First-Hop Redundancy Cheat Sheet

ULTIMATE CHEAT SHEET / CCNA · CCNP · NETWORK ENGINEERS

First-Hop Redundancy Ultimate Cheat Sheet

HSRP • VRRP • GLBP — virtual gateways, priority and preemption, object tracking, Cisco IOS XE configurations, verification, security and troubleshooting.

Published by MAG212 CYBER · Technical education edition

01 / Why first-hop redundancy?

Hosts usually have one static default gateway. If that router or switch fails, the host loses everything off-subnet even though another router is sitting on the same VLAN. A first-hop redundancy protocol (FHRP) lets two or more gateways share a virtual IP and virtual MAC. One of them forwards for the virtual address; if it fails, a peer takes over the same IP and MAC, so hosts need no reconfiguration and their ARP caches stay valid (the new owner sends gratuitous ARP to update switch MAC tables).

FHRPs protect the first hop only. They do not make the upstream WAN, NAT or firewall path redundant — track the path that matters and design redundant uplinks.

02 / Protocol comparison

Rule of thumb: HSRP for all-Cisco campus designs, VRRP for mixed vendors or firewalls, GLBP only where you need several active gateways in one VLAN and the platform supports it — many Catalyst switching platforms do not.

03 / HSRP version 2: complete paired lab

Both Layer 3 switches carry VLAN 20. DIST-A starts active because priority 120 beats DIST-B’s 100. Both enable preemption with a 30-second delay so a rebooting switch finishes building its routing and ARP tables before it reclaims the role. Object tracking lowers DIST-A’s priority by 40 if its uplink fails.

ip routing
vlan 20
 name USERS
track 10 interface GigabitEthernet1/0/48 line-protocol
!
interface Vlan20
 ip address 10.20.20.2 255.255.255.0
 standby version 2
 standby 20 ip 10.20.20.1
 standby 20 priority 120
 standby 20 preempt delay minimum 30
 standby 20 track 10 decrement 40
 no shutdown

ip routing
vlan 20
 name USERS
!
interface Vlan20
 ip address 10.20.20.3 255.255.255.0
 standby version 2
 standby 20 ip 10.20.20.1
 standby 20 priority 100
 standby 20 preempt delay minimum 30
 no shutdown

Expected: DIST-A Active, DIST-B Standby. If Gi1/0/48 goes down, DIST-A drops to 120 − 40 = 80. Because DIST-B has preempt and a higher priority (100), it takes over. When the uplink returns, DIST-A goes back to 120 and, after the 30-second delay, preempts back to Active.

Optional faster detection: standby 20 timers msec 250 msec 750 on both peers. Sub-second timers add control-plane load; on most campus designs BFD or default timers plus tracking are enough.

04 / VRRP: the standards-based alternative

VRRP uses IP protocol 112 (not TCP or UDP). Preemption is on by default. If a router’s real interface address is the virtual IP, it becomes the address owner with priority 255. Cisco IOS XE supports two syntaxes; use the one your release offers.

track 10 interface GigabitEthernet1/0/48 line-protocol
interface Vlan20
 ip address 10.20.20.2 255.255.255.0
 vrrp 20 ip 10.20.20.1
 vrrp 20 priority 120
 vrrp 20 track 10 decrement 40

fhrp version vrrp v3
track 10 interface GigabitEthernet1/0/48 line-protocol
interface Vlan20
 ip address 10.20.20.2 255.255.255.0
 vrrp 20 address-family ipv4
  address 10.20.20.1 primary
  priority 120
  track 10 decrement 40

DIST-B uses the same group with its own address 10.20.20.3 and the default priority 100. VRRPv3 (RFC 9568) supports both IPv4 and IPv6; IPv6 is a separate address-family ipv6 instance. Older guides that say “VRRP has no IPv6” describe VRRPv2. RFC 9568 renamed the forwarding role from Master to Active; many CLIs still print MASTER.

05 / GLBP: redundancy with gateway load sharing

One router is elected Active Virtual Gateway (AVG). It answers every ARP request for the virtual IP but hands out different virtual MACs — one per Active Virtual Forwarder (AVF), up to four per group. Different hosts therefore send traffic to different gateways while sharing one default-gateway IP.

interface Vlan20
 ip address 10.20.20.2 255.255.255.0
 glbp 20 ip 10.20.20.1
 glbp 20 priority 120
 glbp 20 preempt
 glbp 20 load-balancing round-robin
 glbp 20 weighting 100 lower 70 upper 90
 glbp 20 weighting track 10 decrement 40

interface Vlan20
 ip address 10.20.20.3 255.255.255.0
 glbp 20 ip 10.20.20.1
 glbp 20 priority 100
 glbp 20 preempt
 glbp 20 load-balancing round-robin

Priority vs weighting: priority (with preempt) decides which router is AVG. Weighting decides whether a router keeps forwarding as an AVF: in the example, losing the uplink drops DIST-A’s weight from 100 to 60, below the lower threshold of 70, so it stops forwarding and DIST-B takes over its virtual MAC. It resumes when the weight climbs back above 90.

