What Is HSRP in Networking?
On This Page
Quick Definition
HSRP is a Cisco protocol that makes a group of routers appear as a single router to devices on a network. If the main router fails, a backup router automatically takes over without any disruption. This ensures that computers and other devices always have a working path to send their data out of the local network.
Commonly Confused With
VRRP is an open standard (IEEE 3768) protocol that also provides gateway redundancy. HSRP is Cisco proprietary. The main operational difference is that in VRRP, the active router is called the master, and the backup router can participate in traffic forwarding if configured as such (in some implementations). Also, VRRP uses the real MAC address of the master router, while HSRP uses a virtual MAC.
If you have a multivendor network (Cisco and Juniper), you cannot use HSRP because it is proprietary. You would use VRRP instead.
GLBP is also Cisco proprietary, but it provides true load balancing across multiple routers. Instead of having one active router, GLBP allows up to four routers to simultaneously forward traffic by using multiple virtual MAC addresses. HSRP only uses one active router at a time.
If you have two routers in an HSRP group, only one forwards traffic. With GLBP, both can forward traffic, doubling the available bandwidth.
STP is a Layer 2 protocol that prevents loops in a redundant switched network by blocking certain ports. HSRP is a Layer 3 protocol for router redundancy. They are often used together, but they solve different problems. STP deals with switch loops, while HSRP deals with default gateway failures.
A network can have redundant switches (using STP) and redundant routers (using HSRP) to ensure both Layer 2 and Layer 3 availability.
Must Know for Exams
HSRP is a core topic for the Cisco CCNA certification, specifically under the Network Access and IP Connectivity domains. In the current exam blueprint (200-301 CCNA), HSRP falls under the topic of 'Configure and verify first-hop redundancy protocols.' This means you need to know not only the theory but also how to configure, verify, and troubleshoot HSRP on Cisco routers and switches (Layer 3 switches).
In the CCNA exam, questions on HSRP can appear in multiple formats. First, there are multiple-choice theory questions. These will test your understanding of the active/standby election process, the virtual MAC address format, timers (Hello and hold), and the differences between HSRP and other FHRPs like VRRP and GLBP. For example, you might be asked, 'What is the default hold time for HSRP?' or 'What is the virtual MAC address for HSRP group 10?'.
Second, there are scenario-based questions. You might be given a network diagram with two routers and a description of the traffic flow. The question could ask, 'Which router will become the active router?' based on given priority values or IP addresses. You need to understand that the highest priority wins, and if priorities are equal, the highest IP address wins. You also need to know that preemption is disabled by default, meaning a router that boots up with a higher priority will not immediately take over from the currently active router unless preemption is enabled.
Third, there are configuration and troubleshooting scenarios. You might see a partially completed configuration and be asked to identify the missing command. For example, 'Which command is missing to make the router respond to the virtual IP address?' The answer would be 'standby <group> ip <virtual-ip>'. Troubleshooting questions often involve verifying HSRP status using commands like 'show standby' or 'show standby brief'. You should be comfortable interpreting the output, understanding the states (Active, Standby, Init, Listen, Speak), and identifying misconfigurations like mismatched group numbers or virtual IP addresses.
Finally, the CCNA exam expects you to know the practical implications of HSRP features like interface tracking and preemption. You might see a question where an interface goes down, causing a priority reduction, and you need to predict which router becomes the new active router. Mastering these details is essential for scoring well on the exam.
Simple Meaning
Imagine you live in an apartment building with one main entrance. The building manager is the person who unlocks the main door every morning. But what if the manager gets sick and cannot come to work? Then nobody can get in or out. To avoid this problem, you could have a backup manager who is ready to step in at a moment's notice. That is exactly what HSRP does for a computer network.
In a computer network, devices like computers, printers, and servers need to send data to other networks, especially the internet. They send this data to a device called a default gateway, which is typically a router. If that router fails, all the devices lose their connection to the outside world. That is a big problem for businesses that rely on the internet for email, websites, and cloud services.
