Overview
First-hop redundancy protocols (HSRP, VRRP, GLBP) give hosts a single virtual default gateway while multiple physical routers share the load. CCNA focuses on HSRP roles, priority, preempt, and alignment with STP.
Why first-hop redundancy exists
End hosts use a default gateway — one IP on their subnet. When you deploy redundant routers (R1 and R2 both serving 10.10.10.0/24), assigning half the PCs to .2 and half to .3 is fragile: failover requires manual reconfiguration on every host.
First Hop Redundancy Protocols (FHRP) solve this with a virtual IP (VIP) and virtual MAC shared by two or more gateways. Hosts point to the VIP; one physical router acts as active while the other stays standby, taking over automatically on failure.
Network redundancy — eliminating single points of failure at core, distribution, and WAN edge.
Supplementary figure from Panagiss CCNAmd
Redundancy is typically implemented at distribution/core and WAN edge — not at the access layer for ordinary PCs (single NIC). Servers with bonded NICs are the common exception.
FHRP options (CCNA scope)
| Protocol | Standard | Mode | Notes |
|---|---|---|---|
| HSRP | Cisco proprietary | Active / standby | CCNA primary focus |
| VRRP | Open standard (RFC) | Active / standby | Very similar to HSRP |
| GLBP | Cisco proprietary | Active / active | Load balancing across gateways |
Virtual MAC prefixes (memory aid)
You do not need to memorize the full virtual MAC address for the exam — remember the OUI prefix for each protocol and you can recognize the right answer quickly.
| Protocol | Prefix to remember | Mnemonic |
|---|---|---|
| HSRP | 0000.0C | 0C — think Cisco HSRP (Cisco proprietary) |
| VRRP | 0000.5E | 5E sounds like VRRP — it rhymes |
| GLBP | 0007 | 007 — close enough to GLBP / Great Britain in my mind |
HSRP → 0000.0C · VRRP → 0000.5E (5E = VRRP, it rhymes) · GLBP → 0007 (007 = GLBP)
Full formats when you need them on the job:
- HSRP v1:
0000.0c07.acXX(XX = group number in hex) - HSRP v2:
0000.0c9f.fXXX - VRRP:
0000.5e00.01XX - GLBP:
0007.b400.XX01
HSRP roles and operation
Each HSRP router has:
- A physical IP on the LAN interface (unique per router — e.g., .2 and .3)
- A shared virtual IP (VIP) on the same subnet (e.g., 10.10.10.1)
- A shared virtual MAC (
0000.0c07.acXXwhere XX = group number in hex — see prefix mnemonics above)
At startup:
- Routers exchange Hello messages on the HSRP group
- One router becomes Active — owns VIP and virtual MAC, responds to ARP for the VIP
- Other router(s) become Standby — monitor Active Hellos
- If Standby stops receiving Hellos, it transitions to Active and assumes VIP/MAC
FHRP virtual IP — hosts use one default gateway address while two physical routers provide redundancy.
Supplementary figure from Panagiss CCNAmd
Priority and preemption
Priority (1–255, default 100) determines preferred Active router — higher wins.
Tiebreaker: Highest physical IP address on the interface.
Preemption (standby preempt): When enabled, a higher-priority router that comes back online reclaims Active role. Disabled by default — the current Active stays Active even if a higher-priority router returns (avoids flapping instability).
interface GigabitEthernet0/1 ip address 10.10.10.2 255.255.255.0 standby 1 ip 10.10.10.1 standby 1 priority 110 standby 1 preempt
! R2 — lower priority standby interface GigabitEthernet0/1 ip address 10.10.10.3 255.255.255.0 standby 1 ip 10.10.10.1 standby 1 priority 90
Exam scenarios often ask what happens when the primary returns — without preempt, the lower-priority router remains Active.
