CCNA First Hop Redundancy: Reading HSRP and VRRP Status, Election, Preemption and Failover

A first hop redundancy protocol (FHRP) lets two or more routers share one virtual IP address and one virtual MAC address, so hosts can keep using the same default gateway when the router forwarding for it fails. Hosts are configured (statically or by DHCP) with a single default gateway address and resolve it with ARP once. If that address belongs to one physical router and the router fails, every host on the subnet loses off-subnet connectivity until the router returns or someone changes the hosts.

A routing protocol does not fix this. OSPF between the gateway routers and the core can reconverge in seconds, but hosts do not run OSPF: they still send frames to the failed router's MAC address. The fix is at the host's first hop:

• the routers in an FHRP group agree on a virtual IP (for example 10.1.10.1) that is not any single router's interface address in HSRP (VRRP also allows the virtual IP to be a router's real address, covered below);
• hosts use the virtual IP as their default gateway, and the DHCP pool should hand out that address, never a router's interface address;
• one router at a time owns the virtual MAC and answers ARP for the virtual IP. If it fails, another router takes over the same virtual IP and MAC, so the hosts' ARP caches stay valid and nothing changes on the hosts.

CCNA v2.0 exam topic 3.4 asks you to interpret the operational status of two FHRPs: Cisco's HSRP (Hot Standby Router Protocol) and the open-standard VRRP (Virtual Router Redundancy Protocol, version 3 in RFC 5798 on IOS XE). In practice that means reading show standby and show vrrp output and predicting which router forwards, which takes over, and why a group is misbehaving.

HSRP and VRRP solve the same problem the same way, one forwarding router per group with the others waiting, but they differ in names, defaults and packet details, and those differences change how a group behaves when routers join, fail and return.

Two rows matter most. Preemption: a VRRP router with a higher priority takes the Master role back on its own, while an HSRP router needs standby <group> preempt to do the same. Terminology: Active/Standby/Listen are HSRP words, Master/Backup are VRRP words, and a statement that mixes them (a VRRP router "in Standby") is describing the wrong protocol. GLBP, a third Cisco FHRP that load-balances within one group, is not part of this exam topic.

An HSRP router moves through six states, and the State column of show standby brief tells you which one it is in now. Only the Active router forwards traffic sent to the virtual MAC; the Standby router is next in line; any further routers sit in Listen.

R1#show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Gi0/0/1     10   110 P Active  local           10.1.10.3       10.1.10.1

Read each column in turn: Grp is the group number (both routers must use the same one); Pri is the current priority (after any tracking decrement); P marks preemption; Active and Standby name the routers in those roles by their real interface addresses, with local meaning this router; Virtual IP is the address hosts use as their gateway. unknown under Standby means this router hears no peer at all.

The detailed show standby adds the timers, preemption, the virtual MAC, and the configured versus current priority:

R1#show standby Gi0/0/1
GigabitEthernet0/0/1 - Group 10
  State is Active
  Virtual IP address is 10.1.10.1
  Active virtual MAC address is 0000.0c07.ac0a (MAC In Use)
  Hello time 3 sec, hold time 10 sec
  Preemption enabled
  Active router is local
  Standby router is 10.1.10.3, priority 100 (expires in 8.432 sec)
  Priority 110 (configured 110)

Because the output is per router, you can identify the forwarding router from any member: on a Standby router, the address under Active is the router currently forwarding for the virtual IP.

HSRP elects the Active router by highest priority (default 100, range 0–255); if priorities tie, the router with the highest interface IP address on that subnet wins. The next-best router becomes Standby, and every other router goes to Listen. Priority is always compared first: a router left at the default 100 beats one configured with 80 whatever their addresses, and a configured priority below 100 loses to a router that simply uses the default.

The catch is that the election only decides roles when there is a vacancy, for example when routers boot together or the Active fails. HSRP preemption is disabled by default, so a router that comes up and hears an existing Active router does not take over, even with a higher priority. It settles into Standby (or Listen). This is why a high-priority router that was reloaded often comes back as Standby.

• standby <group> preempt lets this router take the Active role from a lower-priority Active router. It must be configured on the router that should take over; preempt on the current Active router does not hand anything back.
• Preempt does not overrule priority. A router with preempt but a lower priority stays where the election puts it.
• When the Active router fails, the Standby becomes Active without needing preempt (the role is vacant), and a Listen router becomes the new Standby.
• standby <group> preempt delay minimum <seconds> makes a preempting router wait before it takes over. Use it when a returning router would otherwise become Active before its routing protocol has converged and then black-hole traffic. It delays only the takeover by the returning router, so failover when the Active fails is no slower. Interface tracking does not solve this problem: the router's interfaces are already up while its routing protocol is still converging, so a line-protocol track never lowers its priority.

interface GigabitEthernet0/0/1
 ip address 10.1.10.2 255.255.255.0
 standby 10 ip 10.1.10.1
 standby 10 priority 110
 standby 10 preempt delay minimum 60

A useful rule for any HSRP scenario: first work out each router's current priority, then ask whether a role is vacant. If none is, only a router with preempt and a higher priority can change who is Active.

