Skip to content

First Hop Redundancy Protocols

A host can only have one default gateway configured. If that router goes down, the host loses its connection to the outside world — even if other routers are available on the network. FHRP solves this by letting multiple physical routers act together as one virtual router.

Virtual Router

  • Two or more routers work together under the same virtual IP and MAC address
  • To clients, they appear as a single router
  • One physical router is active (forwarding), the rest are in standby
  • The failover mechanism works via hello messages between the routers

Failover steps

  1. The standby router stops receiving hello messages from the active router
  2. The standby decides the active router is down and switches to the forwarding state
  3. Clients notice nothing — the same virtual IP and MAC stay active

FHRP Protocols

Protocol Vendor IPv4 IPv6 Roles
HSRP v1 Cisco ✓ — Active / Standby
HSRP v2 Cisco ✓ ✓ Active / Standby
VRRPv2 Open standard ✓ — Master / Backup
VRRPv3 Open standard ✓ ✓ Master / Backup
GLBP Cisco ✓ ✓ Active + load balancing

GLBP is the only protocol that also provides load balancing across multiple gateways.

HSRP — Hot Standby Router Protocol

Operation

  • Routers are grouped into an HSRP group — all configured with the same group number
  • 1 router becomes active (forwarding), the other(s) are standby
  • Every 3 seconds the active router sends a hello message (multicast)
  • After 10 seconds without a hello → standby takes over

Timers

Don't set the hello timer lower than 1 second, and the hold timer not lower than 4 seconds.

Priority

The active router is determined through an election process:

  • Without configured priorities: the router with the highest IP address wins
  • With priorities: the router with the highest priority wins (range 0–255, default 100)
standby [group-nr] priority [value]

Pre-emption

Without pre-emption, the current active router stays active even if a new router with a higher priority joins the group. With pre-emption, a new election starts.

standby [group-nr] preempt

HSRP Versions

HSRP V1 HSRP V2
Group numbers 0–255 0–4095
Multicast address 224.0.0.2 224.0.0.102 (IPv4) / FF02::66 (IPv6)
Virtual MAC 0000.0C07.ACxx 0000.0C9F.Fxxx (IPv4) / 0005.73A0.0xxx (IPv6)
MD5 authentication No Yes

HSRP States

State Description
Initial Interface becomes active or configuration changed
Learn Virtual IP not yet known, waiting for a hello from the active router
Listen Virtual IP known, but the router is not active or standby
Speak Sends hello messages, participates in the election
Standby Candidate to become active, sends hello messages
Active Processes traffic to the virtual MAC address

Interface Tracking

Problem: the active router doesn't go fully down, but its WAN/uplink interface fails. Hello messages on the LAN interface keep working → standby doesn't take over → but traffic dead-ends at the active router.

Solution: interface tracking — configure an interface to monitor. If that interface fails, penalty points are subtracted from the HSRP priority, allowing a standby router to take over the role.

Requires pre-emption.

standby [group-nr] track [interface] [penalty]

IP SLA

Interface tracking only detects a local interface failure. If the problem is on the ISP's side but the active router's WAN interface is still up, tracking doesn't help.

Solution: IP SLA — has the router periodically test end-to-end connectivity itself (e.g. via ICMP echo to an external address). If the IP SLA fails, penalty points are subtracted from the HSRP priority.

Requires pre-emption.