What Problem FHRPs Solve

In a typical network, hosts are configured with a single default gateway usually the IP address of a router interface on their subnet. The issue is that this creates a single point of failure. If that router goes down, users lose access to anything outside their local network, even if other routers are available.

Hosts also don’t have any built in mechanism to dynamically switch to a different gateway. They will continue sending traffic to the same IP address, which means a failed gateway results in a complete loss of upstream connectivity.

First Hop Redundancy Protocols (FHRPs) solve this by introducing a virtual default gateway that multiple routers share. Instead of pointing to a physical router, hosts use a virtual IP address (VIP).

Behind the scenes:

• One router actively forwards traffic (active/master)
• Another router remains on standby (backup)

FHRPs also use a virtual MAC address, so when a failover occurs, the new active router assumes the same IP and MAC. From the host’s perspective, nothing changes, and traffic continues flowing with minimal disruption.

FHRP Comparison Overview

Quick Takeaways

• HSRP: Most common in Cisco networks, simple and reliable
• VRRP: Preferred in multi-vendor environments
• GLBP: Useful when you want load balancing without manual tuning

HSRP (Hot Standby Router Protocol)

HSRP is a Cisco proprietary FHRP used to provide default gateway redundancy. It allows multiple routers to present a single virtual IP address (VIP) to hosts, ensuring continuous connectivity if one router fails.

How It Works

• One router is elected as Active (forwards traffic)
• One router is Standby (takes over if Active fails)
• Other routers remain in a Listen state
• Routers share a virtual IP and virtual MAC address
• Hosts use the VIP as their default gateway

HSRP Groups

• HSRP operates using group numbers
• Each group represents a separate virtual gateway
• Default group is 0, but typically you’ll use custom groups (e.g., 10, 20)
• You can run multiple HSRP groups per VLAN for load balancing
  • Example: VLAN 10 uses Group 10 (Router A active)
  • VLAN 20 uses Group 20 (Router B active)

Election Process

• Based on priority (default: 100)
• Highest priority becomes Active
• Tie-breaker: highest IP address
• The Standby router is the next highest priority

HSRP States

HSRP routers move through several states during operation:

• Disabled
  Interface is not participating in HSRP

• Init (Idle)
  HSRP is enabled, but not fully initialized yet

• Listen
  Receives HSRP messages but is not participating in elections

• Learn
  Learns the virtual IP from another router (if not manually configured)

• Speak
  Actively participates in elections and sends hello messages

• Standby
  Backup router, ready to take over if Active fails

• Active
  Currently forwarding traffic for the virtual IP

Key Features

Preemption

• Disabled by default
• When enabled, a higher priority router can take back the Active role
• Recommended in most production environments (with delay)

Interface Tracking

• Monitors interface state (ex: WAN link)
• If the tracked interface goes down:
  • HSRP priority is reduced
  • Another router can take over as Active

Object Tracking (IP SLA)

• Tracks reachability (not just interface status)
• Example: track upstream connectivity instead of just link state
• Prevents black hole routing

Timers

• Hello timer: 3 seconds (default)
• Hold timer: 10 seconds (default)
• Can be tuned for faster failover

Virtual MAC Format

• 0000.0c07.acXX
• XX = HSRP group number (in hex)

Failure Behavior

• If the Active router fails:
  • Standby takes over the VIP and virtual MAC
  • Traffic continues with minimal disruption
• If tracking is configured:
  • Failover can occur even if the router itself is still up

Key Takeaways

• HSRP is simple and widely used in Cisco environments
• Multiple groups enable basic load balancing
• Preemption and tracking are critical for real-world deployments
• Without tracking, you risk black hole routing

VRRP (Virtual Router Redundancy Protocol)

VRRP is an open standard FHRP (RFC-based) that provides default gateway redundancy similar to HSRP. It allows multiple routers to share a virtual IP address (VIP), ensuring continuous connectivity if the primary router fails.

