What Is HSRP vs VRRP vs GLBP in Networking?

Imagine you are in a large office building with a single reception desk. Everyone who enters the building goes to that desk to get a visitor badge. Now what happens if the receptionist steps away for a break?

People queue up, waiting, and no one gets a badge until the receptionist returns. This is like a network with only one router handling all the traffic. If that router fails, every device loses its connection to the internet or other parts of the network.

To avoid this, you install a second reception desk with another receptionist. But now a visitor walks in and has to decide which desk to approach. They might pick one, but if that receptionist is busy, they might have to wait even though the other desk is free.

This is like having two routers but no coordination between them. The protocols HSRP, VRRP, and GLBP solve this by making the two reception desks appear as one. The visitor sees a single sign that says Reception, and they walk to that single point.

Behind the scenes, the two receptionists communicate. One is the active receptionist, and the other is on standby. If the active one steps away, the standby instantly takes over. The visitor never sees the swap.

In networking terms, these protocols create a virtual IP address and a virtual MAC address that devices on the network use as their default gateway. The group of routers shares this virtual address, but only one router is active at a time (or more in the case of GLBP). When the active router fails, another router in the group assumes the virtual address and continues forwarding traffic with almost no delay.

The devices on the network never need to change their configuration because the virtual gateway address stays the same. The difference between the three protocols is how they choose the active router and whether they can share the traffic load. HSRP is Cisco's own protocol, VRRP is an industry standard that works with any vendor, and GLBP goes a step further by allowing multiple routers to forward traffic at the same time, sharing the load rather than having one active and the rest idle.

This makes the network not only highly available but also more efficient.

HSRP (Hot Standby Router Protocol), VRRP (Virtual Router Redundancy Protocol), and GLBP (Gateway Load Balancing Protocol) are first-hop redundancy protocols (FHRPs) designed to eliminate the single point of failure inherent in a default gateway configuration. In a typical IP network, every host is configured with a default gateway IP address pointing to a single router. If that router fails, all hosts lose connectivity to other networks. FHRPs solve this by allowing two or more routers to share a virtual IP address and virtual MAC address, so that a failure of the active router triggers an automatic failover to a standby router, with minimal disruption.

HSRP is a Cisco proprietary protocol defined in RFC 2281. It runs between 2 and 16 routers in an HSRP group. One router is elected as the active router, another as standby, and the rest are in a listening state. HSRP uses a priority value (1 to 255) and preemption (optional) to determine active status. Routers exchange hello messages every 3 seconds by default over UDP port 1985, using the multicast address 224.0.0.2. The active router sends periodic hello messages; if the standby router misses three consecutive hellos (10 seconds by default), it assumes the active router is down and becomes active. HSRP provides a single virtual MAC address (0000.0c07.acXX, where XX is the group number in hex) that the active router uses. Multiple HSRP groups can be configured on a single interface for load sharing on different VLANs or subnets, but each group has only one forwarding router.

VRRP is an open standard protocol defined in RFC 3768 (later RFC 5798). It is vendor-neutral and works with routers from any manufacturer. VRRP operates similarly to HSRP but uses different timers and addressing. VRRP routers use the multicast address 224.0.0.18 and IP protocol number 112. The virtual MAC address is 0000.5e00.01XX, where XX is the VRRP group number. VRRP uses an election process based on priority (1 to 254, with 100 as default). The router with the highest priority becomes the master; if a tie occurs, the router with the highest primary IP address wins. Preemption is enabled by default. VRRP has a key advantage over HSRP in that it supports the use of the real IP address of a router as the virtual IP address, which simplifies some scenarios. VRRP does not have a concept of a standby router that is explicitly tracked; instead, it simply has one master and one or more backups. VRRP advertises every 1 second by default, and the master down timer is typically 3 seconds.

GLBP is a Cisco proprietary protocol that provides both redundancy and load balancing. Unlike HSRP and VRRP, where only one router actively forwards traffic at a time, GLBP allows up to four routers in a group to share the forwarding load. GLBP elects one router as the active virtual gateway (AVG). The AVG assigns a virtual MAC address to each member router in the group, and it responds to ARP requests from hosts with the virtual MAC of a specific forwarding router, using a round-robin or weighted algorithm. Each forwarding router is called an active virtual forwarder (AVF). GLBP uses hello messages sent to multicast address 224.0.0.102 over UDP port 3222, with a default hello interval of 3 seconds. The virtual MAC format is 0007.b4XX.XXYY, where XX.XX is the group number and YY identifies the forwarder. GLBP supports up to 1024 virtual routers per physical interface and can be configured with weighted load balancing based on interface capacity. This makes GLBP ideal for environments where maximizing link utilization is critical.

In real IT work, network downtime directly costs money, productivity, and sometimes even safety. A hospital, a stock exchange, or an e-commerce website cannot afford to lose connectivity for even a few minutes. HSRP, VRRP, and GLBP are core tools for building a resilient network architecture that can survive hardware failures, link outages, or planned maintenance without users noticing.

