What Is FHRP in Networking?
On This Page
Quick Definition
FHRP stands for First Hop Redundancy Protocol. It is a set of protocols that let multiple routers work together to act as a single default gateway for devices on a network. If one router fails, another automatically takes over, so the devices never lose their connection to other networks. This keeps the network running without disruption.
Commonly Confused With
HSRP is Cisco proprietary, uses an active/standby model, and the virtual IP must be different from the physical IPs. VRRP is an open standard RFC, also active/standby, but it allows the virtual IP to match the physical IP of the master router. VRRP uses a different multicast address and protocol number. HSRP has a standby router that does nothing, while VRRP allows the backup router to also forward traffic if it owns the virtual IP.
If you see a configuration with router A IP 10.0.0.1 and virtual IP 10.0.0.10, it is likely HSRP. If the virtual IP equals the physical IP of router A, it is more likely VRRP.
FHRP is primarily about redundancy and automatic failover, not about distributing traffic across multiple routers. While GLBP does provide some load balancing, the core purpose of FHRP is high availability. Load balancing protocols like ECMP or LACP distribute traffic to increase throughput. FHRP ensures that if one gateway path fails, another takes over seamlessly.
FHRP is like having a spare car in your garage that you only use if your main car breaks down. Load balancing is like using both cars at the same time to carry more passengers.
Dynamic routing protocols (OSPF, EIGRP) learn and advertise routes to remote networks, ensuring that routers know the best path to destinations. FHRP provides a redundant default gateway for hosts on a local subnet. They work at different layers. FHRP does not replace dynamic routing; it complements it. The routers in an FHRP group still need a routing protocol to know how to reach the rest of the network.
Think of FHRP as making sure the door to your house always works. Dynamic routing is like making sure you have a map to get from your house to the grocery store. You need both.
Must Know for Exams
FHRP is a core topic for the Cisco CCNA certification. It appears in the exam blueprint under the Network Access and IP Connectivity sections. The CCNA exam expects candidates to understand the purpose of FHRP, to compare the different protocols (HSRP, VRRP, GLBP), and to be able to interpret configuration outputs. It is classified as a primary objective because it tests foundational knowledge of redundancy, high availability, and Layer 3 operations.
CCNA exam questions about FHRP often require you to know the specific features of each protocol. For example, you need to remember that HSRP uses an active/standby model with a virtual IP address different from the physical IP addresses of the routers. You also need to know that VRRP allows the physical IP of a router to be used as the virtual IP. The exam may ask about priority values, hello timers, preemption, and how failover occurs. There are also questions about which multicast address each protocol uses and which protocols are proprietary versus open standard.
Troubleshooting questions are common. You might be shown the output of a command like show standby or show vrrp and asked to identify why a router is not becoming active. You may also be given a scenario where two routers are configured for HSRP but the standby router never takes over, and you must identify the misconfiguration. Understanding the interaction between FHRP and spanning tree, as well as the use of interface tracking, is also important. The CCNA exam will test your ability to apply FHRP concepts to real network designs, not just memorize facts. Knowing FHRP well will help you answer at least 3 to 5 questions correctly on the exam, and it is a topic that often appears in simulation or lab-style questions.
Simple Meaning
Imagine a busy office building with only one front door. Everyone who works in the building uses that door to go in and out. If the door jams or gets blocked, nobody can leave or enter. They are stuck. That is what happens on a network when the only router that acts as the default gateway fails. Every device that needs to reach the internet or another network loses its connection.
FHRP fixes this problem by setting up two or more routers that pretend to be the same front door. The devices in the network do not need to know that there is more than one router. They just send their traffic to one virtual router address. Behind the scenes, one of the routers is active and forwards the traffic. The other routers stand by, ready to jump in if the active one fails. This all happens automatically and very quickly, usually in a few seconds.
Think of it like having two doors side by side, but they look like one big door from the outside. When one door fails, the other opens without anyone inside noticing. The people (the network devices) keep moving in and out as if nothing changed. FHRP is not itself a single protocol. It is a category that includes several different protocols such as HSRP, VRRP, and GLBP. Each one achieves the same goal but in slightly different ways. They all share the core idea of multiple routers sharing a virtual IP address and a virtual MAC address so that hosts see a single, reliable gateway.
