HSRP, VRRP and GLBP: First Hop Redundancy Compared

What is a first hop redundancy protocol?

A first hop redundancy protocol provides a resilient default gateway for hosts on a LAN. Multiple routers share a virtual IP address, so hosts can continue sending traffic if the active gateway or its uplink fails.

A workstation normally has one default gateway address. If that address belongs only to one physical router, the router becomes a single point of failure. HSRP, VRRP and GLBP solve this problem by presenting a logical gateway built from two or more routers.

Diagram in words: Imagine PC1 connected to an access switch. The switch connects to R1 and R2. R1 uses 192.168.10.2, R2 uses 192.168.10.3, and both participate in a redundancy group with virtual IP 192.168.10.1. PC1 uses only 192.168.10.1 as its default gateway.

The routing table on PC1 does not need to change during a gateway failover. The routers coordinate ownership of the virtual IP address and its associated virtual MAC address.

These protocols build on gateway, ARP and switching concepts commonly covered in a CCNA course. At CCNP level, engineers must also understand election rules, object tracking, timer effects and failure analysis.

How do HSRP, VRRP and GLBP differ?

HSRP and VRRP primarily provide active-standby gateway redundancy, while GLBP can also distribute hosts across multiple active forwarders. HSRP and GLBP are Cisco-developed protocols; VRRP is an open standard suitable for multivendor environments.

Platform and software support should always be checked before selecting a protocol. Some current Cisco platforms or software releases may not support every legacy first hop redundancy feature.

How does HSRP work?

HSRP elects one router as active and another as standby for a group. The active router forwards packets sent to the virtual gateway, while the standby router monitors the group and takes over after a failure.

HSRP uses priority to influence the election. The router with the highest priority becomes active; if priorities tie, the higher interface IP address wins. The default priority is 100.

Preemption is disabled by default. Without preemption, a higher-priority router that returns after a failure does not automatically reclaim the active role. The command standby 10 preempt changes this behaviour.

Common HSRP states are Initial, Learn, Listen, Speak, Standby and Active. In a stable two-router group, one router should normally be Active and the other Standby.

HSRP version 2 supports a larger group-number range and uses different multicast and virtual MAC addressing from version 1. All routers in one group must use a compatible HSRP version.

HSRP configuration example

This example uses R1 as the preferred active router and R2 as standby. The commands are applied to the LAN-facing interfaces.

R1:

interface GigabitEthernet0/0
 description LAN gateway
 ip address 192.168.10.2 255.255.255.0
 standby version 2
 standby 10 ip 192.168.10.1
 standby 10 priority 120
 standby 10 preempt

R2:

interface GigabitEthernet0/0
 description LAN gateway
 ip address 192.168.10.3 255.255.255.0
 standby version 2
 standby 10 ip 192.168.10.1
 standby 10 priority 110
 standby 10 preempt

Verify the group with:

R1# show standby brief
                     P indicates configured to preempt.
Interface   Grp Pri P State   Active          Standby         Virtual IP
Gi0/0       10  120 P Active  local           192.168.10.3    192.168.10.1

This illustrative output shows that R1 is active, preemption is configured, and R2 is recognised as the standby router.

How does VRRP work?

VRRP creates a virtual router with one master and one or more backups. The master forwards gateway traffic and sends advertisements; a backup becomes master if advertisements stop arriving.

VRRP is standardised, making it the usual choice when gateway devices from different vendors must participate in the same redundancy group. IPv4 VRRP advertisements use multicast address 224.0.0.18 and IP protocol number 112.

The highest priority wins the master election. Priority 255 has a special meaning: it identifies a router that owns the configured virtual IP address as a real interface address. Priority 0 is used by a master to indicate that it is giving up responsibility.

Preemption is enabled by default in Cisco IOS VRRP implementations. It can be configured explicitly when documenting the intended design.

VRRP configuration example

Do not configure this VRRP example at the same time as the HSRP example for the same virtual gateway. Treat it as an alternative design.

