HSRP vs VRRP vs GLBP: Choosing a First Hop Redundancy Protocol

A first hop redundancy protocol (FHRP) lets two or more routers share one virtual IP address and one virtual MAC address, so hosts keep a single unchanging default gateway even when the router behind it fails. HSRP (Hot Standby Router Protocol) is Cisco-proprietary and runs one active router with the rest standing by. VRRP (Virtual Router Redundancy Protocol) is the open standard equivalent, RFC 5798, using master and backup terminology. GLBP (Gateway Load Balancing Protocol) is Cisco-proprietary and is the only one of the three that puts several routers to work forwarding for the same virtual IP at once.

Default gateway failure

A host learns one default gateway address, ARPs for it once, caches the MAC address, and frames every off-subnet packet to that MAC. That address belongs to a router subinterface or to an SVI on a Layer 3 switch, the two gateway objects described in inter-VLAN routing. If the router owning the address fails, the whole subnet is stranded, because no other box owns that address.

An FHRP breaks the address away from the hardware. The group gets a virtual IP address that hosts use as their gateway, and derives a virtual MAC address from the group number. Whichever router holds the forwarding role owns both and answers ARP requests for the virtual IP with the virtual MAC. When it fails, the survivor claims the same virtual MAC and sends a gratuitous ARP to refresh the switches’ MAC address tables. Hosts change nothing: same gateway IP, same cached MAC, different physical router. The group members are normally the pair of distribution switches or the two routers a site homes into, which is where a two-tier, three-tier, or spine-leaf design places its redundant pair.

HSRP

HSRP elects one active router and one standby router per group, and any remaining members listen. Priority decides the election, higher wins, default 100, with the higher interface IP address breaking a tie. Hellos are sent every 3 seconds and the hold time is 10 seconds.

R1(config)#interface GigabitEthernet0/0/2
R1(config-if)#standby version 2
R1(config-if)#standby 30 ip 10.20.5.1
R1(config-if)#standby 30 priority 150
R1(config-if)#standby 30 preempt

Preemption is disabled by default. Without standby 30 preempt, the highest-priority router will not take the active role away from a router that already holds it; it waits for that router to fail. A design that depends on a specific router being the gateway needs preempt configured on it explicitly.

Virtual MAC addresses differ by version. HSRPv1 supports groups 0 to 255 and builds the address as 0000.0C07.ACxx, xx being the group number in hexadecimal. HSRPv2 supports groups 0 to 4095 and uses 0000.0C9F.Fxxx with three hex digits, so group 200 is 0000.0c9f.f0c8 because 200 decimal is C8 hexadecimal. Version 1 uses multicast 224.0.0.2 and version 2 uses 224.0.0.102, both on UDP port 1985.

Reading group state:

R2# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State    Active          Standby         Virtual IP
Gi0/0/1     20   130 P Standby  10.20.5.2       local           10.20.5.1

The word local marks the role this router holds, so this router is the standby for group 20. The Active column gives the current active router’s real interface address, 10.20.5.2, not a gateway address, and the Virtual IP column, 10.20.5.1, is what hosts point at. P means preempt is configured, which does not imply this router will ever become active.

Interface tracking

A router can hold the active role, answer for the virtual IP, and have no working path upstream. Tracking closes that gap by lowering the local priority when a monitored interface loses its line protocol.

R1(config-if)#standby 30 track GigabitEthernet0/0/1 15

With no decrement value supplied, the default is 10.

The decrement is subtracted from the tracking router’s own priority; it is not added to anyone else’s, and it does not disqualify the router from the active role. A tracked failure changes nothing unless the resulting priority falls strictly below the peer’s and the peer is configured to preempt.

Work an example. R1 has priority 150 with a tracked decrement of 15, and R2 has priority 130 with preempt. R1’s uplink fails and R1 drops to 135, still greater than 130, so R1 stays active and keeps drawing traffic it can no longer forward. The decrement would have to be at least 21 to take R1 to 129 or below.

The same behavior can be expressed with a named tracked object, which one or several groups can reference:

R1(config)#track 6 interface GigabitEthernet0/0/1 line-protocol
R1(config)#interface GigabitEthernet0/0/2
R1(config-if)#standby 30 track 6 decrement 40

The track command is entered in global configuration mode and the standby command under the interface running the group. Reversing those modes is a stock distractor. The same tracked objects are what drive a backup static route that installs only when the primary path is withdrawn.

A related problem appears after a reload. A booting router regains its priority in a second or two and, with preempt set, reclaims the active role well before OSPF or EIGRP has rebuilt its adjacencies and filled the routing table the gateway forwards from. Traffic is drawn to a gateway that cannot route it yet, and users lose roughly half a minute after every reboot. The fix is a preemption delay:

R1(config-if)#standby 5 preempt delay minimum 120

The router now waits two minutes after the group comes up before preempting, which gives the control plane time to converge.