Full Technical Definition
First Hop Redundancy Protocol (FHRP) is a network mechanism that eliminates a single point of failure at the default gateway layer of a local area network. In a standard IP subnet, each host is configured with a default gateway IP address. This gateway is typically a single router interface. If that router fails or its interface goes down, all hosts on that subnet lose connectivity to other subnets and the internet until the gateway is manually reconfigured or a dynamic routing protocol converges. FHRP solves this by allowing two or more routers to share a virtual IP address and a virtual MAC address, presenting themselves as a single virtual router to the hosts.
A standby group is formed between the participating routers. One router is elected as the active router and performs packet forwarding for the virtual IP address. The other routers in the group act as standby routers, monitoring the active router's health via periodic hello messages sent over the LAN. If the standby router stops receiving hello messages from the active router, it initiates a failover process and assumes the role of the active router. The transition occurs within a few seconds, and hosts remain unaware of the change because the virtual IP and MAC addresses remain the same.
The three most common FHRP implementations are Hot Standby Router Protocol (HSRP), Virtual Router Redundancy Protocol (VRRP), and Gateway Load Balancing Protocol (GLBP). HSRP is a Cisco proprietary protocol that uses an active/standby model with a single virtual IP address. Routers in an HSRP group elect an active and a standby router, and hello messages are sent every 3 seconds by default to the multicast address 224.0.0.2 with UDP port 1985. VRRP is an open standard defined in RFC 5798 that functions similarly but allows the physical IP address of a router to be used as the virtual IP address. VRRP uses the multicast address 224.0.0.18 and IP protocol 112. GLBP is another Cisco proprietary protocol that provides load balancing among multiple routers in addition to redundancy. GLBP allows up to four routers to forward traffic simultaneously by assigning multiple virtual MAC addresses to the same virtual IP address. FHRP operates at Layer 3 but relies on Layer 2 communication for hello messaging and MAC address resolution. It is critical for network high availability and is often deployed at the distribution layer in campus networks, on WAN edges, and in data center topologies.
Real-Life Example
Think about a long bridge that connects an island to the mainland. Every day, thousands of cars drive over that bridge to get to work, school, and stores. The bridge is the only way off the island. It is the default path for everyone. Now imagine one morning a truck hits the bridge and it collapses. Every single person on the island is trapped. They cannot get to the mainland until the bridge is repaired, which could take days or weeks.
FHRP is like building a second bridge next to the first one. But the two bridges are designed so that from the mainland side, they look like a single, wide bridge. All the cars drive onto what they think is one bridge, but the traffic is actually being split or directed to one of the two physical bridges. If the first bridge collapses, the second bridge immediately takes over. The cars in line do not even see the collapse. They just keep driving and suddenly they are using the second bridge without any delay.
In this analogy, the island is your local network. The mainland is the internet or another network. Each car is a data packet. The drivers (hosts) only know one address for the mainland, which is the virtual bridge entrance. The two physical bridges are the two routers running FHRP. The collapse of one bridge is the router failure. The second bridge that automatically takes over is the standby router. The people on the island never experience a traffic jam because the switch to the second bridge is seamless. FHRP gives network devices the same kind of invisible, reliable access to the rest of the network.
Why This Term Matters
FHRP matters because almost every network depends on a default gateway for communication beyond the local subnet. In a small office, a single router might be acceptable because a failure means only a few people lose access, and manual intervention is possible. But in a large enterprise, a campus, a hospital, or a data center, the loss of a default gateway affects hundreds or thousands of users and critical services. Downtime translates directly to lost productivity, lost revenue, and even safety risks.
FHRP provides automatic failover without requiring any changes to host configurations. Hosts keep the same default gateway IP address, so there is no need to reconfigure every device on the LAN. This is especially important in environments where devices are statically configured or where DHCP lease times are long. FHRP also works alongside dynamic routing protocols. The routers participating in the FHRP group can still run OSPF or EIGRP to exchange routing information with the rest of the network, ensuring that the virtual gateway knows how to reach remote networks.
In practical IT operations, FHRP is a fundamental building block for network high availability. It is commonly used in virtualized environments where multiple hypervisors need a resilient gateway. It is also used in branch office deployments where two WAN routers provide backup internet links. Without FHRP, network engineers would have to rely on manual failover scripts or host-level gateway monitoring techniques, which are slower and more error-prone. FHRP automates the process and reduces the Mean Time To Repair (MTTR) for a gateway failure from minutes or hours to seconds. For any network that requires reliability, FHRP is not optional; it is a core requirement.