HSRP solves this by creating a virtual router. This virtual router has its own IP address, called the virtual IP address. Think of this virtual IP address as the main entrance door number of the apartment building. Multiple physical routers (the managers) are configured to work together. One router is the active manager, and the others are standby managers. The active manager handles all the traffic, just like the main manager unlocks the door. The standby managers constantly check that the active manager is still working. If the active manager fails, one of the standby managers instantly takes over, using the same virtual IP address. The devices in the network never even know there was a problem because they are always sending data to the same virtual IP address.
This process is automatic and fast, usually taking only a few seconds. That makes the network more reliable. Businesses can continue their work without interruption, even if a physical router breaks down.
Full Technical Definition
Hot Standby Router Protocol (HSRP) is a Cisco proprietary First Hop Redundancy Protocol (FHRP) defined in RFC 2281. Its primary purpose is to provide high network availability by allowing a group of routers to share a single virtual IP address and virtual MAC address. This creates the illusion of a single default gateway, eliminating the single point of failure that a physical default gateway represents.
The group of routers participating in HSRP is called an HSRP group or a standby group. Each group has a unique group number, typically between 0 and 255. The routers in the group elect one router to be the active router and another to be the standby router. The active router is responsible for forwarding packets sent to the virtual IP address. The standby router monitors the active router and takes over if the active router fails. Other routers in the group (if any) are in a listening state.
Election of the active router is based on priority. Each router is assigned a priority value from 0 to 255, with higher values being more preferred. By default, the priority is 100. If a router has a higher priority, it becomes the active router. If priorities are equal, the router with the highest IP address becomes active. Once an active router is elected, it sends periodic Hello messages (every 3 seconds by default) to the multicast address 224.0.0.2 (all routers) using UDP port 1985. The standby router listens for these Hello messages. If the standby router does not receive three consecutive Hello messages (the hold time, which defaults to 10 seconds), it assumes the active router has failed and transitions to the active state itself.
The virtual MAC address used by HSRP is 0000.0c07.acXX, where XX is the HSRP group number in hexadecimal. For example, group 10 would use virtual MAC 0000.0c07.ac0A. This virtual MAC ensures that traffic sent to the virtual IP address is handled by the active router. When a failover occurs, the new active router starts using this same virtual MAC, so switches and end devices do not need to update their ARP caches.
HSRP supports multiple versions. Version 1 is the original, with limitations such as supporting only 256 groups and using the multicast address 224.0.0.2. Version 2 improves on this by supporting up to 4096 groups, using the multicast address 224.0.0.102, and including group name support. Cisco recommends using HSRP version 2 in modern networks.
Configuration involves assigning the virtual IP address and priority to each router, enabling preemption, and setting the group number. Preemption allows a higher-priority router to take over the active role if it comes online after a failure, which is often desirable. Additional features include interface tracking, which can automatically lower a router's priority if a specific interface goes down, ensuring that the router with the best path to the downstream network is the active router.
Real-Life Example
Think about a busy hospital that needs electricity 24/7. The main power comes from the city grid. But the hospital knows that power outages can happen. So they have a backup generator. In a normal situation, the generator just sits there, waiting. If the city power fails, the generator must kick in within seconds so that life-support machines and lights do not turn off. The hospital has a main power line (the active router) and a backup generator (the standby router). The patients (the computers) do not care which source the electricity comes from, as long as it works.
Now, imagine a slightly different setup. Instead of one generator, the hospital has two generators. They cooperate. One generator is always running and handling all the load. The second generator is ready to take over if the first one fails. They share a single electrical panel (the virtual IP address) that the hospital's wiring connects to. When you plug a device into the wall, you do not know which generator is powering it. You just know that the outlet works. That is HSRP.
