Skip to content
Log in Sign up My account

3.3.c HSRP and VRRP

Blueprint 3.3.c: Configure first hop redundancy protocols, such as HSRP, VRRP

  • HSRP versions 1 and 2: groups, virtual MAC, multicast address, states
  • VRRP versions 2 and 3: master election, address owner, IOS XE syntax
  • Priority, preemption and preempt delay
  • Object tracking with interface and IP SLA objects
  • Authentication and timers
  • Load sharing with multiple groups

The verb is configure. Expect a simulation like Sim 06 where you finish an HSRP or VRRP design, and exhibit questions where show standby or show vrrp output explains why the wrong router is forwarding. The design side of FHRP (why you need one, where it sits in the campus) is in 1.1 Design and High Availability.

The problem FHRP solves

Hosts get one default gateway from DHCP or static configuration. If that router fails, hosts cannot reach anything off their subnet, even though a second router sits on the same VLAN. A first hop redundancy protocol lets two or more routers share a virtual IP address and virtual MAC address. One router forwards for the virtual address; the others listen and take over if it stops sending hellos. Hosts never notice, because the gateway IP and MAC they cached stay the same. The new forwarder sends a gratuitous ARP so switches update their MAC tables.

graph TB
  CORE["Core / uplinks"] --- D1
  CORE --- D2
  D1["DIST1 10.10.10.2<br/>HSRP active, priority 110"] -- "trunk" --- D2["DIST2 10.10.10.3<br/>HSRP standby, priority 100"]
  D1 --- SW["ACC1 VLAN 10"]
  D2 --- SW
  SW --- H["Hosts<br/>gateway 10.10.10.1 (VIP)"]

Protocol comparison

HSRPv1 HSRPv2 VRRPv2 VRRPv3
Standard Cisco Cisco RFC 3768 RFC 5798
Roles Active, standby, listen Active, standby, listen Master, backup Master, backup
Multicast address 224.0.0.2 224.0.0.102 (IPv6 FF02::66) 224.0.0.18 224.0.0.18 (IPv6 FF02::12)
Transport UDP 1985 UDP 1985 IP protocol 112 IP protocol 112
Group range 0 to 255 0 to 4095 1 to 255 1 to 255
Virtual MAC 0000.0c07.acXX 0000.0c9f.fXXX 0000.5e00.01XX 0000.5e00.01XX (IPv6 0000.5e00.02XX)
Default timers Hello 3 s, hold 10 s Hello 3 s, hold 10 s Advertisement 1 s Advertisement 1 s (set in centiseconds or ms)
Default priority 100 (range 0 to 255) 100 100 (range 1 to 254, 255 = owner) 100
Preempt default Off Off On On
VIP can be an interface address No No Yes (address owner) Yes
IPv6 No Yes No Yes
Authentication Plain text, MD5 Plain text, MD5 Plain text, MD5 (Cisco) None in the RFC

XX is the group number in hex. HSRPv2 group 10 uses 0000.0c9f.f00a, HSRPv1 group 10 uses 0000.0c07.ac0a, VRRP group 10 uses 0000.5e00.010a.

GLBP (Cisco) is the third FHRP and is not named in the 3.3.c objective. Its distinguishing feature is load balancing within one group: an active virtual gateway (AVG) answers ARP with the virtual MACs of up to four active virtual forwarders (AVFs). It uses 224.0.0.102 and UDP 3222.

Exam trap

HSRPv1 and HSRPv2 do not interoperate: they use different multicast addresses and MAC formats. If one router runs standby version 2 and its peer does not, both become active and both send gratuitous ARPs for the VIP. standby version applies to all HSRP groups on that interface.

Election, priority and preemption

HSRP

  1. The router with the highest priority becomes active. Default 100.
  2. On a tie, the highest interface IP address wins.
  3. The next best becomes standby. Others stay in listen.

HSRP states: Initial, Learn (no VIP known yet), Listen, Speak (taking part in election), Standby, Active.

Election only happens when there is no active router. If a router with a higher priority comes online later, it does not take over unless it has preempt configured. That is the single most tested HSRP fact.

VRRP

  1. If a router owns the virtual IP (it is the real address of its interface), it has priority 255 and is always master.
  2. Otherwise the highest priority wins, default 100, configurable 1 to 254.
  3. On a tie, the highest primary IP address wins.

Preemption is on by default. Backups declare the master dead after the master down interval: three advertisement intervals plus a skew time that depends on priority (skew = (256 minus priority) / 256 seconds in VRRPv2), so higher-priority backups react slightly faster.