R1:

interface GigabitEthernet0/0
 ip address 192.168.10.2 255.255.255.0
 vrrp 10 ip 192.168.10.1
 vrrp 10 priority 120
 vrrp 10 preempt

R2:

interface GigabitEthernet0/0
 ip address 192.168.10.3 255.255.255.0
 vrrp 10 ip 192.168.10.1
 vrrp 10 priority 110
 vrrp 10 preempt

Use these commands to verify the state:

show vrrp brief
show vrrp interface GigabitEthernet0/0

A healthy result should show R1 as Master, R2 as Backup and the same virtual IP, group number and advertisement interval on both devices.

How does GLBP provide load balancing?

GLBP separates gateway election from packet forwarding. One router becomes the Active Virtual Gateway, or AVG, while one or more routers become Active Virtual Forwarders, allowing different hosts to use different virtual MAC addresses.

Hosts still configure one virtual IP address. When clients send ARP requests for that IP, the AVG can reply with different virtual MAC addresses. Traffic from the clients is then distributed among the AVFs.

Diagram in words: PC1 and PC2 both use 192.168.10.1. The AVG answers PC1 with virtual MAC A and PC2 with virtual MAC B. R1 forwards frames sent to MAC A, while R2 forwards frames sent to MAC B.

GLBP supports these load-balancing methods:

GLBP distributes hosts, not individual packets in one flow. Existing ARP entries also affect how quickly traffic distribution changes.

GLBP configuration example

R1:

interface GigabitEthernet0/0
 ip address 192.168.10.2 255.255.255.0
 glbp 10 ip 192.168.10.1
 glbp 10 priority 120
 glbp 10 preempt
 glbp 10 load-balancing round-robin

R2:

interface GigabitEthernet0/0
 ip address 192.168.10.3 255.255.255.0
 glbp 10 ip 192.168.10.1
 glbp 10 priority 110
 glbp 10 preempt
 glbp 10 load-balancing round-robin

Verify the AVG and AVF roles with:

show glbp brief
show glbp 10

Do not assume that both routers will carry exactly half the traffic. Client count, ARP caching, flow size and the selected load-balancing method affect actual utilisation.

Why is interface or object tracking important?

Tracking allows a router to reduce its redundancy priority or GLBP weighting when another resource fails. Without tracking, a router can remain the active gateway even when its WAN uplink is unavailable, causing a traffic black hole.

Consider R1 with a working LAN interface but a failed uplink on GigabitEthernet0/1. HSRP hellos on the LAN continue, so R1 remains active unless the uplink is tracked.

Create an interface tracking object:

track 10 interface GigabitEthernet0/1 line-protocol

Apply it to HSRP on R1:

interface GigabitEthernet0/0
 standby 10 track 10 decrement 30

R1 starts with priority 120. If the tracked uplink fails, its effective priority falls to 90. R2, with priority 110, can then become active because preemption is configured.

A similar VRRP configuration is:

interface GigabitEthernet0/0
 vrrp 10 track 10 decrement 30

For GLBP, weighting can control whether a router remains an active forwarder:

interface GigabitEthernet0/0
 glbp 10 weighting 100 lower 80 upper 90
 glbp 10 weighting track 10 decrement 30

When the weighting falls below the lower threshold, the router gives up its forwarding role. It can resume after the weighting rises above the upper threshold. Exact tracking capabilities depend on the Cisco IOS or IOS XE platform.

For deeper enterprise routing labs involving gateway resilience, route control and troubleshooting, see the CCNP Enterprise course. The CCNP ENARSI practical study order also helps place redundancy testing alongside routing and path-selection topics.

How should HSRP, VRRP and GLBP be troubleshot?

Start by verifying Layer 1, VLAN membership and IP addressing, then compare the group configuration on every router. Most failures are caused by mismatched virtual IPs, versions, group numbers, timers, authentication settings or blocked protocol messages.

1. Confirm interface and VLAN status

show ip interface brief
show interfaces GigabitEthernet0/0
show vlan brief
show interfaces trunk

Both gateway interfaces must be operational and connected to the same Layer 2 broadcast domain. On multilayer switches, also verify that routed ports or switched virtual interfaces are configured as intended.