In this analogy, the two generators are the two routers. The electrical panel is the virtual IP address. The constant monitoring of the city grid (the Hello messages) ensures the backup generator knows if the main generator fails. The transfer switch that automatically switches over in milliseconds is the failover mechanism of HSRP. The patients getting continuous care are the network users who never lose their connection to the outside world.
This is exactly how HSRP works in a data center. Two or more routers are connected to the same network segment. They all share a virtual IP address that is configured as the default gateway on all end devices. One router is active, handling all traffic. The other(s) stand by. If the active router fails, a standby router becomes active within seconds, using the same virtual IP and MAC. The end devices never notice the change, and network connectivity is maintained.
Why This Term Matters
In any modern organization, network downtime translates directly to lost revenue, reduced productivity, and frustrated users. Applications are increasingly cloud-based, and users expect always-on connectivity. The default gateway is a critical single point of failure. Without a redundancy protocol like HSRP, if the main router fails, every device in that subnet loses internet access and the ability to communicate with other subnets. HSRP is a simple and effective solution that dramatically increases network reliability.
For network administrators, HSRP provides a mechanism to perform maintenance without causing outages. If a router needs a software upgrade or hardware replacement, the administrator can manually change the priority to make it standby, perform the maintenance, and then bring it back online. During this entire process, the network remains operational because the other router takes over seamlessly. This capability is essential for meeting service level agreements (SLAs) that require 99.999% uptime.
HSRP also allows load sharing across multiple routers. By creating multiple HSRP groups on the same set of routers and configuring different groups to have different active routers, traffic can be balanced. For example, half the devices can use one group (with router A as active), and the other half use another group (with router B as active). This optimizes bandwidth usage and reduces the risk of overloading a single router.
In practical IT, HSRP is often used in conjunction with other redundancy technologies like Spanning Tree Protocol (STP) for Layer 2 redundancy and link aggregation (EtherChannel) for increased bandwidth. It is a foundational component of a highly available network architecture. Understanding HSRP is critical for any network professional involved in designing, implementing, or troubleshooting enterprise networks.
How It Appears in Exam Questions
HSRP questions on the CCNA exam are designed to test your practical knowledge. They are rarely purely definitional. Instead, they place you in a scenario and ask you to make a decision or identify a problem.
Scenario-based question pattern: Imagine a network with two routers, R1 and R2, connected to the same LAN segment. Both are configured for HSRP group 1. The virtual IP address is 192.168.1.1. R1 has a priority of 150, and R2 has a priority of 100. Both routers are up. Which router will be the active router? The answer is R1 because it has a higher priority. The question might then ask, 'If R1 fails, what happens?' The answer: R2 will become active after the hold timer expires (three missed Hello messages).
Configuration-based question pattern: You are given a partial configuration for router R1:
interface GigabitEthernet0/0 ip address 192.168.1.2 255.255.255.0 standby 1 ip 192.168.1.1 standby 1 priority 150 standby 1 preempt
The question asks, 'What is missing from this configuration to ensure that R1 will become active immediately if it comes online after a failure?' The answer is 'standby 1 preempt' is actually already there, so the configuration is correct for preemption. A tricky question might ask, 'What is missing to allow this router to respond to the virtual IP address?' The answer: nothing, 'standby 1 ip 192.168.1.1' enables that. But if the 'standby 1 ip' command were missing, the router would not participate in HSRP for group 1.
Troubleshooting-based question pattern: A user reports intermittent connectivity. The network administrator checks the router configuration and sees that the virtual IP address is correctly configured. However, the 'show standby' command shows both routers in 'Init' state. What is the likely cause? The answer could be that the interface is down, or that the routers cannot communicate with each other (e.g., a firewall blocking multicast or a VLAN mismatch). Another common troubleshooting scenario: After rebooting the active router, the standby router does not take over. The issue could be that the standby router is not configured for HSRP on that interface, or that the standby timer is very long.