How It Appears in Exam Questions
FHRP questions on the CCNA exam come in several distinct patterns. One common type is the direct knowledge question, where the exam asks something like 'Which FHRP protocol is Cisco proprietary and uses an active/standby model?' The answer choices might include HSRP, VRRP, GLBP, and others. These questions test your recall of protocol characteristics. Another pattern involves comparing protocols. You might be asked 'Which two features distinguish VRRP from HSRP?' This type forces you to recall specific differences such as the use of the physical IP address as the virtual IP in VRRP or the multicast address used.
The most challenging question style is the scenario-based troubleshooting question. For example, you are told that two routers R1 and R2 are configured for HSRP. The virtual IP is 192.168.1.1. The network has hosts with that default gateway. After a power outage, R2 fails and R1 does not take over. You are given partial configuration outputs and must identify the problem. The issue could be that preempt is not enabled on R1, or that the priority of R1 is lower than R2, or that the interface tracking is causing R1 to decrement its priority below the standby threshold. You need to read the output of show standby and interpret the priority values and the standby state.
Another question pattern involves configuration fragments. A question might present a line like standby 1 ip 192.168.1.1 and ask what it does. Or it might show a full configuration and ask you to identify the active router based on priority numbers. There are also questions about interface tracking, such as 'What is the purpose of the standby 1 track interface serial 0/0/0 command?' The answer is that it monitors the WAN uplink and decrements the HSRP priority if the uplink fails, triggering a failover to the other router. GLBP questions often focus on load balancing and the concept of multiple virtual MAC addresses. You should also be prepared to see questions that combine FHRP with VLANs or trunking, where the FHRP group is configured on a subinterface. All these question types require both conceptual understanding and the ability to read and interpret router output.
Practise FHRP Questions
Test your understanding with exam-style practice questions.
Example Scenario
A small business, ABC Ltd, has two routers connected to their internal LAN. Router A and Router B both connect to the same switch and share the same subnet 192.168.10.0/24. The company has 50 computers and a server. All devices are configured with the default gateway 192.168.10.1. The network administrator wants to ensure that if Router A fails, Router B will automatically take over without changing any device settings.
The administrator decides to configure HSRP. On Router A, they set the HSRP group number to 1, the virtual IP address to 192.168.10.1, and the priority to 150. On Router B, they set the same virtual IP address, but the priority to 100. They also enable preempt on both routers. After the configuration, Router A becomes the active router because it has the higher priority. Router B becomes the standby router. When a user types an internet address, the packet goes to 192.168.10.1. The switch sends the frame to Router A because Router A holds the virtual MAC address.
One day, Router A suffers a hardware failure and stops sending HSRP hello messages. Router B waits for three hello intervals (about 10 seconds by default) and then assumes the active role. Router B begins responding to ARP requests for 192.168.10.1 and forwards traffic for the hosts. The users might experience a brief pause, but their connections resume automatically. The administrator later replaces Router A, and when Router A comes back online, it sends hello messages with its higher priority. Because preempt is enabled, Router A immediately takes back the active role. The network continues to run smoothly with no manual intervention required.
Common Mistakes
Thinking that FHRP load balances traffic across all routers equally by default.
HSRP and VRRP use an active/standby model where only one router forwards traffic at a time. The standby router does not forward any traffic unless it becomes active. Only GLBP and some advanced HSRP configurations with multiple groups can provide load balancing.
Always check which FHRP protocol is being used. If load balancing is needed, use GLBP or configure multiple HSRP groups on different VLANs.
Configuring the virtual IP address as the same as the physical IP address of one of the routers in HSRP.
In HSRP, the virtual IP address must be different from the physical interface IP addresses of the participating routers. VRRP allows the physical IP to be used as the virtual IP, but HSRP does not. If you do this, HSRP will not form correctly and may cause IP address conflicts.
Assign a unique virtual IP address that is not used by any physical interface on the routers. The virtual IP should belong to the same subnet as the physical interfaces.
Forgetting to enable preempt on both routers, causing the active router to never return after it recovers.