Preempt delay

When a router reloads, the interface comes up long before the routing table is complete. Preempting immediately can black-hole traffic for seconds. Use a delay:

standby 10 preempt delay minimum 60
vrrp 20 preempt delay minimum 60          ! VRRPv2 syntax

Exam trap

Preemption has to be enabled on the router that should take over. If R1 has a tracked uplink and priority 110 with preempt, but R2 (priority 100) has no preempt, R1 dropping to 90 does nothing: R2 never claims the active role. Look at both routers.

Object tracking

Tracking lowers a router's FHRP priority when something it depends on fails, so a peer with preempt can take over.

track 1 interface GigabitEthernet0/0 line-protocol
!
ip sla 1
 icmp-echo 203.0.113.1 source-interface GigabitEthernet0/0
 frequency 5
ip sla schedule 1 life forever start-time now
track 2 ip sla 1 reachability
!
interface Vlan10
 standby 10 track 1 decrement 20
 standby 10 track 2 decrement 20
  • Default decrement is 10 if none is given.
  • Multiple tracked objects subtract cumulatively.
  • The decrement must push the priority below the peer's priority. If the priorities end up equal, the outcome depends on the IP address tiebreaker, which is not a design you can rely on.
  • track 1 interface ... line-protocol only sees the local link. An IP SLA object catches failures beyond the next hop, such as an ISP problem with the link still up.
  • standby 10 track Gi0/0 20 (tracking an interface directly) is older syntax. The track object form is current and is what the exam expects.

Worked example: R1 priority 110, tracks two objects at decrement 20 each. Both fail: 110 minus 40 = 70. R2 at 100 with preempt takes over. One fails: 90, R2 still takes over. If the decrement were 10, one failure leaves R1 at 100, equal to R2, and failover then depends on which router has the higher IP address. Always size the decrement so the priority drops clearly below the peer.

Exam trap

A VRRP address owner has priority 255 and cannot be decremented by tracking. If you want tracking to move the master role, do not make the virtual IP equal to an interface address.

Configuration on IOS XE

interface Vlan10
 ip address 10.10.10.2 255.255.255.0
 standby version 2
 standby 10 ip 10.10.10.1
 standby 10 priority 110
 standby 10 preempt delay minimum 30
 standby 10 timers msec 200 msec 750
 standby 10 authentication md5 key-string Hsrp10Key
 standby 10 track 1 decrement 20

interface Vlan10
 ipv6 address 2001:db8:10::2/64
 standby version 2
 standby 6 ipv6 autoconfig          ! VIP is the link-local address derived from the virtual MAC
 standby 6 ipv6 2001:db8:10::1/64   ! optional global VIP
 standby 6 priority 110
 standby 6 preempt

interface Vlan20
 ip address 10.20.20.2 255.255.255.0
 vrrp 20 ip 10.20.20.1
 vrrp 20 priority 110
 vrrp 20 authentication md5 key-string Vrrp20Key
 vrrp 20 track 1 decrement 20

fhrp version vrrp v3
!
interface Vlan20
 ip address 10.20.20.2 255.255.255.0
 vrrp 20 address-family ipv4
  address 10.20.20.1 primary
  priority 110
  track 1 decrement 20
  timers advertise 1000
  vrrpv2                            ! optional: send v2 adverts to interoperate with v2 peers

Notes on the syntax:

  • standby 10 ip 10.10.10.1 on one router is enough; peers can learn the VIP from hellos. Configure it on both anyway so a router that boots alone still has a VIP.
  • standby timers takes hello then hold. Hold should be at least three times hello. Sub-second timers use msec.
  • standby 10 authentication md5 key-string must match on all members. A mismatch means each router ignores the other's hellos, so both become active.
  • fhrp version vrrp v3 changes the whole device to the VRRPv3 command style. On IOS XE, once it is on, the old vrrp 20 ip form is rejected.
  • VRRPv3 has no authentication. If a question asks for authenticated VRRP, it is VRRPv2.

Load sharing with multiple groups

One group means one router forwards and the other idles. The standard fix is a group per VLAN with opposite priorities, aligned with the spanning tree root for that VLAN so traffic does not cross the inter-switch link.

graph TB
  D1["DIST1<br/>VLAN 10 active (110)<br/>VLAN 20 standby (100)<br/>STP root VLAN 10"] --- D2["DIST2<br/>VLAN 10 standby (100)<br/>VLAN 20 active (110)<br/>STP root VLAN 20"]
  D1 --- A["ACC1 VLANs 10, 20"]
  D2 --- A

You can also run two groups on the same VLAN with two VIPs and give half the hosts each gateway (MHSRP). That needs DHCP scope work, which is why per-VLAN groups are more common.

