23 First Hop Redundancy Protocols · CCNA

Exam topics covered

3.5 Describe the purpose, functions, and concepts of first hop redundancy protocols

Foundation. Routers can reroute around a failure in seconds using OSPF, but hosts cannot. A PC knows exactly one default gateway address, usually learned from DHCP, and if the router that owns that address fails, the PC is cut off even though a second router sits on the same subnet. First hop redundancy protocols (FHRPs) solve this by letting two or more routers share a virtual gateway address. This chapter explains the problem, then covers HSRP in depth (states, priority, preemption, timers, groups and load sharing), compares it with VRRP and GLBP, and shows the configuration and verification output you need to recognise. The CCNA blueprint asks you to describe FHRPs, so focus on concepts and on reading show standby output.

23.1 The Default Gateway as a Single Point of Failure

In Figure 23-1, a building's users are in VLAN 10 (10.1.10.0/24). The network designer installed two routers, R1 and R2, each with its own path to the core. Every PC, however, is configured with default gateway 10.1.10.2, which is R1's address. When R1 fails, R2 is still up and still has a route to everywhere, but no PC will send it traffic: they keep ARPing for 10.1.10.2 and getting no answer.

Core / WAN
R1 (failed)
10.1.10.2
R2 (up)
10.1.10.3

Sw1 vlan 10

Figure 23-1 Two routers, but one gateway address: when R1 fails, hosts cannot use R2.

Reconfiguring every host by hand is not an option, and DHCP hands out only one default gateway per scope. What is needed is a gateway address that is not tied to one physical router. That is exactly what an FHRP provides.

23.2 How FHRPs Work

All three FHRPs on the exam (HSRP, VRRP and GLBP) use the same core idea, shown in Figure 23-2:

The routers are configured with their own real interface addresses (10.1.10.2 and 10.1.10.3) and a shared virtual IP address (10.1.10.1). Hosts use the virtual IP as their default gateway.

The group also has a virtual MAC address. When a host ARPs for the virtual IP, the router currently in charge replies with the virtual MAC.

One router is active (it forwards traffic sent to the virtual MAC); another is standby, monitoring the active router by exchanging hello messages.

If hellos stop, the standby router takes over the virtual IP and MAC and sends a gratuitous ARP so that switches update their MAC address tables to point to the new active router's port.

Figure 23-2 An FHRP presents one virtual router to hosts; the active physical router answers for it.

Because the hosts only ever see the virtual IP and MAC, a failover is invisible to them: their ARP cache stays valid, and traffic simply arrives at a different physical router. A few seconds of loss during the switchover is typical.

Exam alert

Hosts are configured with the virtual IP address as their default gateway, never with either router's real address. The real addresses are still needed: the routers use them to exchange hellos.

23.3 Hot Standby Router Protocol (HSRP)

HSRP is Cisco-proprietary and is the default FHRP on most Cisco routers and Layer 3 switches. Routers in an HSRP group exchange hello messages over UDP port 1985. Two versions exist, and the version must match within a group.

Table 23-1 HSRP version 1 and version 2

Default Yes, on most IOS releases Enabled with standby version 2 23.3.1 Active and standby election

Within a group, one router becomes active and one becomes standby; any others remain in the listen state. The router with the highest priority (0–255, default 100) becomes active. If priorities tie, the highest real interface IP address wins. The standby router is the next best, and it is the only one that takes over if the active router fails.

Table 23-2 HSRP states

State Meaning
Initial /
Learn

HSRP starting; the router has not yet learned the virtual IP or heard the active router.

Listen Knows the virtual IP; neither active nor standby, just listening to hellos. Speak Sending hellos and taking part in the active/standby election.

Standby Next in line; monitors the active router.

Active Owns the virtual IP and MAC and forwards packets for the group.

23.3.2 Preemption

By default HSRP is not preemptive. If R1 (priority 110) fails, R2 becomes active; when R1 returns, it stays standby even though its priority is higher. That avoids an extra disruption but may leave traffic on a less preferred path. The command standby group preempt lets a higher-priority router take the active role back as soon as it is ready. Preemption is usually configured, together with interface tracking ( standby group track ), which lowers a router's priority when its uplink fails so the other router can preempt.

23.3.3 Hello and hold timers

The active and standby routers send hellos every 3 seconds by default. If the standby router hears nothing for the hold time, 10 seconds by default, it declares the active router dead and takes over. Both values can be tuned with standby group timers hello hold , down to milliseconds with the msec keyword, for sub-second failover. Figure 23-3 shows the sequence of a failover.

R1 (active) SW1 R2 (standby)
Hello (every 3 s)
fails

no hellos ...

hold timer (10 s) expires
R2 → Speak → Active
Gratuitous ARP: 10.1.10.1 is at 0000.0c9f.f00a
SW1 relearns the virtual MAC on R2's port;
hosts keep the same gateway IP and MAC

Figure 23-3 HSRP failover: the standby router waits for the hold time, becomes active, and announces the virtual MAC with a gratuitous ARP.

