it as the brief display of HSRP standby information), not building the config from nothing.

What to check in that output: group number, priority, whether P (preempt) is shown, the state of this router, the address of the active and standby routers, and the virtual IP. The classic faults are different virtual IPs on the two routers, different group numbers, different HSRP versions, and the gateway on the hosts pointing at a router’s real address rather than the virtual IP.

Tracking: when the uplink dies but the LAN port stays up

Priority alone does not detect a failed uplink behind the active router. Object tracking lowers the priority when a tracked interface or route goes down, so the other router wins. Cisco’s guide lists HSRP, VRRP and GLBP as clients that can register for tracking. The related exam point: tracking only helps if preemption is enabled on the router that must take over, otherwise the lower-priority standby cannot grab the role from a router that merely lost its priority.

Which exams test this

CCNA v1.1 asks for concepts; v2.0 narrows the protocols to HSRP and VRRP and asks for status interpretation. Network+ expects the purpose: a virtual IP shared by redundant gateways.

How exam questions are built

The scenario nearly always involves a gateway failure and a surprise afterwards. Look for these constraint words. “Cisco-proprietary” means HSRP; “open standard” or “multivendor” means VRRP. “Recovered but did not take over again” means preemption is missing (HSRP). “Hosts must not be reconfigured” points to the virtual IP. “Forwards traffic” means active or master, while “standby” and “backup” routers do not forward for the group. A wrong-answer favourite is that the virtual IP must be one of the routers’ real addresses; in HSRP it is a separate address (in VRRP the owner may use its real one, priority 255).

Remember that FHRP protects the gateway, not the link between switches; that is the job of EtherChannel and LACP and spanning tree. Routing between the redundant routers and upstream still needs OSPF or static routes, as in the CCNA cheat sheet.

Go deeper

• RFC 5798: VRRP version 3, the standard behind the VRRP values above.
• Cisco: Configuring HSRP and Cisco: Configuring VRRP, the IOS XE guides (Cisco blocks scripted requests but both pages load in a browser).
• Related guides: administrative distance and the routing table, static vs dynamic routing, and the CCNA study plan for the HSRP lab.