When a network engineer configures a router as a default gateway for hundreds or thousands of devices, they are creating a single point of failure. If that router goes down, every single device loses internet access. By implementing a first-hop redundancy protocol, the engineer eliminates that single point of failure.

In practice, most enterprise networks use VRRP because it is an open standard and works with mixed-vendor environments. Cisco shops often use HSRP or GLBP depending on whether they need load balancing. GLBP is especially useful in data centers where bandwidth utilization is under constant scrutiny.

Without GLBP, half the router capacity remains idle during normal operation. With GLBP, all routers carry traffic, potentially delaying or avoiding a hardware upgrade. For cloud infrastructure and virtualized environments, these protocols are also important.

Virtual routers in platforms like VMware NSX or AWS can use VRRP-like mechanisms to ensure high availability for virtual networks. Understanding these protocols is foundational for anyone pursuing a career in networking, because redundancy is not a luxury it is a requirement for any production network. In cybersecurity terms, a single outage can be exploited by attackers as a diversion or can cause data loss if sessions are dropped.

HSRP, VRRP, and GLBP minimize that risk.

In certification exams like Cisco ENCOR, you will see several types of questions regarding HSRP, VRRP, and GLBP. Multiple-choice questions often ask you to compare features, for example: 'Which protocol is an open standard?' or 'Which protocol supports load balancing across multiple routers?'

or 'What is the default hello timer for HSRP?' Another common pattern is a scenario where you must select the appropriate protocol. For instance, 'A company has a mix of Cisco and Juniper routers.

Which first-hop redundancy protocol should they use?' The correct answer is VRRP, because it is vendor-neutral. You might also see configuration questions that present a partial configuration and ask you to identify the missing command or the error.

For example: 'R1 is configured as the active HSRP router for group 10 with a priority of 150. R2 has a priority of 100. When R1 fails, R2 becomes active. After R1 recovers, it remains in the standby state.

Why?' The answer would be that preemption is not enabled. Troubleshooting questions are also frequent. They might give you output from show commands and ask why failover did not occur as expected.

Common issues include mismatched authentication strings, mismatched HSRP version, or incorrect virtual IP addresses. Architecture questions may ask about the design implications, such as: 'You are designing a network with two routers and 200 hosts. You need to use both routers to forward traffic to increase throughput.

Which protocol should you choose?' The answer is GLBP, because it is the only one that allows multiple routers to forward traffic simultaneously using the same virtual IP address. Some questions may also probe your understanding of the virtual MAC addresses, especially in a switched environment where the switch MAC table must learn the virtual MAC.

For example: 'Which MAC address does an HSRP group with number 10 use?' You should know it is 0000.0c07.ac0a.

In a real-world network, configuring a first-hop redundancy protocol requires careful planning. Start by deciding which protocol suits your environment. For a pure Cisco shop, HSRP is simple and widely supported.

For a multivendor environment, use VRRP. If you need to maximise link utilization, GLBP is the best choice. The configuration steps are similar across protocols. On each router interface that will participate, you define the virtual IP address and set a priority.

For HSRP, the command is 'standby group-number ip virtual-ip-address'. For VRRP, it is 'vrrp group-number ip virtual-ip-address'. For GLBP, it is 'glbp group-number ip virtual-ip-address'.

Priority is set with 'standby group-number priority value', 'vrrp group-number priority value', or 'glbp group-number priority value'. Enabling preemption is critical if you want a specific router to always be the active one when it is online. Use 'standby preempt', 'vrrp preempt', or 'glbp preempt'.

You should also configure authentication to prevent rogue routers from joining the group. Use 'standby authentication string', 'vrrp authentication string', or 'glbp authentication string'. For HSRP and VRRP, you can use MD5 or plaintext.

For troubleshooting, use 'show standby brief', 'show vrrp brief', or 'show glbp brief'. These commands display the group number, priority, state (active/standby/master/backup), virtual IP, and timers. Common issues include mismatched virtual IPs, differing authentication keys, and firewalls blocking the multicast traffic.

If failover does not happen, check that hello packets are being received by using debug commands like 'debug standby events' or 'debug vrrp events'. Remember that these protocols rely on a shared subnet. All routers in the group must be in the same VLAN and connected to the same Layer 2 domain.

Also, consider the impact on switch MAC tables. When a failover occurs, the new active router sends a gratuitous ARP, which updates the switch's CAM table. This process is fast, typically under a few seconds.

For a more robust solution, combine these protocols with interface tracking. For example, you can use 'standby track' to lower the HSRP priority of a router if its WAN interface goes down, making the other router take over. This prevents the router from being active but unable to send traffic to the next hop.

GLBP also supports weighted tracking, where the weight of a router determines how many connections it receives. Practically, you can configure an IP SLA probe to track a remote destination and adjust the priority based on reachability. This makes the failover more intelligent.

For exam success, focus on memorizing default timers, multicast addresses, MAC addresses, and the key differences. Also practice interpreting show command output so you can quickly identify which router is active and why. Understanding these protocols at a practical level will also help you in job interviews and real network deployments, where high availability is often a critical requirement.