FHRP: HSRP vs VRRP vs GLBP

First Hop Redundancy Protocols (FHRPs) allow two or more routers to share a single virtual IP address (VIP) and virtual MAC address, providing redundancy for the default gateway on a subnet. Hosts configure the VIP as their default gateway; if the active router fails, another router takes over transparently. The three main FHRPs are:

HSRP operates with a group of routers sharing a virtual IP and virtual MAC (0000.0c07.acXX, where XX is the group number in hex). Routers elect an active router and one or more standby routers. The active router responds to ARP requests for the VIP and forwards traffic. The standby router monitors the active via hello messages (default 3 seconds) and takes over after a hold time (default 10 seconds) if hellos stop.

HSRP States: - Initial – Router just started or interface down. - Learn – Router doesn't know the VIP; waits to hear from active. - Listen – Router knows VIP; listens for hellos from active/standby. - Speak – Router participates in election; sends hellos. - Standby – Router is the backup; monitors active. - Active – Router is forwarding traffic for the group.

HSRP Versions: - HSRPv1 – Uses multicast 224.0.0.2, supports up to 255 groups, group numbers 0-255. - HSRPv2 – Uses multicast 224.0.0.102, supports up to 4096 groups, group numbers 0-4095, and adds IPv6 support.

Configuration Example:

interface GigabitEthernet0/0
 ip address 192.168.1.2 255.255.255.0
 standby version 2
 standby 1 ip 192.168.1.1
 standby 1 priority 110
 standby 1 preempt
 standby 1 timers 1 3

Verification Commands:

show standby
show standby brief

Example output:

Router# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Gi0/0       1    110 P Active  local           192.168.1.3     192.168.1.1

VRRP is an open standard (RFC 5798). It uses the concept of a virtual router with a virtual IP that can be the same as the physical IP of one router (the owner). The master router is the one with highest priority (default 100). VRRP uses the virtual MAC 0000.5e00.01XX (XX is group number in hex).

VRRP States: - Initialize – Interface down or router starting. - Master – Router is forwarding traffic and sending VRRP advertisements (default 1 second). - Backup – Router monitors master; if no advertisements for 3 times the advertisement interval (master down interval), it becomes master.

Key Differences from HSRP: - VRRP allows the virtual IP to be the same as the physical IP of the master (owner). HSRP cannot use the physical IP as the virtual IP. - VRRP does not have a separate standby state; the backup is simply backup. - VRRP uses the physical MAC of the master by default, but can also use a virtual MAC.

Configuration Example:

interface GigabitEthernet0/0
 ip address 192.168.1.2 255.255.255.0
 vrrp 1 ip 192.168.1.1
 vrrp 1 priority 110
 vrrp 1 preempt

Verification Commands:

show vrrp
show vrrp brief

GLBP provides load balancing by allowing multiple routers to forward traffic simultaneously while still providing redundancy. It uses a single virtual IP and multiple virtual MAC addresses. One router is elected as the Active Virtual Gateway (AVG), which assigns virtual MAC addresses to the other routers (Active Virtual Forwarders - AVFs). Hosts' ARP requests are answered with different virtual MACs, distributing traffic.

GLBP Components: - AVG (Active Virtual Gateway) – Manages the group, responds to ARP requests, assigns virtual MACs. - AVF (Active Virtual Forwarder) – Forwards traffic for assigned virtual MAC. - Standby – Backup AVG.

GLBP States: - Disabled – Interface down. - Listen – Listening for hello messages. - Speak – Participating in election. - Standby – Backup AVG. - Active – AVG or AVF.

Configuration Example:

interface GigabitEthernet0/0
 ip address 192.168.1.2 255.255.255.0
 glbp 1 ip 192.168.1.1
 glbp 1 priority 110
 glbp 1 preempt

Verification Commands:

show glbp
show glbp brief

FHRPs interact with Spanning Tree Protocol (STP) because both provide redundancy at different layers. STP prevents loops in Layer 2, while FHRP provides gateway redundancy at Layer 3. They must be aligned: the active FHRP router should be on the same switch as the STP root bridge to avoid suboptimal traffic paths. Also, FHRP can work with HSRP/VRRP tracking to adjust priority based on uplink status.

In enterprise networks, FHRPs are deployed to ensure that end devices can always reach their default gateway, even if a router fails. A common scenario is a pair of routers connected to a distribution switch. For example, in a campus network, two routers (or Layer 3 switches) are configured with HSRP to provide a virtual IP for each VLAN. The network engineer sets one router as active with a higher priority, and the other as standby. To prevent asymmetric routing, the engineer ensures that the HSRP active router is also the STP root for the corresponding VLAN.

Another scenario uses GLBP to load balance traffic across multiple routers. For instance, in a data center, two routers serve as gateways for a server farm. GLBP distributes traffic based on round-robin ARP replies, increasing throughput without requiring hosts to change configuration. The engineer must monitor the load distribution and adjust weights if needed.

A third scenario involves VRRP in a multi-vendor environment. Since VRRP is an open standard, it can interoperate between Cisco and Juniper routers. The engineer must be careful with the virtual IP: if it matches the physical IP of the owner, the owner always becomes master, which can be a single point of failure if that router fails. The engineer typically uses a separate virtual IP to allow any router to become master.

Common misconfigurations include mismatched timers between routers, lack of preempt causing a router not to reclaim its role after recovery, and forgetting to enable preempt on both sides. Also, tracking is often overlooked: if the active router loses its WAN uplink but remains LAN-connected, it still acts as gateway but cannot reach the internet, causing black-hole traffic. Tracking solves this by reducing priority when the uplink fails, triggering failover.