VRRP elects the Master by highest priority, then highest interface IP, and every other router in the group is a Backup; unlike HSRP there is no separate Standby or Listen role. The VRRP states are Initialize, Backup and Master, and show vrrp brief prints them in capitals:

R1#show vrrp brief
  Interface          Grp  A-F Pri  Time Own Pre State   Master addr/Group addr
  Gi0/0/1             20 IPv4 120     0  N   Y  MASTER  10.1.20.2(local) 10.1.20.1

Three VRRP rules differ from HSRP:

• Preemption is on by default. A Backup whose priority is higher than the Master's takes over without any command. With three routers at 200, 180 and 90, the 200 router is Master and the other two are both Backup.
• Preemption needs a strictly higher priority. A Backup with the same priority as the Master does not take over, even if its IP address is higher; the address tie-break applies only when routers are choosing a Master together. To make a Backup take over without touching the Master, its priority must exceed the Master's, not equal it.
• The address owner. VRRP allows the virtual IP to be one router's real interface address. That router is the owner, runs at priority 255 automatically and is always Master while it is up; no configured priority (which can only reach 254) can beat it.

fhrp version vrrp v3
interface GigabitEthernet0/0/1
 ip address 10.1.20.2 255.255.255.0
 vrrp 20 address-family ipv4
  address 10.1.20.1 primary
  priority 120

Because preemption is the default, a migration from HSRP to VRRP with the same priorities and no preempt commands changes behaviour: a reloaded high-priority router that used to return as HSRP Standby now returns as VRRP Master. Preemption can be turned off with no preempt under the VRRP group.

Each FHRP builds its virtual MAC from a fixed prefix plus the group number in hex, and sends its hellos to a fixed multicast address, so a MAC address or a packet capture identifies the protocol, version and group.

Convert carefully: group 30 is hex 1e (0000.5e00.011e in VRRP), group 200 is hex c8 (0000.0c9f.f0c8 in HSRPv2). Working backwards from a host's ARP entry tells you which group a new router must join and whether it needs standby version 2.

Practical consequences:

• Version is set per interface. standby version 2 applies to every HSRP group on that interface. Enabling it on one router (for example to add an IPv6 group, which requires version 2) moves that router's IPv4 groups to the v2 MAC and to 224.0.0.102 as well.
• There is no version negotiation. A v1 router listens on 224.0.0.2 and a v2 router on 224.0.0.102, so mixed versions never hear each other and both claim Active.
• Group numbers above 255 need version 2. A team that numbers groups to match VLAN IDs above 255 must enable version 2 first, or the router rejects the group.
• Reusing a group number in different VLANs is harmless. Switches learn MAC addresses per VLAN, so 0000.0c07.ac01 in VLAN 10 and in VLAN 20 are separate entries.
• ACLs must permit the hellos. An inbound ACL ending in deny ip any any on the FHRP interface drops the hellos unless it permits UDP 1985 to the HSRP address, or IP protocol 112 to 224.0.0.18 for VRRP.

Object tracking lowers a router's FHRP priority by a set decrement while a tracked object (typically an uplink's line protocol) is down, so a router with a dead uplink can hand the gateway role to its peer. Tracking only lowers the local priority; whether the peer actually takes over depends on the peer's preemption.

track 1 interface GigabitEthernet0/0/0 line-protocol
!
interface GigabitEthernet0/0/1
 standby 10 priority 125
 standby 10 track 1 decrement 35

In show standby the result appears as current versus configured priority:

  Priority 90 (configured 125)
    Track object 1 state Down decrement 35

Rules for reading tracking scenarios:

• The decrement must push the priority below the peer's. 150 − 15 = 135 still beats a peer at 130; 150 − 25 = 125 does not. Equal priorities fall back to the IP tie-break, so aim strictly below.
• Decrements add up. With two tracked uplinks at 15 each, a router at 140 drops to 125 with one failure and 110 with both. Check which combination of failures crosses the peer's priority.
• In HSRP the peer needs preempt. The Active router does not resign because its priority fell; the Standby router takes over only if it has standby <group> preempt. Without it, a Standby with a higher priority waits forever while the Active router keeps forwarding with a dead uplink.
• In VRRP preemption is already on, so a lower priority on the Master is enough for a higher-priority Backup to take over, and when the object comes back up the original router's priority is restored and it preempts back.
• In HSRP the router whose priority recovers needs preempt to take the Active role back.