23.3.4 Groups and load sharing across VLANs

An HSRP group exists per interface (or subinterface or SVI) and is identified by a group number. A single group has only one active router, so in a one-VLAN design the standby router carries no user traffic. With several VLANs, you can balance the load by making each router active for different groups. In Figure 23-4, R1 is active for VLAN 10 and R2 is active for VLAN 20; each backs up the other. The group number is only locally meaningful to the segment, but matching it to the VLAN ID is a common, readable convention.

Figure 23-4 Load sharing with two HSRP groups: each router is active for one VLAN and standby for the other.

23.4 Configuring and Verifying HSRP

The following configuration builds Figure 23-4 on router-on-a-stick subinterfaces. Every HSRP command starts with standby and the group number, entered on the interface facing the hosts.

! R1

R1(config)# interface GigabitEthernet0/0.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 10.1.10.2 255.255.255.0
R1(config-subif)# standby version 2
R1(config-subif)# standby 10 ip 10.1.10.1 ! virtual IP
R1(config-subif)# standby 10 priority 110
R1(config-subif)# standby 10 preempt
R1(config-subif)# interface GigabitEthernet0/0.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 10.1.20.2 255.255.255.0
R1(config-subif)# standby version 2
R1(config-subif)# standby 20 ip 10.1.20.1
R1(config-subif)# standby 20 preempt ! priority stays 100

! R2 mirrors this with addresses .3, priority 110 on group 20, default on group 10 Only one router strictly needs the standby 10 ip command with the address; others can learn the virtual IP from hellos. Configuring it on both is safer and clearer. Verify with show standby brief , which gives a one-line summary per group.

R1 — console

R1# show standby brief

P indicates configured to preempt.

|
Interface Grp Pri P State Active Standby Virtual IP
Gi0/0.10 10 110 P Active local 10.1.10.3 10.1.10.1
Gi0/0.20 20 100 P Standby 10.1.20.3 local 10.1.20.1

Figure 23-5 show standby brief on R1: active for group 10, standby for group 20. Output is illustrative of IOS 15/IOS XE.

For full detail, including the virtual MAC, timers and the partner router's priority, use show standby :

R1 — console

R1# show standby GigabitEthernet0/0.10

GigabitEthernet0/0.10 - Group 10 (version 2)
State is Active
2 state changes, last state change 00:14:07
Virtual IP address is 10.1.10.1
Active virtual MAC address is 0000.0c9f.f00a (MAC In Use)
Local virtual MAC address is 0000.0c9f.f00a (v2 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 1.264 secs
Preemption enabled
Active router is local

Standby router is 10.1.10.3, priority 100 (expires in 9.872 sec)

Priority 110 (configured 110)

Group name is "hsrp-Gi0/0.10-10" (default)

Figure 23-6 show standby detail for group 10. Group 10 in hex is 00A, giving the v2 MAC 0000.0c9f.f00a.

Tip

You can work out the group number from a virtual MAC. HSRPv1 0000.0c07.ac14 is group 0x14 = 20. HSRPv2 0000.0c9f.f064 is group 0x064 = 100.

23.5 VRRP and GLBP

VRRP (Virtual Router Redundancy Protocol) is the IETF open standard (RFC 5798 for VRRPv3), so it is the choice in multivendor networks. It works like HSRP with different names: one master router and one or more backup routers. Priority defaults to 100 with the highest winning, but preemption is enabled by default, and VRRP may even use one router's real interface address as the virtual IP (that router, the address owner, gets priority 255). Advertisements go to 224.0.0.18 every second.

GLBP (Gateway Load Balancing Protocol) is Cisco-proprietary and adds load balancing within a single group. One router is elected active virtual gateway (AVG); it assigns a different virtual MAC to each of up to four active virtual forwarders (AVFs). When hosts ARP for the single virtual IP, the AVG answers each with a different AVF's MAC (round-robin by default), so hosts in one VLAN spread across all routers.

Table 23-3 Comparing FHRPs

Feature HSRP VRRP GLBP

Standard Cisco proprietary IETF open standard Cisco proprietary Roles Active / Standby Master / Backup AVG / AVF (up to

4)

Load balancing Per group (per VLAN) Per group (per VLAN) Within one group Default priority 100 100 (255 for address

Multicast 224.0.0.2 (v1), 224.0.0.102 (v2) 224.0.0.18 224.0.0.102 Virtual MAC 0000.0C07.ACxx (v1),

0000.0C9F.Fxxx (v2)

0000.5E00.01xx 0007.B400.xxyy

Exam alert

Know which protocol is open (VRRP) and which balances load across routers in a single group (GLBP). Also remember the terms: HSRP active/standby, VRRP master/backup, GLBP

Avg/avf.