Another common question involves HSRP version mismatch. One router is configured with version 2, and the other is configured with version 1 (the default). They will not form an HSRP adjacency because they use different multicast addresses. The 'show standby' command would show the routers in 'Init' or 'Listen' state without a standby router being recognized. The fix is to configure the same version on both routers.
Finally, you may encounter questions comparing HSRP to VRRP and GLBP. The key differences are: HSRP is proprietary (Cisco), VRRP is an open standard (RFC 3768), and GLBP provides load balancing across multiple routers. HSRP uses a virtual MAC starting with 0000.0c07.ac, while VRRP uses 0000.5e00.01. You need to know these distinctions for exam questions that ask, 'Which FHRP is a Cisco proprietary protocol?'
Practise HSRP Questions
Test your understanding with exam-style practice questions.
Example Scenario
Scenario: A small college has a computer lab with 50 computers. All these computers need to access the internet to browse course materials and submit assignments. The lab's network uses the IP subnet 192.168.10.0/24. The default gateway for all computers is set to 192.168.10.1. This gateway is a single router, Router-A, which connects the lab to the campus backbone and the internet.
One morning, during final exams, Router-A crashes due to a power supply failure. Immediately, the 50 computers lose their internet connection. Students cannot access their exam materials or submit their work. Panic ensues. The network administrator rushes to the server room, finds the problem, and replaces the router. It takes 20 minutes. During those 20 minutes, no work is done.
To prevent this disaster, the college decides to implement HSRP. They install a second router, Router-B, and connect it to the same lab network segment. Both routers are configured for HSRP group 10. The virtual IP address is 192.168.10.1 (the same IP the computers were using). Router-A is given a priority of 150, so it becomes the active router. Router-B has the default priority of 100 and becomes the standby router.
Now, when a student sends data to the internet, the data goes to the virtual IP 192.168.10.1, but it is actually handled by Router-A. Router-B constantly listens for Hello messages from Router-A.
One day, Router-A fails again. After three missed Hello messages (about 10 seconds), Router-B detects the failure and transitions to the active state. It immediately starts responding to the virtual IP address and forwarding traffic. The computers never stop working. A few users might experience a brief pause, but they quickly recover. No panic, no lost work. The network administrator can then repair Router-A at his convenience. When Router-A is fixed and comes back online, because preemption is enabled, it reclaims the active role, and Router-B goes back to standby. The network remains operational throughout the entire process.
This scenario demonstrates how HSRP provides seamless gateway redundancy, protecting users from the disruption of a single router failure.
Common Mistakes
Thinking that HSRP provides load balancing by default.
HSRP has a single active router that handles all traffic. Standby routers do not forward traffic unless the active fails. To achieve load balancing, you must configure multiple HSRP groups and split the hosts between them.
Understand that HSRP is for redundancy only. If you need load balancing, use GLBP or configure multiple HSRP groups with different active routers.
Assuming that the router with the highest IP address always becomes the active router.
The active router election is based primarily on priority (highest wins). The highest IP address is only used as a tie-breaker when priorities are equal.
Remember the election order: priority first, then IP address. Configure explicit priorities to control which router is active.
Forgetting that HSRP preemption is disabled by default.
Without preemption, if a higher-priority router fails and later recovers, it will not automatically reclaim the active role. The currently active router (with lower priority) will remain active, which might be suboptimal.
Always explicitly enable preemption with the 'standby <group> preempt' command if you want a router to take over when it becomes available.
Configuring HSRP on different VLANs but using the same group number unintentionally.
HSRP groups are local to a particular VLAN or interface. Using the same group number on different VLANs is acceptable, but it can cause confusion during troubleshooting if not documented.
Use unique group numbers per VLAN for clarity, or ensure proper documentation. The group number only needs to match between routers on the same VLAN.
Mismatching HSRP versions between routers.
HSRP version 1 and version 2 are not compatible. Routers configured with different versions will not form an adjacency, resulting in both routers being in 'Init' state and no failover capability.
Configure the same HSRP version on all routers in the group using the 'standby version 2' command under the interface.