2. Check protocol state

show standby brief
show vrrp brief
show glbp brief

Look for the expected Active/Standby, Master/Backup or AVG/AVF roles. An unknown peer often indicates a Layer 2 problem, a protocol mismatch or filtered control traffic.

3. Compare critical parameters

Check the following on both routers:

• Protocol and version
• Group number
• Virtual IP address
• Subnet mask and local interface subnet
• Priority and preemption
• Hello, hold or advertisement timers
• Authentication configuration, if used
• Tracking objects and decrement values

Use these commands to inspect the running configuration:

show running-config interface GigabitEthernet0/0
show track
show ip arp 192.168.10.1

4. Investigate dual-active symptoms

If both HSRP routers report Active, or multiple VRRP routers report Master, they are probably not receiving each other's control messages. Check for a VLAN split, access control filtering, storm-control effects, an incorrect HSRP version or an intermediate device that does not pass the required multicast traffic.

Debugging can be useful in a controlled lab:

debug standby terse
debug vrrp events
debug glbp events

Disable debugging after the test:

undebug all

Use debug commands carefully on production systems because output volume can affect device operation.

5. Test a real failure

Run a continuous ping from a client to an external destination, then shut the active router's tracked uplink:

interface GigabitEthernet0/1
 shutdown

Confirm the tracking state and gateway transition. Restore the link with no shutdown, observe whether preemption occurs, and record any packet loss. Test device failure, uplink failure and downstream path failure separately because they do not produce identical results.

Which protocol should you choose?

Choose HSRP for straightforward Cisco active-standby gateway redundancy, VRRP for standards-based or multivendor designs, and GLBP when supported Cisco devices need gateway redundancy with host-level load distribution. The final choice must also consider platform support, operational standards and design simplicity.

In many networks, routing designs such as equal-cost paths, switch stacks, virtual chassis systems or chassis-level redundancy may change the need for a traditional first hop redundancy protocol. Evaluate the complete campus design rather than selecting a protocol in isolation.

Summary

HSRP, VRRP and GLBP protect hosts from a single default-gateway failure by using a virtual IP address. HSRP uses active and standby roles, VRRP uses master and backup roles, and GLBP adds multiple active virtual forwarders.

Priority, preemption and tracking determine how failover behaves. A complete lab should verify not only router election but also client ARP behaviour, uplink failure, recovery and end-to-end traffic forwarding.

Frequently asked questions

Can HSRP, VRRP and GLBP be configured together?

They can exist on the same device when the platform supports them, but they should not claim the same virtual IP on the same LAN. In a comparison lab, configure and test one protocol at a time to avoid duplicate gateway ownership.

Does HSRP load balance traffic?

A single HSRP group is active-standby and does not natively share forwarding between both routers. Load sharing can be designed with multiple HSRP groups and different active routers, but that requires separate gateway assignments or VLAN-level planning.

Is VRRP better than HSRP?

Neither protocol is universally better. VRRP is useful for standards-based and multivendor designs, while HSRP is widely used in Cisco environments and offers familiar Cisco operational tools.

Does GLBP balance every packet?

No. GLBP gives different virtual MAC addresses to hosts, so it distributes client forwarding responsibilities rather than balancing every packet in a flow. Unequal client traffic can therefore produce unequal link utilisation.

What happens if the active gateway loses only its WAN link?

The gateway may remain active if its LAN interface and redundancy messages are still working. Configure interface or object tracking so the router lowers its priority or weighting and allows a router with a working path to take over.

Why is preemption required in an HSRP design?

Preemption allows a higher-priority HSRP router to become active when it joins or recovers. Without it, the current active router can keep the role even if another router has a higher configured priority.

To practise FHRP configuration, object tracking and structured failover testing, enquire about lab access and upcoming batches for the CCNP Enterprise course.

*Reviewed by Network Rhinos networking trainers.*

Related reading: CCNP Interview Questions on BGP and Route Redistribution