Without preempt, if the active router fails and the standby takes over, the original active router will not reclaim the active role when it comes back online. This can lead to suboptimal forwarding if the original router had a higher priority or better path to the rest of the network.
Always enable the preempt command on all routers in the FHRP group to ensure that the router with the highest priority is always the active router after any failover event.
Assuming that FHRP works across a router's WAN link or that it requires Layer 3 connectivity between the routers.
FHRP operates over a single LAN segment. The routers must be connected to the same Layer 2 broadcast domain. They communicate using multicast packets that are confined to the local VLAN. FHRP does not work over routed links or across a WAN without special tunneling techniques.
Ensure that both routers participating in the FHRP group are connected to the same VLAN and have Layer 2 adjacency. Do not try to configure FHRP between routers connected by a serial point-to-point link.
Exam Trap — Don't Get Fooled
{"trap":"The exam question states that an HSRP active router fails, and the standby router takes over. Then the original router comes back online. The question asks what happens to the active role.
Many learners choose the answer that says the original router becomes active again immediately because of the priority.","why_learners_choose_it":"They remember that HSRP uses priority to elect the active router. They assume that when a router with a higher priority comes back online, it automatically takes over.
However, they forget that priority only determines the initial election. Without the preempt command, the higher priority router does not reclaim the active role after a failover.","how_to_avoid_it":"Always link the concept of priority and preemption.
Remember that priority is used to choose the active router only during the initial election or after a preemption event. If preempt is not configured, the active router stays active until it fails, regardless of priority. Look for the preempt keyword in the configuration output or question details."
Step-by-Step Breakdown
Election of Active Router
When FHRP is configured on multiple routers, they exchange hello messages. Each router has a priority value (default 100, can be set higher). The router with the highest priority becomes the active router. If priorities are equal, the router with the highest IP address wins. This election determines which router will forward traffic for the virtual IP address.
Virtual IP and MAC Address Assignment
The active router takes ownership of the virtual IP address and the virtual MAC address. The virtual MAC address is a specific address format (like 0000.0c07.acXX for HSRP) that the standby router uses to identify the group. The active router responds to ARP requests for the virtual IP with the virtual MAC. Hosts cache this mapping and send frames to the virtual MAC.
Health Monitoring via Hello Messages
The active router sends periodic hello messages to the multicast address of the FHRP group. The standby router listens for these messages. If the standby router stops receiving hellos for a configured hold time (usually three times the hello interval), it assumes the active router has failed. This triggers the failover process.
Failover and State Transition
When the standby router detects that the active router is unreachable, it transitions from standby state to active state. It starts responding to ARP requests for the virtual IP address using its own virtual MAC. The switch learns the new MAC address location via MAC learning, and traffic flows to the new active router. The transition takes a few seconds during which traffic may be dropped.
Preemption and Re-election
If preempt is enabled on the routers, when the original active router comes back online and has a higher priority, it sends hello messages. The current active router sees the higher priority and relinquishes the active role. The group then holds a new election, and the higher priority router takes over. This ensures that the most preferred router is always active.
Practical Mini-Lesson
To deploy FHRP in a real network, you must first understand the topology requirements. Both routers must be in the same VLAN and have Layer 2 connectivity through a switch. They must belong to the same subnet and have unique IP addresses on their LAN interfaces. The virtual IP address must be an unused address in that subnet. For HSRP, the virtual IP cannot match any physical interface IP. For VRRP, you can optionally set the virtual IP to match the master router's IP.
Configuration is straightforward. On a Cisco router, you enter interface configuration mode for the LAN interface. You then use the command standby [group-number] ip [virtual-ip] to enable HSRP. To set priority, use standby [group] priority [value]. To enable preemption, use standby [group] preempt. For VRRP, the commands are vrrp [group] ip [virtual-ip] and vrrp [group] priority [value]. Both protocols also support interface tracking, which allows the router to decrement its priority if a tracked interface fails. For example, if the WAN link goes down on the active router, it can drop its priority and let the standby take over. This is configured with standby [group] track [interface] [decrement-value].
A common real-world scenario is a dual-homed branch office. Two routers connect to two different ISPs. Both routers run HSRP on their inside LAN interfaces. The active router forwards traffic to the primary ISP. The standby router is idle. If the active router's WAN link fails, interface tracking reduces its HSRP priority, causing a failover to the standby router, which then uses the backup ISP. This setup provides both gateway redundancy and ISP failover without requiring host configuration changes.