Verification

DIST1# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Vl10        10   110 P Active  local           10.10.10.3      10.10.10.1
Vl20        20   100 P Standby 10.20.20.3      local           10.20.20.1

DIST1# show standby Vlan10
Vlan10 - Group 10 (version 2)
  State is Active
    2 state changes, last state change 00:12:41
  Virtual IP address is 10.10.10.1
  Active virtual MAC address is 0000.0c9f.f00a (MAC In Use)
    Local virtual MAC address is 0000.0c9f.f00a (v2 default)
  Hello time 200 msec, hold time 750 msec
  Authentication MD5, key-string
  Preemption enabled, delay min 30 secs
  Active router is local
  Standby router is 10.10.10.3, priority 100 (expires in 0.640 sec)
  Priority 110 (configured 110)
    Track object 1 state Up decrement 20
  Group name is "hsrp-Vl10-10" (default)

The two lines to find first are Priority 110 (configured 110) (if the numbers differ, a tracked object is down) and Preemption enabled.

DIST2# show vrrp brief
Interface          Grp Pri Time  Own Pre State   Master addr     Group addr
Vl20               20  110 3570       Y  Master  10.20.20.3      10.20.20.1

Time is the master down interval in milliseconds: 3 x 1000 plus skew (256 minus 110) / 256 x 1000, about 570. Own is blank because the VIP is not an interface address; Pre Y shows default preemption. With VRRPv3, show vrrp output shows the address family per group.

Troubleshooting checklist

Symptom Check
Both routers active (or both master) Hellos not reaching each other: VLAN not on the trunk, version mismatch, authentication mismatch, ACL dropping 224.0.0.2/.102/.18
Higher priority router stays standby No preempt on it (HSRP)
Tracked failure does not fail over Decrement too small, peer missing preempt, track object watching the wrong thing, VRRP owner at 255
Flapping between active and standby Timers too aggressive for CPU load, unstable IP SLA, preempt with no delay after reload
Hosts cannot reach VIP after failover Switch MAC table not updated (gratuitous ARP filtered), or STP blocking the path to the new active

Lab: HSRPv2 with tracking, then VRRP

Topology: the base topology campus: DIST1 and DIST2 with SVIs for VLAN 10, uplinks to R1 and R2, ACC1 with Host1.

  1. Create VLAN 10 on all three switches, trunk it on the DIST1 to ACC1, DIST2 to ACC1 and DIST1 to DIST2 links. Address Vlan10 on DIST1 as 10.10.10.2/24 and on DIST2 as 10.10.10.3/24.
  2. Configure HSRPv2 group 10 with VIP 10.10.10.1 on both. DIST1 priority 110 with preempt, DIST2 default priority with preempt. Add MD5 authentication with the same key on both.
  3. Track DIST1's uplink to R1: track 1 interface GigabitEthernet0/1 line-protocol, standby 10 track 1 decrement 20.
  4. On Host1 set gateway 10.10.10.1, start a continuous ping to R1's loopback.
  5. Verify show standby brief on both: DIST1 Active, DIST2 Standby, P set on both.

  6. Shut DIST1's uplink. Expected on DIST1:

    DIST1# show standby brief
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Vl10        10   90  P Standby 10.10.10.3      local           10.10.10.1

    Host1 loses at most a few pings (hold time 10 s with default timers). 7. Bring the uplink back. DIST1 returns to 110 and preempts back after the delay. 8. Break it. Change the key on DIST2. Both switches go Active. Note the authentication and duplicate-address log messages. Fix the key. 9. Convert to VRRP. Remove the HSRP configuration, then build VRRP group 10 with the same VIP and priorities. Confirm with show vrrp brief that DIST1 is master without configuring preempt, and that a tracked failure moves the master to DIST2.

Quick check

DIST1 has HSRP priority 105 and tracks one object with no decrement value. DIST2 has priority 100 and preempt. The tracked object goes down. Who is active?

DIST2. The default decrement is 10, so DIST1 drops to 95. That is lower than DIST2's 100, and DIST2 has preempt, so DIST2 takes over the active role.

Which virtual MAC address does HSRPv2 group 300 use?

300 in hex is 0x12C, so the MAC is 0000.0c9f.f12c. HSRPv1 could not use group 300 at all, because its range ends at 255.

A VRRP router's interface address is 10.1.1.1 and the group VIP is also 10.1.1.1. What priority does it have, and can tracking move the master role away from it?

It is the address owner with priority 255, and it is always master while it is up. Tracking cannot decrement an owner, so the backup only takes over if the owner fails completely.

References