Featured image

Table of Contents Link to heading

First Hop Redundancy Protocols Link to heading

Info
Read more at .

FHRPs solve a fundamental problem in LAN design: end hosts configure a single default gateway IP address. If that gateway fails, the host has no automatic mechanism to discover a new one — all traffic is black-holed until the host is manually reconfigured or DHCP renews with a new gateway address.

HSRP, VRRP, and GLBP all solve this by presenting a virtual gateway IP address to hosts. The virtual IP is shared between two or more routers; if the primary router fails, a backup takes ownership of the virtual IP and begins responding to ARP requests with the virtual MAC — hosts never know a failover occurred.

HSRP Fundamentals Link to heading

Info
HSRP (Hot Standby Router Protocol) is a Cisco-proprietary FHRP that provides default gateway redundancy using a virtual IP and virtual MAC address shared between an active and a standby router.

Key protocol parameters:

Parameter Value (v1) Value (v2)
Standard Cisco proprietary Cisco proprietary
Transport UDP port 1985 UDP port 1985
Hello interval 3 seconds 3 seconds
Hold interval 10 seconds 10 seconds
Multicast address 224.0.0.2 224.0.0.102
Group number range 0–255 0–4095
Virtual MAC format 0000.0c07.acXX 0000.0c9f.fXXX
Default priority 100 100
Default pre-emption Disabled Disabled
Authentication MD5 or plaintext MD5 or plaintext

The active router sources Hello packets from its real interface IP using the HSRP virtual MAC address. The standby router sources Hellos from its real IP using its interface BIA (burned-in MAC). End hosts ARP for the virtual IP and receive the virtual MAC in the ARP reply — they always send traffic to the virtual MAC, regardless of which physical router is currently active.

HSRP Versions: v1 vs v2 Link to heading

Feature HSRPv1 HSRPv2
Group range 0–255 0–4095
Virtual MAC 0000.0c07.acXX 0000.0c9f.fXXX
Multicast 224.0.0.2 224.0.0.102
IPv6 support No Required for IPv6
Timer granularity Seconds Milliseconds
Interoperability v1 and v2 are mutually exclusive per interface
Note
HSRPv2 is required for IPv6 HSRP. For IPv4 deployments, HSRPv2 offers millisecond-granularity timers (useful in environments requiring sub-second failover) and a larger group number space (useful when matching HSRP group numbers to VLAN IDs above 255). Migrate to v2 for new deployments.

HSRP Roles Link to heading

Role Function Election Criteria
Active Forwards traffic for the virtual IP; responds to ARP with the virtual MAC Higher priority, then higher IP
Standby Monitors the active router; takes over if active fails Second-highest priority
Listen Aware of the HSRP group but neither active nor standby (in multi-router groups) Lower priority

The active router is elected based on priority (default 100). If priorities are equal, the router with the highest IP address wins. The standby is the router with the second-highest priority.

HSRP State Machine Link to heading

HSRP routers transition through these states during initialisation and after topology changes:

State Description
Disabled HSRP not configured or interface is down
Init Interface is up, HSRP is starting — waiting to hear from other routers
Listen Router knows the active and standby routers but is neither
Speak Router is sending Hellos and participating in active/standby election
Standby Router is the backup — monitoring the active, ready to take over
Active Router owns the virtual IP and virtual MAC — forwarding traffic

Normal steady state: one router in Active, one in Standby, others (if any) in Listen.

Pre-emption Link to heading

By default, HSRP pre-emption is disabled. This means that if the active router fails and the standby takes over, the original active router will NOT reclaim the active role when it comes back online — even if it has a higher priority.

standby 1 preempt

With pre-emption enabled, a router that comes back online and has a higher priority than the current active will trigger a new election and take back the active role after the pre-emption delay (default: 0 seconds, configurable).

Tip

Enable pre-emption with a delay in production environments to prevent the router from taking over before its routing table has fully converged:

standby 1 preempt delay minimum 60

Without this delay, a router that just completed a reload may take the active role before its IGP has converged — causing a brief black hole even though the “better” router is now active.

Load Sharing with Multiple HSRP Groups Link to heading

Info
HSRP does not load-balance traffic within a single group — only one router is active at a time. Load sharing is achieved by running multiple HSRP groups on the same interface, with different routers as active for each group, and splitting hosts between the two virtual gateways.

