Day 20
First Hop Redundancy Protocols
first-hop-redundancy
At a glance
First-hop redundancy: hosts need one stable gateway IP. HSRP roles/states, virtual IP/MAC, preempt and tracking, VRRP/GLBP comparison, show standby, and split-brain / design pitfalls. Maps to CCNA v2.0 objective(s) 3.4.
Deep chapter
Long-form companion reading (original prose).
First hop problem
Hosts send off-subnet traffic to a default gateway. That gateway is one IP and one MAC on the LAN. If the router owning that address dies, ARP still points at a corpse until someone changes every host—or you use an FHRP.
First Hop Redundancy Protocols let two or more routers share a virtual IP that hosts use as their gateway. One device forwards; another stands ready. The host config never changes when the active forwarder fails.
FHRP solves gateway router failure on that subnet. It does not by itself fix a switching loop, a down access port, or a WAN outage behind both routers. Pair it with sound L2 design and upstream routing (OSPF from Days 26–28).
Exam trap: two routers with different gateway IPs on the same VLAN is not FHRP—it is a split brain waiting for half the PCs to be misconfigured.
HSRP roles
HSRP (Hot Standby Router Protocol) is Cisco-proprietary. In a group, one router is Active (forwards for the virtual IP), one is Standby (ready to take over), and any others are Listen. Hosts ARP for the VIP and learn the virtual MAC.
Priority elects Active (highest wins; default 100). Tie-break uses highest IP address on the HSRP interface. Configure with `standby <group> ip <VIP>` and `standby <group> priority <value>` on each peer’s SVI or interface.
Active and Standby exchange Hellos (UDP 1985, multicast 224.0.0.2 in v1 themes). If Active stops speaking, Standby promotes after Hold time. Group number must match on all members of that VIP.
Exam trap: the VIP must sit in the same subnet as the interface IPs, and should not duplicate a physical interface IP on either peer.
HSRP states
HSRP state machine you should recognize: Initial, Learn, Listen, Speak, Standby, Active. Speak is where a router sends Hellos and participates in election; Standby and Active are the forwarding-ready roles.
A healthy pair shows one Active and one Standby in `show standby`. Transient Speak/Listen during startup or failover is normal. Flapping Active/Standby usually means Layer 2 instability, timer mismatch, or interface tracking thrash.
Failover: Active lost → Standby becomes Active and may send a gratuitous ARP so switches update CAM for the virtual MAC. Hosts keep the same gateway IP; only the forwarding chassis changes.
Exam trap: Listen is a normal state for a third router, not automatically a failure. Two Actives is the failure mode (split-brain).
Virtual IP MAC
The virtual IP is what you configure on hosts as the default gateway. The virtual MAC is derived from the HSRP group (v1 pattern 0000.0c07.acXX where XX is the group number in hex). Hosts bind VIP → vMAC in ARP.
Physical interface IPs remain unique for management, routing protocol peering, and sourcing. Do not point PC gateways at those physical addresses if you want failover—the VIP is the contract with the hosts.
On failover, the new Active owns the same VIP and vMAC. Switches must learn the vMAC on the new port (gratuitous ARP helps). Spanning-tree blocking toward the wrong uplink can still black-hole even when HSRP looks perfect.
Exam trap: changing the HSRP group number changes the virtual MAC. Hosts may cache the old ARP entry until timeout unless something refreshes them.
Preempt
Without preempt, a higher-priority router that returns from failure stays Standby/Listen while the lower-priority router remains Active. Traffic does not automatically fail back.
Enable with `standby <group> preempt`. When the preferred router recovers and its priority is higher, it takes Active again. Optional `preempt delay` softens bounce during boot storms.
Use preempt when you have a clear primary (better links, preferred firewall path, aligned with STP root). Skip or delay preempt when failback would cause a second hit during unstable maintenance windows.
Exam trap: higher priority alone does not reclaim Active until preempt is configured (unless the current Active fails).