GLBP shares load per host through ARP replies, not per packet or per flow. Load-balancing modes: round-robin (default), weighted and host-dependent (the same host always gets the same MAC).

06 / Failover and validation

Test in a lab or maintenance window: confirm the state change, that hosts keep forwarding, that remote applications stay reachable, and that failback works. A stable virtual IP does not preserve sessions if NAT, firewall state or asymmetric routing breaks the flow.

07 / Command field reference

show standby brief
show standby vlan 20
show vrrp brief
show vrrp detail
show glbp brief
show glbp detail
show track brief
show logging | include HSRP|VRRP|GLBP

show ip interface brief
show interfaces trunk
show vlan brief
show spanning-tree vlan 20
show ip route
show ip arp 10.20.20.1
ping 10.20.20.1 source vlan 20
traceroute 8.8.8.8

Read the group number, state (Active/Standby/Listen or Active/Backup), priority, virtual IP, virtual MAC, timers and the “last state change” counter. A ping to the virtual IP is only a first test — also test a remote destination from a VLAN 20 host.

08 / Troubleshooting decision tree

1. Hosts cannot reach the virtual IP: check VLAN membership, the host’s gateway and mask, and that at least one SVI is up/up.
2. Both peers show Active: hellos are not getting through. Check allowed VLANs on every trunk, STP blocking, ACLs or control-plane policies dropping 224.0.0.102 / 224.0.0.18, mismatched group numbers, HSRP version or authentication.
3. Failover does not happen: check show track, the priority after decrement, and that the peer has preempt.
4. Gateway answers but the internet fails: check default routes, upstream reachability, ACLs, NAT and firewall state — not only the FHRP.
5. State keeps flapping: correlate interface logs, err-disable events, STP topology changes, CPU load, timers and an oscillating tracked object.

09 / Security and design hardening

• Authenticate the protocol where supported: standby 20 authentication md5 key-chain FHRP-KEYS (HSRP) or the platform’s VRRP authentication options. Plain-text keys stop accidents, not attackers.
• An attacker on the VLAN can send hellos with priority 255 and become the gateway (man-in-the-middle). Restrict who can reach infrastructure VLANs, and filter FHRP traffic arriving on host ports with port ACLs where your platform allows.
• Use BPDU Guard on host ports, prune allowed VLANs on trunks and protect management with AAA and SSH.
• Align the STP root (and HSRP active) for each VLAN on the same distribution switch so traffic does not cross the inter-switch link unnecessarily.
• Document priorities, monitor state changes in syslog/SNMP, and test both failover and failback.
• Consider whether StackWise Virtual, VSS, vPC or anycast gateways in an EVPN fabric fit better than a classic FHRP.

10 / Practice exam: eight explained answers

1. Why use a virtual IP? Hosts keep one gateway address even when the device doing the forwarding changes.
2. What does HSRP preemption do? Lets a higher-priority peer take the Active role from a lower-priority one. It is off by default in HSRP.
3. Does VRRP use UDP 112? No — it is IP protocol 112. HSRP uses UDP 1985 and GLBP UDP 3222.
4. DIST-A priority 120 tracks its uplink with decrement 15. DIST-B is 100 with preempt. Does DIST-B take over when the uplink fails? No. 120 − 15 = 105, still higher than 100. The decrement must push the active below the standby.
5. Why could both routers show Active? They are not hearing each other’s hellos, usually because of a trunk, VLAN or filtering problem.
6. Does GLBP load-balance every packet? No. The AVG gives different hosts different virtual MACs, so the split is per host.
7. What is the HSRPv2 virtual MAC for group 20? 0000.0c9f.f014 (20 = 0x014).
8. What must a failover test include? The state change, host forwarding, reachability to upstream applications, and a planned failback.

11 / Sources & further reading

This is an original MAG212 CYBER guide. The lab, diagram, configurations and troubleshooting cases were written independently and checked against current Cisco documentation and IETF standards.

• Cisco IOS XE — Configuring HSRP
• RFC 9568 — Virtual Router Redundancy Protocol (VRRP) Version 3
• RFC 3768 — VRRP (version 2)
• Cisco Feature Navigator — check GLBP/VRRPv3 support for your platform

CLI syntax varies by IOS XE release and hardware. Check support with ? and your platform’s configuration guide, and validate through change control before production use.