LAB HSRP Load Sharing and Failover

Goal: Build Figure 23-4 so that R1 is active for VLAN 10 and R2 for VLAN 20, then prove that each router takes over when the other fails and gives the role back afterwards. Steps:

1. On SW1, create VLANs 10 and 20, trunk the ports to R1 and R2, and put one PC in each VLAN with gateway 10.1.10.1 or 10.1.20.1.
2. Configure R1 as in Section 23.4. On R2, use addresses 10.1.10.3 and 10.1.20.3, standby version 2 , the same virtual IPs, standby 20 priority 110 , and preempt on both groups.
3. Check show standby brief on both routers. Start ping 8.8.8.8 -t (or a continuous ping to a core address) from the VLAN 10 PC.
4. Shut R1's G0/0. Watch R2's console, then re-enable G0/0 and watch R1 preempt. Verify:

R2 — console

%HSRP-5-STATECHANGE: GigabitEthernet0/0.10 Grp 10 state Standby -> Active

R2# show standby brief

P indicates configured to preempt.

|
Interface Grp Pri P State Active Standby Virtual IP
Gi0/0.10 10 100 P Active local unknown 10.1.10.1
Gi0/0.20 20 110 P Active local unknown 10.1.20.1

! ... R1 G0/0 re-enabled ...

%HSRP-5-STATECHANGE: GigabitEthernet0/0.10 Grp 10 state Active -> Speak %HSRP-5-STATECHANGE: GigabitEthernet0/0.10 Grp 10 state Speak -> Standby

Figure 23-7 R2 takes over group 10 when R1 fails (standby shows "unknown"), then yields to R1 when it returns and preempts.

Expected results: The continuous ping loses only a few replies (up to the 10-second hold time) during failover, and none when R1 preempts gracefully. Without preempt on R1, R2 would stay active for group 10 after R1 recovers.

Hsrp

Vrrp

master / backup

Glbp

Avg

Avf

interface tracking

Review questions

1. What problem do first hop redundancy protocols solve?

A. Routing loops between redundant routers
B. Loss of off-subnet connectivity for hosts when their single default gateway fails
C. Slow OSPF convergence
D. Duplicate IP addresses assigned by DHCP

2. Which address should hosts use as their default gateway in an HSRP design?

A. The active router's interface IP
B. The standby router's interface IP
C. The virtual IP address
D. The HSRP multicast address

3. Two HSRP routers have default settings. R1 is 10.1.1.2 and R2 is 10.1.1.3. Which is active?

A. R1, lower IP address
B. R2, higher IP address
C. Whichever has the higher router ID
D. Both forward traffic

4. What is the default HSRP priority?

A. 0
B. 1
C. 100
D. 255

5. R1 (priority 120) was the active router, failed, and has just recovered. R2 (priority 100) is active. Preemption is not configured. What happens?

A. R1 becomes active immediately.
B. R1 becomes active after the hold time.
C. R2 stays active; R1 becomes standby.
D. Both routers become active.

6. Which virtual MAC address does HSRPv1 group 5 use?

A. 0000.0c07.ac05
B. 0000.0c9f.f005
C. 0000.5e00.0105
D. 0007.b400.0501

7. Which two statements describe HSRPv2 compared with v1? (Choose two.)

A. Supports group numbers up to 4095
B. Uses multicast 224.0.0.18
C. Supports IPv6
D. Is an IETF standard
E. Uses hello time 1 second by default

8. After a failover, how do switches learn that the virtual MAC is now reachable through the new active router?

A. The new active router sends a gratuitous ARP.
B. Hosts flush their ARP caches.
C. STP recalculates.
D. The switch receives a CDP update.

9. What are the default HSRP hello and hold timers?

A. 1 s and 3 s
B. 3 s and 10 s
C. 10 s and 40 s
D. 5 s and 15 s

10. Which FHRP is an open standard?

A. HSRP
B. GLBP
C. VRRP
D. CARP

11. Which two statements about GLBP are true? (Choose two.)

A. The AVG assigns virtual MACs to forwarders.
B. It is an IETF standard.
C. Multiple routers forward traffic for a single group.
D. It supports only one forwarding router per group.
E. Its routers are called master and backup.

12. A network has VLANs 10 and 20 with two routers running HSRP. How can both routers forward user traffic at the same time?

A. Configure the same priority on both routers.
B. Make one router active for the VLAN 10 group and the other active for the VLAN 20 group.
C. Disable preemption.
D. Use the same virtual IP address in both VLANs.

Answers

1. B. Hosts have one gateway address; FHRPs make that address survive a router failure.
2. C. Hosts point to the virtual IP, which moves between routers.
3. B. With equal (default 100) priorities, the highest interface IP wins.
4. C. HSRP priority defaults to 100, range 0–255.
5. C. HSRP is non-preemptive by default, so R2 keeps the active role.
6. A. HSRPv1 MACs are 0000.0c07.acXX with the group in hex (05). B is the v2 format; C is VRRP; D is GLBP.
7. A, C. HSRPv2 extends groups to 4095 and supports IPv6. It uses 224.0.0.102; 224.0.0.18 is

Vrrp.

8. A. The gratuitous ARP from the new active router updates switch MAC tables.
9. B. HSRP defaults are a 3-second hello and 10-second hold time.
10. C. VRRP is defined by the IETF (RFC 5798). HSRP and GLBP are Cisco-proprietary.
11. A, C. The AVG hands out AVF MACs so several routers forward for one group. GLBP is Cisco-proprietary.
12. B. Load sharing in HSRP is done per group, typically one group per VLAN with different active routers.