VRRP

VRRP is the IETF standard, so it interoperates between vendors. One router is the master and the others are backups. Default priority is 100, and a router carrying the virtual IP address as a real interface address is the address owner and uses priority 255. Advertisements go out once per second to multicast 224.0.0.18 using IP protocol number 112. The virtual MAC is 0000.5E00.01xx, with xx the group number in hexadecimal.

R1(config-if)#vrrp 10 ip 10.20.6.1
R1(config-if)#vrrp 10 priority 120

Preemption is enabled by default in VRRP, the opposite of HSRP. There is no preempt command to add for normal operation, and disabling it takes an explicit no vrrp 10 preempt.

GLBP

GLBP defines two roles inside one group. GLBP priority elects one active virtual gateway (AVG), the only member that answers ARP requests for the virtual IP address, and it answers them with different virtual MAC addresses for different hosts. Up to four routers act as active virtual forwarders (AVFs), each assigned one of those virtual MAC addresses and each forwarding the traffic sent to it.

That ARP behavior is the entire load-sharing mechanism. Some hosts cache one virtual MAC and others cache another, so their frames land on different physical routers even though every host was given one gateway address by the same DHCP pool’s default-router option. HSRP and VRRP cannot do this inside a single group; the workaround there is two groups with two virtual IPs and hosts split between them by scope. GLBP virtual MACs take the form 0007.B400.xxyy, xx being the group and yy the forwarder number, and hellos go to 224.0.0.102 on UDP port 3222 every 3 seconds with a 10-second hold. Load balancing defaults to round-robin; weighted mode favors routers with higher configured weight, and host-dependent mode always returns the same virtual MAC to a given host.

If an AVF’s uplink dies, the hosts holding that forwarder’s virtual MAC keep framing to it and their packets are discarded, while hosts holding another virtual MAC are unaffected. Priority does not help, because it only decides which router is the AVG. The mechanism that does is weighting combined with object tracking: the tracked failure drops the router’s weight below its configured lower threshold, so it gives up its forwarder role and a surviving router takes over that virtual MAC.

R1(config-if)#glbp 12 weighting 110 lower 95 upper 105
R1(config-if)#glbp 12 weighting track 6 decrement 20

Comparison

Characteristic	HSRP	VRRP	GLBP
Origin	Cisco-proprietary	Open standard, RFC 5798	Cisco-proprietary
Role names	Active and standby	Master and backup	AVG and AVF
Routers forwarding per group	One	One	Up to four
Virtual MAC	0000.0C07.ACxx (v1), 0000.0C9F.Fxxx (v2)	0000.5E00.01xx	0007.B400.xxyy
Default priority	100	100 (255 for the address owner)	100
Preemption default	Disabled	Enabled	Enabled for the AVG role
Timers	Hello 3 s, hold 10 s	Advertisement 1 s	Hello 3 s, hold 10 s
Transport	UDP 1985, 224.0.0.2 or 224.0.0.102	IP protocol 112, 224.0.0.18	UDP 3222, 224.0.0.102
Load sharing within one group	No	No	Yes, per host by ARP reply

How the 200-301 exam tests this

• Requirement to protocol. Both routers must forward for one VLAN with one gateway address and one DHCP scope. The answer is GLBP; two HSRP groups with two virtual IPs breaks the single-scope constraint.
• Tracking arithmetic. Priorities and a decrement are given and you decide whether the role moves. Subtract, compare against the peer, confirm the peer preempts.
• Virtual MAC identification. Convert the group number to hexadecimal and match the prefix, watching for the VRRP prefix and the wrong-version HSRP prefix among the choices.
• Reading show standby brief. local marks this router’s role, Active holds a real interface address, Virtual IP holds the gateway hosts use.
• Post-reload outage. A router reclaims the active role faster than its routing protocol converges. preempt delay minimum is the answer, not faster hellos.
• GLBP forwarder failure. Hosts on one virtual MAC lose connectivity while others are fine. Weighting with object tracking is the fix, not priority.

Three protocols with overlapping vocabulary blur together fast — drill them with practice questions until the defaults separate cleanly.

Quick reference

• Hosts keep one gateway address; the FHRP moves the virtual IP and virtual MAC between routers.
• HSRP: Cisco, active and standby, priority 100, preempt off by default, hello 3 and hold 10.
• HSRPv1 virtual MAC 0000.0C07.ACxx, groups 0 to 255; HSRPv2 0000.0C9F.Fxxx, groups 0 to 4095.
• VRRP: RFC 5798, master and backup, virtual MAC 0000.5E00.01xx, preempt on by default, address owner priority 255.
• GLBP: Cisco, one AVG answers all ARP requests, up to four AVFs forward, round-robin by default.
• standby <grp> track <interface> with no value decrements by 10.
• A decrement causes failover only if the result drops below the peer’s priority and the peer preempts.
• track 6 interface Gi0/0/1 line-protocol is global; standby 30 track 6 decrement 40 is under the interface.
• standby <grp> preempt delay minimum <seconds> stops a rebooted router reclaiming the role too early.
• GLBP recovers a failed uplink with weighting plus object tracking, not priority.