With two routers (R1 and R2) and two HSRP groups:

  • R1 is active for group 1 (virtual IP: 10.10.10.1), standby for group 2
  • R2 is active for group 2 (virtual IP: 10.10.10.254), standby for group 1
  • 50% of hosts use 10.10.10.1 as their default gateway
  • 50% of hosts use 10.10.10.254 as their default gateway

Both gateways remain active simultaneously, distributing load across both routers. If either router fails, the survivor takes over both virtual IPs.

Configuration Link to heading

Basic HSRP Configuration Link to heading 

interface GigabitEthernet0/1
 ip address 10.10.10.2 255.255.255.0
 standby version 2
 standby 1 ip 10.10.10.1
 standby 1 priority 110
 standby 1 preempt delay minimum 60
 standby 1 authentication md5 key-string HsrpKey123
 standby 1 timers msec 250 msec 750

Load Sharing: Single Subnet, Two Gateways Link to heading

Example

R1 is active for group 1 (VIP: 10.10.10.1), R2 is active for group 2 (VIP: 10.10.10.254):

Router R1:

interface GigabitEthernet0/1
 ip address 10.10.10.2 255.255.255.0
 standby version 2
 standby 1 ip 10.10.10.1
 standby 1 priority 110
 standby 1 preempt
 standby 2 ip 10.10.10.254
 standby 2 priority 90

Router R2:

interface GigabitEthernet0/1
 ip address 10.10.10.3 255.255.255.0
 standby version 2
 standby 1 ip 10.10.10.1
 standby 1 priority 90
 standby 2 ip 10.10.10.254
 standby 2 priority 110
 standby 2 preempt

Load Sharing: Multiple Subnets Link to heading

Example

R1 is active for subnet 10.10.10.0/24, R2 is active for 10.10.20.0/24:

Router R1:

interface GigabitEthernet0/1
 ip address 10.10.10.2 255.255.255.0
 standby 1 ip 10.10.10.1
 standby 1 priority 110
 standby 1 preempt

interface GigabitEthernet0/2
 ip address 10.10.20.2 255.255.255.0
 standby 2 ip 10.10.20.1
 standby 2 priority 90

Router R2:

interface GigabitEthernet0/1
 ip address 10.10.10.3 255.255.255.0
 standby 1 ip 10.10.10.1
 standby 1 priority 90

interface GigabitEthernet0/2
 ip address 10.10.20.3 255.255.255.0
 standby 2 ip 10.10.20.1
 standby 2 priority 110
 standby 2 preempt

Interface Tracking Link to heading

HSRP interface tracking decrements the router’s priority when a tracked interface (typically a WAN uplink) goes down, triggering a failover to the standby even if the HSRP interface itself is still up:

! Track the WAN uplink
track 1 interface GigabitEthernet0/0 line-protocol

interface GigabitEthernet0/1
 standby 1 ip 10.10.10.1
 standby 1 priority 110
 standby 1 preempt
 standby 1 track 1 decrement 20

If GigabitEthernet0/0 goes down, the router’s HSRP priority drops from 110 to 90 — below the standby’s priority of 100 — triggering a failover.

Verification Link to heading 

show standby
show standby brief
show standby GigabitEthernet0/1
show standby GigabitEthernet0/1 detail

show standby brief provides a compact view of all HSRP groups: group number, priority, state (Active/Standby/Listen), virtual IP, and which router is the current active. show standby gives full detail including timer values, hello/coup/resign counters, and authentication method.

Guidelines and Limitations Link to heading

  • Configure an IP address on the HSRP interface before HSRP is activated — HSRP requires a real interface IP to source Hello packets
  • The virtual IP must be in the same subnet as the interface IP for IPv4 HSRP
  • Use HSRPv2 for IPv6 — HSRPv1 does not support IPv6
  • Do not run more than one FHRP protocol (HSRP, VRRP, GLBP) on the same interface simultaneously
  • HSRPv1 and HSRPv2 are mutually exclusive per interface — all routers in a group must use the same version
  • You cannot change from v2 to v1 if groups above 255 are configured
  • HSRP for IPv4 supports BFD for faster failure detection — HSRP for IPv6 does not
  • In vPC environments, configure the same virtual MAC on both vPC peers and use the vPC peer-gateway feature to prevent suboptimal routing through the peer link