19 First-Hop Redundancy Protocols

Modern enterprise networks depend on redundancy to avoid single points of failure, and First Hop Redundancy Protocols (FHRPs) deliver this at the default gateway. By letting multiple routers present a shared virtual IP and virtual MAC, hosts always point to the same gateway while the routers coordinate via multicast hello messages to elect an active device and a standby. If the active router fails, the standby takes over seamlessly (failover), with gratuitous ARP updating switch MAC tables so traffic quickly shifts to the new active router. Preemption policies then determine whether a recovered, higher-priority router reclaims the active role.

Cisco devices support three FHRPs with overlapping goals but distinct traits. HSRP (Cisco-proprietary) uses active/standby roles and typically balances traffic per subnet by making different routers active in different VLANs; VRRP (industry standard) uses master/backup terminology and is suitable for multivendor environments; GLBP (Cisco-proprietary) uniquely enables per-host load balancing within a single subnet by electing an Active Virtual Gateway that assigns multiple Active Virtual Forwarders, each with its own virtual MAC. Across these, the multicast destinations, virtual MAC formats, and default preemption behaviors vary, and understanding those contrasts is important for certification.

Basic HSRP setup centers on defining a group and VIP on each router interface, choosing the protocol version, and influencing elections with priority and optional preemption; verification is done with show commands that reveal state, timers, peers, and the virtual MAC. Version 2 adds larger group capacity and IPv6 support. In multi-subnet designs, distributing “active” roles across routers provides simple load sharing, while GLBP is used when true per-host balancing is needed in a single subnet. Collectively, these configurations translate the FHRP concepts—shared virtual addressing, neighbor hellos, failover, GARP updates, and preemption—into resilient default-gateway operations with minimal downtime.

Despite the hardware failure on R1, hosts in the LAN still try to use R1 as their default gateway. Without an FHRP, R2 is unable to take over R1’s role.

After a hardware failure on R1, R2 takes over as the default gateway. R1 and R2 share a virtual IP (VIP) address, which hosts in the LAN use as their default gateway. The hosts are unaware of the change from R1 to R2.

R1 and R2 communicate with multicast hello messages to establish and maintain their FHRP neighbor relationship. R1 becomes the active router, and R2 the standby. When a host sends an ARP request to the VIP, R1 will reply with the virtual MAC address, allowing the host to create an appropriate ARP table entry. Switches will also learn the virtual MAC address on the appropriate port.

An FHRP failover. 1) A hardware failure occurs on R1. 2) R2 takes over as the active router. 3) R2 sends GARP messages, sourced from the virtual MAC and destined for the broadcast MAC. 4) The switches learn the virtual MAC on the appropriate ports—those leading toward the new active router. 5) End hosts’ default gateways and ARP table entries for the VIP remain the same.

HSRP load balancing. R1 is the active router in subnet 1, and the standby router in subnet 2. R2 is the standby router in subnet 1, and the active router in subnet 2.

GLBP enables load balancing among hosts in the same subnet. Half of the hosts in 10.0.0.0/24 use one AVF (R1) as their default gateway, and the other half use the other AVF (R2). Each AVF has a unique virtual MAC address.

An HSRPv2 group of two routers. R1 is the active router, and R2 is the standby. If R1 fails, R2 will become the active router. However, because preemption is enabled on R1, it will retake its role after it recovers from the failure.

• First Hop Redundancy Protocol (FHRP) is a category of protocol that allows multiple routers to work together to provide a redundant default gateway for hosts in a LAN.
• The active router actively forwards packets between hosts in the LAN and external destinations. The standby router is ready to take over if the active router fails.
• Routers using an FHRP share a virtual IP (VIP) address, which is configured as the default gateway of hosts in the LAN. They also share a virtual MAC address.
• The active router uses the virtual MAC when replying to ARP requests sent to the VIP. When hosts send packets to external destinations, the frames encapsulating the packets will be sent to the active router.
• Routers using an FHRP communicate via multicast hello messages, which are sent at regular intervals. Hello messages are used to establish and maintain neighbor relationships.
• When the active router fails and the standby router takes over the active role, it is called a failover.
• After a failover, the new active router sends gratuitous ARP (GARP) messages—ARP replies that were not prompted by ARP requests.
• GARP messages are addressed to the broadcast MAC address (ffff.ffff.ffff) for the purpose of updating switches’ MAC address tables.
• Because the VIP and virtual MAC addresses remain the same, FHRP failovers are transparent to end hosts; the end hosts are not aware that a failover has occurred.
• Cisco routers support three FHRPs: HSRP, VRRP, and GLBP.
• Hot Standby Router Protocol (HSRP) is a Cisco-proprietary FHRP with two versions: HSRPv1 and HSRPv2.
• Preemption is an FHRP feature that allows a higher-priority router to take over as the active router, even if there is another active router present.
• HSRP elects one active router, and other routers become standby routers. HSRP preemption is disabled by default.
• HSRPv1 uses the multicast IP address 224.0.0.2, and HSRPv2 uses 224.0.0.102.
• The HSRPv1 virtual MAC address format is 0000.0c07.acXX, where XX is the HSRP group number. The HSRPv2 format is 0000.0c09.fXXX, where XXX is the group.
• HSRPv2 adds IPv6 support, whereas HSRPv1 only supports IPv4.
• HSRP supports per-subnet load balancing by configuring a different active router for different subnets.
• Virtual Router Redundancy Protocol (VRRP) is an industry-standard FHRP, which can be implemented on any vendor’s routers.
• VRRP elects one master router, and other routers become backup routers. Unlike HSRP, preemption is enabled by default.
• VRRP uses the multicast IP address 224.0.0.18.
• The VRRP virtual MAC address format is 0000.5e00.01XX, where XX is the VRRP group number.
• Like HSRP, VRRP supports per-subnet load balancing.
• Gateway Load Balancing Protocol (GLBP) is a Cisco-proprietary FHRP that enables load balancing within a single subnet; load balancing is done on a per-host basis.
• GLBP elects one Active Virtual Gateway (AVG), which assigns up to four Active Virtual Forwarders (AVF). The AVG itself can be an AVF. AVG preemption is disabled by default, but AVF preemption is enabled.
• Although there is a single VIP, GLBP achieves load balancing by assigning each AVF a unique virtual MAC address. The format is 0007.b400.XXYY, where XX is the group number, and YY is the AVF number.
• The AVG replies to ARP requests using the virtual MAC of one of the AVFs, in a round-robin manner.
• Although routers using an FHRP share a VIP, each router still needs its own unique IP address. It uses this IP address when communicating with other routers.
• Enable HSRP version 2 with standby version 2 in interface config mode.
• Configure the HSRP VIP with standby group ip vip in interface config mode.
• Configure the HSRP priority (default 100) with standby group priority priority in interface config mode.
• Enable HSRP preemption with standby group preempt in interface config mode.
• Use show standby brief and show standby to verify HSRP operation.

FAQ