Tracking preview
Interface tracking lowers HSRP priority when an uplink fails, so Active can give up the VIP before hosts black-hole into a router with a dead WAN or core link. Example idea: track Gi0/1, decrement priority by 20 when it goes down.
Classic line: `standby <group> track <interface> [decrement]`. Object tracking on newer IOS can watch reachability, not just line protocol. Decrement must drop the Active below the Standby’s priority, and Standby needs preempt to take over.
Design the numbers: Primary 110, Secondary 100, decrement 20 → primary falls to 90 and secondary preempts. Without preempt on the secondary, tracking only paints a sad priority.
Exam trap: tracking the HSRP LAN interface itself is the wrong uplink story. Track the interface whose failure makes this router a bad Active.
VRRP compare
VRRP is the standards-based cousin (IETF). Roles: Master (like Active) and Backup (like Standby). Virtual IP behavior is analogous; many designs use the Master’s real IP as the VIP (VRRP allows that pattern).
Priority elects Master (default 100; owning the VIP address often implies priority 255 in classic VRRP). Preempt is commonly on by default in VRRP—opposite muscle memory from HSRP’s default.
For CCNA compare-and-contrast: HSRP = Cisco, Active/Standby, preempt off by default; VRRP = standard, Master/Backup, preempt often on; both give a VIP for hosts. Commands differ (`vrrp` vs `standby`) but the design picture is the same.
Exam trap: do not mix HSRP on one peer and VRRP on the other for the same VIP. Same protocol, same group semantics, matching priorities.
GLBP glance
GLBP (Gateway Load Balancing Protocol) is Cisco-specific and can load-share across multiple routers on the same subnet. An AVG (Active Virtual Gateway) assigns virtual MACs to AVFs (Active Virtual Forwarders) so different hosts hash to different forwarders.
HSRP/VRRP are primarily active/standby for forwarding the VIP (with upstream ECMP as a separate story). GLBP’s trick is first-hop load balancing on the LAN itself. CCNA expects recognition more than deep config mastery.
If the exam asks “which FHRP load balances per host on the gateway LAN,” GLBP is the usual answer. If it asks for industry-standard gateway redundancy, VRRP wins. If it shows `standby` commands, it is HSRP.
Exam trap: GLBP still needs sound L2/STP design. Load balancing does not fix asymmetric firewalls or broken uplinks by magic.
show standby
`show standby` (and `show standby brief`) is the HSRP verification hammer. You want correct VIP, group, state Active on one peer and Standby on the other, matching Hello/Hold timers, preempt setting, and priority values you designed.
Brief output is perfect for a two-SVI lab sweep. Full output shows tracked interfaces, decrement, and virtual MAC. Compare both peers side by side—priority and preempt mismatches are obvious in a paired read.
After failover tests, confirm the new Active, ping the VIP from a host, and check the host ARP table still shows the VIP with the HSRP vMAC. Upstream routing (OSPF) should still look sane on the new Active.
Exam trap: Active on both peers for one group means a communication break between them (or mis-matched groups/VIPs). Fix L2 between HSRP peers before you raise priorities again.
Split brain risks
Split-brain means each router believes it is Active because Hellos no longer pass between them while both still touch the hosts—often a broken trunk, blocked VLAN, or ACL between distribution peers.
Two Actives answer for the same VIP/vMAC → duplicate IP symptoms, intermittent connectivity, flapping CAM. Hosts may hash to either router unpredictably. Upstream may black-hole return traffic.
Prevention: keep a healthy L2 path for HSRP Hellos on that VLAN, align STP so both routers are not isolated, avoid filtering 224.0.0.2/HSRP ports between peers, and monitor for dual-Active with `show standby`.
Exam trap: raising priority does not fix split-brain. Restore Hello connectivity between the peers first.
Design active/standby
Pick a clear primary distribution switch per VLAN: higher HSRP priority, preempt on, tracking on its core/WAN uplinks. Align that primary with the STP root for the VLAN so user traffic does not hairpin across the standby uplink unnecessarily.