HSRP version
| HSRP v1 | HSRP v2 | |
|---|---|---|
| Multicast | 224.0.0.2 | 224.0.0.102 |
| Group numbers | 0–255 | 0–4095 |
| Default | Yes | Must configure standby version 2 |
Both routers in a group must run the same version.
standby version 2
Active/Active pattern (per-subnet load sharing)
HSRP itself is active/standby per group — only one router forwards for a given VIP. You can achieve load sharing by using different groups on different subnets, swapping priorities so each router is Active for one VLAN and Standby for another.
10.10.10.0/24: R1 priority 110 (Active), R2 priority 90 (Standby), VIP 10.10.10.1
10.10.20.0/24: R2 priority 110 + preempt (Active), R1 priority 90 (Standby), VIP 10.10.20.1
Each subnet still has one Active router — but aggregate traffic is shared across both physical routers.
Layer 3 redundancy with floating static routes
FHRP protects the first hop for hosts. WAN edge redundancy uses floating static routes with higher AD:
! Primary default via ISP1
ip route 0.0.0.0 0.0.0.0 203.0.113.1
! Backup default via R2 if primary link fails (AD 5)
ip route 0.0.0.0 0.0.0.0 10.10.20.2 5
! Backup route to inside VLAN via R2
ip route 10.10.10.0 255.255.255.0 10.10.20.2
Aligning HSRP with STP
In a redundant L2/L3 campus design, HSRP Active router should match the STP root bridge for the same VLAN — or at minimum, the Active router should not be reachable through a blocked STP port.
Why: If the HSRP Active router sits behind a blocking STP port, traffic to the VIP crosses an alternate path — suboptimal forwarding, potential asymmetry, and harder troubleshooting.
Best practice checklist:
| Layer | Align |
|---|---|
| STP | Root bridge on distribution switch (or core) for each VLAN |
| HSRP | Active router on the same device (or same site path) as STP root |
| Spanning tree priority | Set root priority lower (better) on the HSRP Active side |
| Port roles | HSRP-facing VLAN interfaces on switches should not rely on blocked uplinks to reach Active |
If STP blocks the port toward the HSRP Active router, hosts may still reach the VIP through a longer L2 path while the Standby router sits on a direct link — know that L2 path and L3 gateway roles should be coordinated.
Example coordination:
! On distribution switch intended as STP root for VLAN 10
spanning-tree vlan 10 priority 4096
! On matching HSRP Active router interface
standby 1 priority 110
standby 1 preempt
Verification
show standby show standby brief show standby all debug standby terse
Key fields in show standby:
- State: Active / Standby / Listen
- Virtual IP address
- Priority and preempt status
- Active router address and standby router address
- Hellos timers
Troubleshooting
| Symptom | Check |
|---|---|
| Both routers Standby | Group mismatch, ACL blocking multicast, version mismatch |
| Flapping Active role | Preempt + unstable interface; timer mismatch |
| Hosts cannot reach VIP | Wrong VIP config, different subnet masks, ARP stuck to old virtual MAC |
| Suboptimal traffic flow | STP root and HSRP Active on opposite sides |
After failover, hosts may cache the old virtual MAC briefly — gratuitous ARP from the new Active helps update caches.
Exam checklist
Hosts configure the virtual IP as default gateway — not the physical .2 or .3 addresses on the routers.
Standard HSRP = one Active per group. For load sharing across routers, use multiple groups/VLANs (active/active pattern) or GLBP.
Quick review
- FHRP provides a virtual IP/MAC so hosts need one default gateway
- HSRP Active forwards; Standby monitors Hellos and takes over on loss
- Higher priority wins; preempt (off by default) controls fail-back behavior
- Coordinate HSRP Active with STP root to avoid blocked-path forwarding
- Verify with
show standby— confirm Active, Standby, VIP, and timers - Virtual MAC prefixes: HSRP
0000.0C, VRRP0000.5E, GLBP0007— full address optional - VRRP = open-standard equivalent; GLBP = Cisco active/active load balancing