Exam Trap — Don't Get Fooled
{"trap":"The exam shows both routers configured with the same priority (default 100), and asks which router will be the active router. Many learners choose the router with the highest IP address, but they forget that the election also considers router startup order, and that without preemption, the first router to come up will be active.","why_learners_choose_it":"Learners memorize the rule 'highest IP wins' but forget that this tie-breaking rule only applies when both routers come up simultaneously.
In real life and in the exam scenario, routers rarely boot at the exact same microsecond. The router that boots first will become active, and the second router will see an active router and go into standby, even if it has a higher IP address.","how_to_avoid_it":"Always check if preemption is enabled.
If preemption is disabled (the default), the first router to become active stays active, regardless of priority or IP address. The tie-breaking rule (highest IP) only matters during the initial election if both routers boot simultaneously or if a router with a higher priority comes online after the active has been elected and preemption is enabled."
Step-by-Step Breakdown
HSRP Group Creation and Virtual IP Assignment
The administrator configures an IP address on the interface (e.g., GigabitEthernet0/0) plus a virtual IP address using the command 'standby <group> ip <virtual-ip>'. This virtual IP becomes the default gateway for end devices. Multiple routers on the same subnet are configured with the same group number and virtual IP.
Router Priority and Election
Each router in the group is assigned a priority (default 100, range 0-255). The router with the highest priority wins the election to become the active router. If priorities are equal, the router with the highest IP address on that interface wins the election. The active router is responsible for forwarding all traffic sent to the virtual IP.
Active Router Begins Sending Hello Messages
The active router sends Hello messages every 3 seconds (default) to the multicast address 224.0.0.2 (version 1) or 224.0.0.102 (version 2) using UDP port 1985. These messages advertise its active state and priority. The standby router listens for these messages.
Standby Router Monitors the Active Router
The standby router expects to receive Hello messages from the active router within a hold time of 10 seconds (default). If the standby router does not receive three consecutive Hello messages, it assumes the active router has failed. The hold time can be configured manually, but it must be at least three times the Hello timer.
Failover and Standby Router Becomes Active
After the hold timer expires, the standby router transitions from the Standby state to the Active state. It starts using the virtual IP and virtual MAC address, sending gratuitous ARP messages to update the ARP tables of connected switches and hosts. From the perspective of end devices, the default gateway is still reachable; they do not see any interruption.
Recovery and Re-election (If Preemption is Enabled)
When the failed router recovers, it begins sending Hello messages. If preemption is enabled (via 'standby <group> preempt' on that router), and it has a higher priority than the current active router, it will trigger a new election. The higher-priority router becomes active again, and the current active steps down to standby. If preemption is disabled, the original active router will remain in standby even if it has a higher priority.
Practical Mini-Lesson
HSRP is one of the most important protocols for network reliability, and as a network professional, you will configure and troubleshoot it regularly. Let us walk through a practical configuration scenario and the verification steps you must know.
First, planning is critical. You need to decide which router should be active under normal conditions. Typically, you want the router with the faster link or more capacity to be active. Assign it a higher priority (e.g., 150). The backup router gets the default priority of 100. Decide if you want preemption. In most production networks, preemption is enabled because you want the primary router to resume its role after maintenance or repair. However, in some cases, disabling preemption can prevent unnecessary flapping if the router is unstable after a reboot.
Next, configure each router. On the primary router (let us call it R1), enter interface configuration mode for the LAN-facing interface (e.g., interface GigabitEthernet0/0). Assign the physical IP address (ip address 10.0.0.2 255.255.255.0). Then configure HSRP: standby 1 ip 10.0.0.1, standby 1 priority 150, standby 1 preempt. Optionally, set the HSRP version: standby version 2. On the backup router (R2), do the same, but with priority 100: standby 1 ip 10.0.0.1, standby 1 priority 100, standby 1 preempt. Notice that the virtual IP is the same on both routers.