How It Works

• One router is elected as the Master (forwards traffic)
• Other routers act as Backup
• Routers share a virtual IP and virtual MAC address
• Hosts use the VIP as their default gateway

Key Difference from HSRP

• The Master router typically owns the real IP address of the VIP
• Preemption is enabled by default
• Faster and simpler failover behavior

VRRP Groups

• VRRP uses Virtual Router IDs (VRIDs) instead of group numbers
• Each VRID represents a virtual gateway
• Range: 1–255
• Multiple VRRP groups can be used for load balancing across VLANs

Election Process

• Based on priority:
  • Default: 100
  • Highest priority becomes Master
• Special case:
  • Router with the actual IP matching the VIP gets priority 255 (always wins)
• Tie-breaker: highest IP address

VRRP States

• Initialize
  VRRP is starting up and not yet participating

• Master
  Actively forwarding traffic for the VIP

• Backup
  Waiting to take over if Master fails

Timers

• Advertisement interval: 1 second (default)
• Master down interval is calculated based on timers and priority
• Typically results in faster failover than HSRP

Virtual MAC Format

• 0000.5e00.01XX
• XX = VRID (in hex)

Failure Behavior

• If the Master router fails:

  • A Backup router takes over as Master
  • Assumes the VIP and virtual MAC
  • Minimal disruption to traffic

• Because preemption is enabled:

  • A higher priority router will automatically reclaim Master when it returns

Key Takeaways

• VRRP is the preferred choice in multi-vendor environments
• Simpler than HSRP with fewer states
• Preemption is on by default (be aware in production)
• Typically offers faster and more predictable failover

GLBP (Gateway Load Balancing Protocol)

GLBP is a Cisco proprietary FHRP that provides both default gateway redundancy and load balancing. Unlike HSRP and VRRP, which rely on a single active router, GLBP allows multiple routers to actively forward traffic at the same time.

How It Works

• Routers share a virtual IP address (VIP)
• One router is elected as the AVG (Active Virtual Gateway)
• Other routers become AVFs (Active Virtual Forwarders)
• The AVG assigns different virtual MAC addresses to each AVF
• Hosts receive different MAC addresses via ARP → traffic is distributed across routers

GLBP Roles

• AVG (Active Virtual Gateway)

  • Handles ARP requests for the VIP
  • Assigns virtual MACs to clients
  • Controls load balancing decisions

• AVF (Active Virtual Forwarder)

  • Actually forwards traffic for assigned hosts
  • Each AVF owns a unique virtual MAC

Load Balancing Methods

• Round-Robin (default)

  • Cycles through available AVFs for each ARP request

• Weighted

  • Traffic distribution based on router capacity

• Host-Dependent

  • A host always gets the same AVF (consistent path)

Election Process

• Based on priority (default: 100)
• Highest priority becomes AVG
• Tie-breaker: highest IP address
• AVFs are assigned from remaining routers

GLBP States

GLBP routers move through similar states as HSRP:

• Disabled
  Not participating in GLBP

• Init
  GLBP is initializing

• Listen
  Not participating in elections yet

• Speak
  Participating in elections

• Standby
  Backup for the AVG

• Active
  Acting as AVG or AVF

Forwarder Preemption

• Controls whether a router can reclaim its role as an AVF
• Disabled by default
• Useful in maintaining consistent load balancing behavior

Weighting & Tracking

• GLBP supports weight-based load balancing
• Interfaces or objects can be tracked:
  • If a tracked object fails → weight decreases
  • If weight drops below threshold → router stops forwarding traffic

This helps prevent black hole routing

Timers

• Hello timer: 3 seconds (default)
• Hold timer: 10 seconds (default)

Virtual MAC Format

• 0007.b4XX.XXXX
• Multiple MAC addresses are used (one per AVF)

Failure Behavior

• If an AVF fails:

  • Another router takes over its virtual MAC
  • Traffic for affected hosts is rerouted

• If the AVG fails:

  • A standby router takes over ARP responsibilities

• Minimal disruption, but slightly more complex than HSRP/VRRP

Key Takeaways

• GLBP provides true active/active gateway load balancing
• More complex than HSRP/VRRP
• Useful when you want to utilize multiple routers without manual tuning
• Often avoided in favor of simpler designs unless load balancing is required

FHRP Design Considerations

Designing with FHRPs isn’t just about adding redundancy it’s about making sure traffic flows efficiently during both normal operation and failure scenarios.