Odd VLANs Active on Dist-A, even VLANs Active on Dist-B is a common load-share pattern—still active/standby per VIP, but different VIPs prefer different chassis. Document group numbers and priorities in the runbook.
Keep VIP addressing consistent (often .1 or .254), never reuse VIP as a physical IP unless you are in a VRRP ownership story you fully understand, and test forced failover plus failback during a change window.
Exam trap: HSRP Active on Dist-A while STP root is Dist-B forces traffic up to B then across to A for the gateway—works until it hurts. Align FHRP and STP.
Version notes
HSRP version 1 is the classic default on many platforms: group range 0–255, virtual MAC 0000.0c07.acXX, multicast 224.0.0.2. Version 2 expands group range (0–4095), changes the vMAC to 0000.0c9f.fXXX, and uses 224.0.0.102.
Peers must run the same HSRP version on a group. Set with `standby version 2` when you need larger group IDs or v2 behavior. Mismatched versions fail to form a stable Active/Standby relationship.
IPv6 HSRP exists on modern code with different CLI; CCNA focus stays IPv4 VIP, priority, preempt, tracking, and `show standby`. Know that v1 vs v2 is a compatibility knob, not a free upgrade mid-flight.
Exam trap: changing version changes the virtual MAC. Treat it like a group-number change—hosts and switches may need ARP/CAM refresh.
Lab HSRP
Lab: two routers or L3 switches on VLAN 10 with unique interface IPs (for example .2 and .3) and VIP .1. On both: `standby 1 ip 192.168.10.1`, primary `standby 1 priority 110` and `standby 1 preempt`, secondary at default 100 with preempt. Hosts use .1 as gateway.
Verify `show standby brief` → one Active, one Standby. Ping VIP and a remote subnet. Shut the Active’s uplinks (with tracking) or the Active HSRP interface to force failover; confirm Standby becomes Active and pings recover.
Restore the primary, confirm preempt failback if enabled, and save configs. Optional: add `standby 1 track` on the primary uplink with a decrement that loses to 100, proving tracking plus preempt.
Capture outputs: before/after `show standby`, host ARP for the VIP, and a traceroute through the gateway so you can defend the lab in a quiz.
Exam comparison
Quick grid: HSRP—Cisco, Active/Standby, `standby`, preempt off by default. VRRP—standard, Master/Backup, preempt often on. GLBP—Cisco, AVG/AVF, first-hop load balancing. All solve the single default-gateway problem.
Shared ideas across HSRP/VRRP: VIP for hosts, priority election, Hello-based failure detection, need for L2 path between peers, danger of dual-active, value of tracking plus preempt for uplink loss.
Stack with earlier days: STP alignment (Day 20s), SVI/VLAN gateway (Day 16–18), OSPF upstream (Days 26–28). FHRP is the host-facing piece of distribution redundancy, not a routing protocol replacement.
Exam trap: “Which protocol is vendor-neutral gateway redundancy?” → VRRP. “Which uses Active/Standby and standby CLI?” → HSRP. “Which load-balances gateways on the LAN?” → GLBP.
Key ideas
- FHRP virtualizes the default gateway so one router failure does not black-hole hosts.
- HSRP: Active forwards, Standby ready; Listen/Speak during election.
- Virtual IP is what hosts use; virtual MAC is protocol-specific.
- Preempt lets a recovered higher-priority router reclaim Active.
- Tracking can decrement priority when an uplink fails.
- VRRP is standards-based; GLBP can share forwarding across gateways.
- show standby (HSRP) proves VIP, active/standby, priority, and preempt.
Self-check
- Why can’t hosts just list two default gateways in most exam topologies?
- Active recovers with higher priority but preempt off — who stays Active?
- What does tracking change when the tracked interface goes down?
- HSRP vs VRRP — one exam-relevant difference?
- Which show confirms the virtual IP and current Active router?