After configuration, verify with the 'show standby' command. This shows you the state (Active/Standby), virtual IP, priority, preemption status, and timers. The 'show standby brief' command gives a concise table view of all HSRP groups. You should see R1 as Active and R2 as Standby. If both are in Init state, check that the interface is up and that multicast traffic is allowed between the routers.
Now, test failover. Shut down the interface on R1 (interface GigabitEthernet0/0, then shut). Within about 10 seconds (the hold timer), R2 should transition to Active. Run 'show standby' on R2 to confirm. Then bring R1's interface back up. If preemption is enabled, R1 should become Active again. If it does not, check that preemption is configured.
Watch out for common issues. A frequent problem is a mismatch in the group number or virtual IP. Another is that the routers cannot communicate via multicast because of an access control list (ACL) blocking the HSRP multicast address. Also, if you use a firewall between the routers, you need to allow UDP port 1985. In a switched environment, ensure the ports are in the same VLAN.
Finally, consider interface tracking. If the active router loses its connection to the internet (e.g., its WAN interface goes down), you want the standby router to take over. Use the 'standby 1 track <interface>' command to reduce the priority of the active router if that tracked interface goes down. This ensures that the router with the best path to the internet always serves as the active gateway. Mastering these details will make you a competent and reliable network engineer.
Memory Tip
Remember the election rule: Priority Powers the Pick. Higher priority wins; if equal, highest IP address breaks the tie. And Preempt is the key to taking back the crown.
Covered in These Exams
Current Exam Context
Current exam versions that test this topic — use these objectives when studying.
200-301Cisco CCNA →N10-009CompTIA Network+ →Related Glossary Terms
802.1Q is the networking standard that allows multiple virtual LANs (VLANs) to share a single physical network link by tagging Ethernet frames with VLAN identification information.
802.1X is a network access control standard that authenticates devices before they are allowed to connect to a wired or wireless network.
An A record is a DNS record that maps a domain name to the IPv4 address of the server hosting that domain.
An A record is a type of DNS resource record that maps a domain name to an IPv4 address.
Frequently Asked Questions
Is HSRP only available on Cisco devices?
Yes, HSRP is a Cisco proprietary protocol. If you have a multi-vendor network, you should use the open standard VRRP instead.
What is the default HSRP hello timer and hold timer?
The default hello timer is 3 seconds, and the default hold timer is 10 seconds. The hold timer must be at least three times the hello timer.
Can HSRP be used on Layer 3 switches?
Yes, HSRP can be configured on Cisco Layer 3 switches on the switch virtual interfaces (SVIs) that are configured with an IP address.
What is the difference between HSRP version 1 and version 2?
Version 2 supports more group numbers (up to 4096 vs. 256), uses a different multicast address (224.0.0.102 vs. 224.0.0.2), and supports group names. Version 2 is recommended for new deployments.
Does HSRP work across different subnets?
No, HSRP operates within a single subnet. All routers in the HSRP group must be connected to the same Layer 2 network and configured with IP addresses in the same subnet.
What happens to the active router's traffic if it fails?
Any traffic that was in transit when the active router failed may be lost. Sessions using TCP will typically recover because TCP can retransmit, but UDP-based real-time streams may have a brief glitch. HSRP does not preserve state; it only provides a new active gateway.
Summary
HSRP is a Cisco proprietary protocol that provides default gateway redundancy for IP networks. It allows two or more routers to share a virtual IP address and virtual MAC address, presenting a single gateway to end devices. If the active router fails, a standby router automatically takes over, ensuring continuous network connectivity.
This protocol is a critical component of high availability network designs. On the CCNA exam, you must understand the election process, configuration commands, verification with 'show standby', and troubleshooting common issues like mismatched versions or missing preemption. Remember that HSRP is not for load balancing by default; it is for redundancy.
The key takeaway is that HSRP protects against the single point of failure that a default gateway represents, and mastering it is essential for any network professional.