What can go wrong? Misconfiguration of the virtual IP address is the most common issue. If the virtual IP is already in use or if the routers do not agree on the same virtual IP, the group will not form. Another problem is forgetting to open the required multicast addresses on any Layer 3 switches or firewalls between the routers. ACLs that block multicast traffic can prevent hello messages from reaching the standby router, causing election failures. Also, if the standby router never sees hellos, it may think the active is down and keep transitioning back and forth, causing flapping. Finally, if preempt is not enabled, the original active router will not reclaim the role after a reboot, which can lead to unexpected traffic paths and potential performance issues if the standby router has lower bandwidth to the rest of the network.
Memory Tip
Remember 'FHRP = Fake Home Router Pool' – multiple routers pretending to be one home (gateway) so your devices never get stuck outside.
Covered in These Exams
Current Exam Context
Current exam versions that test this topic — use these objectives when studying.
200-301Cisco CCNA →N10-009CompTIA Network+ →Related Glossary Terms
802.1Q is the networking standard that allows multiple virtual LANs (VLANs) to share a single physical network link by tagging Ethernet frames with VLAN identification information.
An A record is a DNS record that maps a domain name to the IPv4 address of the server hosting that domain.
5G is the fifth generation of cellular network technology, designed to deliver faster speeds, lower latency, and support for many more connected devices than previous generations.
Frequently Asked Questions
Do I need to configure the same virtual IP address on both routers for FHRP to work?
Yes, all routers in the FHRP group must use the same virtual IP address. This address is the default gateway that hosts use. The routers share this single IP, and only the active router responds to ARP requests for it.
Can FHRP work across different VLANs?
FHRP operates within a single VLAN. You can configure separate FHRP groups on different VLANs (for example, using subinterfaces or SVIs), but each group is isolated to its own VLAN. The routers must be in the same Layer 2 broadcast domain for the VLAN.
What is the default hello interval for HSRP?
The HSRP default hello interval is 3 seconds. The hold timer is 10 seconds by default. This means if the standby router does not receive a hello message for 10 seconds, it assumes the active router has failed and begins the failover process.
Can I use FHRP with dynamic routing protocols?
Yes, absolutely. FHRP provides a redundant default gateway for hosts. The routers in the FHRP group can run OSPF, EIGRP, or any other routing protocol to learn routes to remote networks. FHRP and dynamic routing work together seamlessly.
What happens to active sessions during an FHRP failover?
During the failover, which typically takes a few seconds, some packets may be lost. Active TCP sessions might need to retransmit packets. Stateful applications may be disrupted. To minimize impact, you can use interface tracking to failover proactively before a loss of connectivity, or use stateful switchover techniques for critical sessions.
Is GLBP better than HSRP?
GLBP offers load balancing across multiple routers, which HSRP does not provide by default. However, HSRP is simpler and more widely used. The choice depends on the requirement. If you need both redundancy and traffic distribution, GLBP is a better choice. If you only need failover, HSRP or VRRP are sufficient.
Summary
First Hop Redundancy Protocol (FHRP) is a fundamental networking technology that ensures high availability by allowing multiple routers to share the role of a default gateway. It eliminates the single point of failure that exists when a network relies on a single router for outbound traffic. FHRP is not a single protocol but a category that includes HSRP, VRRP, and GLBP. Each of these protocols has its own characteristics, but all achieve the same basic goal: automatic failover without host reconfiguration.
For IT professionals, understanding FHRP is essential for designing resilient networks. It is widely used in campus networks, data centers, and branch offices where uptime is critical. The protocol works by having routers elect an active router that responds to the virtual IP address. The standby router monitors the active router's health and takes over if it fails. Interface tracking adds intelligence by allowing the active router to step down if its upstream connection fails.
On the CCNA exam, FHRP is a primary topic that tests both conceptual knowledge and practical troubleshooting skills. You will need to know the differences between HSRP, VRRP, and GLBP, understand how priority and preemption work, and be able to interpret configuration outputs. Mastery of FHRP will help you answer several exam questions and is a skill that directly translates to real-world network administration. The key takeaway is to always remember the role of the virtual IP, the importance of preempt, and the fact that FHRP operates over a single Layer 2 domain.