When the forwarding router fails, the next router waits for its failure-detection timer to expire, takes over the same virtual IP and virtual MAC, and sends gratuitous ARP so the switches update their MAC address tables. Hosts change nothing.

• HSRP detection. The Standby router expects a hello every 3 seconds and declares the Active router dead when the hold timer (10 seconds by default) expires. After a sudden power loss, failover can therefore take up to about 10 seconds. (If the Active router is shut down gracefully, it sends a resign message and the Standby takes over at once.)
• VRRP detection. The Master advertises every 1 second by default, and a Backup takes over when the master down interval expires: three advertisement intervals plus a skew time that is shorter for higher-priority Backups. At priority 100 that is about 3.6 seconds, which is why VRRP with defaults fails over faster than HSRP with defaults. A single missed advertisement is not enough. Detection relies only on missed advertisements: the protocol gets no link-state notice from the switch, and BFD, which some platforms can add for faster detection, is not enabled by default.
• What the new forwarding router does. It starts answering ARP for the virtual IP with the virtual MAC, never its burned-in MAC, and sends a gratuitous ARP sourced from the virtual MAC so switches move the MAC to its port.
• What hosts do. Nothing: their ARP entry for the gateway still maps the virtual IP to the same virtual MAC, so they keep sending frames as before.
• What the other routers do. In HSRP the old Standby becomes Active and the best Listen router becomes the new Standby. In VRRP the highest-priority Backup becomes Master and the rest stay Backup.

Two observations help when reading host-side evidence. A host's ARP request for the virtual IP gets one reply, from the Active (Master) router, carrying the virtual MAC. A traceroute's first hop shows the real interface address of the router that is currently forwarding, because the ICMP time-exceeded message is sourced from that interface, not from the virtual IP. So on a subnet whose virtual gateway is 172.16.5.1, a first hop of 172.16.5.3 means the router whose interface is 172.16.5.3 is the one forwarding now.

Both routers show Active (HSRP) or Master (VRRP) when neither is processing the other's hellos: each believes it is alone, so each claims the role. In HSRP the giveaway is unknown under Standby on both routers. Two routers answering ARP for the same virtual IP with the same virtual MAC makes the switches flip the MAC between ports, so users see intermittent gateway failures. This is a fault, not load sharing.

Settings that do not cause dual Active: equal priorities (the IP tie-break settles it), preemption on both or neither, and different configured hello/hold timers (the routers still exchange hellos and elect one Active). If the routers can ping each other, the Layer 2 path is fine and the cause is in how the hellos are sent or accepted.

An FHRP group has exactly one forwarding router, so the Standby or Backup router carries no gateway traffic for that group; to use both routers you run more than one group and make a different router the forwarder in each.

• Per VLAN. Give DSW1 the higher priority (with preempt) in VLAN 10's group and DSW2 the higher priority (with preempt) in VLAN 20's group. Each switch forwards for one VLAN and backs up the other. Equal priorities or preempt everywhere do not split the load by themselves.
• Two groups on one VLAN. Configure two groups with different virtual IPs, a different router preferred in each, and have DHCP hand half the hosts each gateway. If one router fails, the survivor forwards for both virtual IPs (each with its own group's MAC). With VRRP's default preemption, the returning router retakes its group automatically; with HSRP it needs preempt.

IPv6. IPv6 hosts normally learn their default router from router advertisements (RAs), not from DHCPv6, and the default router is a link-local address. FHRPs therefore protect a virtual link-local address:

• HSRP for IPv6 requires version 2. The group's virtual MAC is 0005.73a0.0XXX and Cisco derives the virtual link-local address from that MAC, and show standby displays it as FE80::5:73FF:FEA0:XXX (group 12 gives 0005.73a0.000c and FE80::5:73FF:FEA0:C). This is not standard modified EUI-64, which would flip the universal/local bit and add 02 to the first byte, so read the address from the output rather than converting the MAC yourself. The Active router sends the RAs that advertise this virtual link-local as the default router.
• VRRPv3 supports IPv6 natively: a group's primary address is a link-local address such as fe80::1, the Master answers neighbor solicitations for it with the IPv6 virtual MAC 0000.5e00.02XX, and hosts see the virtual link-local as their default route learned from RAs.

interface GigabitEthernet0/0/1
 standby version 2
 standby 12 ipv6 autoconfig
 standby 12 priority 110
 standby 12 preempt

Remember that standby version 2 is per interface: adding an IPv6 HSRP group on an interface that already runs IPv4 HSRP version 1 moves the IPv4 groups to version 2 too, so both routers must change together.