Choose the Right Protocol

• HSRP: Standard choice in Cisco environments
• VRRP: Best for multi-vendor networks
• GLBP: Use only if you truly need built-in load balancing

Active/Standby vs Load Balancing

• HSRP/VRRP are active/standby by default
• Load balancing is typically done by:
  • Using multiple VLANs
  • Assigning different routers as active per VLAN
• GLBP provides automatic load balancing, but adds complexity

Align FHRP with STP (Critical)

• The active gateway should also be the STP root bridge
• Prevents suboptimal routing and unnecessary Layer 2 traffic
• Example:
  • Switch A = STP root + HSRP active for VLAN 10
  • Switch B = STP root + HSRP active for VLAN 20

Avoid Black Hole Routing

• A router can still be “up” but unable to forward traffic upstream
• Always use:
  • Interface tracking
  • IP SLA / object tracking
• Ensures failover happens when upstream connectivity is lost

Use Preemption (with Caution)

• Allows the preferred router to reclaim active role
• Recommended:
  • Enable preemption
  • Add a delay to prevent flapping during boot

VLAN and Gateway Design

• Typically:
  • One FHRP group per VLAN
• For load sharing:
  • Distribute active roles across VLANs
• Keep gateway placement consistent and predictable

Failure Domain Awareness

• FHRPs operate between independent devices
• Unlike stacking:
  • No shared control plane
  • Better fault isolation
• Helps reduce impact of device-level failures

Keep It Simple

• Don’t overcomplicate designs unless needed
• Many networks work best with:
  • HSRP or VRRP
  • Proper tracking
  • Clean VLAN distribution

Key Takeaways

• FHRP design is about traffic flow, not just redundancy
• Always align with STP and upstream paths
• Tracking is critical to avoid silent failures
• Simpler designs are usually more stable and easier to troubleshoot

Supervisor & Route Processor Redundancy

FHRPs protect against device failure, but what about failures inside the device?
That’s where Supervisor and Route Processor redundancy comes in.

In higher-end switches and routers, you can have multiple control planes:

• Supervisor engines (switches)
• Route processors (routers)

These provide redundancy at the control plane level, allowing the device to stay operational even if a critical component fails.

Why This Matters

Without control plane redundancy:

• If the supervisor or route processor crashes → the whole device reloads
• FHRP failover is triggered → network convergence event

With redundancy:

• Failover happens within the device
• Traffic disruption is minimized or avoided entirely
• FHRP may not need to fail over at all

Key Concepts

Stateful Switchover (SSO)

• Maintains synchronization between active and standby supervisors
• When the active fails:
  • Standby takes over without resetting interfaces
• Control plane switchover is nearly seamless

Nonstop Forwarding (NSF)

• Works with routing protocols (OSPF, EIGRP, BGP)
• During a control plane failure:
  • The data plane keeps forwarding traffic
  • Routing neighbors are preserved temporarily

Route Processor Redundancy

• Seen in routers with dual RPs
• One RP is active, the other is standby
• State information is synced between them

Interaction with FHRPs

• Prevents unnecessary FHRP failover events
• The device remains the active gateway even during internal failure
• Improves overall network stability

Example:

• Without SSO:
  • Supervisor crash → HSRP failover → traffic shift
• With SSO:
  • Supervisor crash → standby takes over → no HSRP failover

Design Considerations

• Common in:
  • Core switches
  • Distribution layer in large networks
• Adds cost and complexity, but increases uptime
• Requires proper configuration and testing

Key Takeaways

• FHRPs protect against device loss
• Supervisor/RP redundancy protects against internal failures
• Technologies like SSO and NSF keep traffic flowing during control plane events
• Together, they provide a more resilient and stable network design

Conclusion

FHRPs are one of those things that seem simple at first, but they have a big impact on how stable and predictable your network actually is.

At a basic level, they solve the default gateway problem by removing a single point of failure. But in real networks, it goes deeper than that. How you design and tune FHRPs directly affects traffic flow, failover behavior, and how your network reacts under failure conditions.

HSRP and VRRP give you solid, predictable redundancy. GLBP adds load balancing, but with added complexity that isn’t always worth it. In most environments, a well designed HSRP or VRRP setup with proper tracking and VLAN distribution gets the job done cleanly.

The biggest takeaway is that redundancy alone isn’t enough. You need to think about:

• Where traffic flows during normal operation
• What happens when upstream links fail
• How fast and clean failover actually is

On top of that, technologies like SSO and NSF take things further by preventing unnecessary failovers altogether, keeping traffic moving even during internal device issues.

At the end of the day, good FHRP design isn’t about memorizing commands it’s about building a network that fails predictably, recovers quickly, and avoids breaking in the first place.