This chapter covers a NEW objective in the CCNA v2 exam (200-301 v2.0, 2026 blueprint): interpreting the operational status of HSRP and VRRP. Cisco added this to reflect real-world demands for resilient first-hop redundancy in modern networks. Mastering the states, timers, and verification commands is essential not only for passing the exam but also for troubleshooting and designing highly available LANs. This objective falls under the IP Routing domain (20% of the exam).
Jump to a section
Imagine a large office building with a critical server room. The building has two backup generators: Generator A (primary) and Generator B (standby). Both are connected to the main electrical panel, but only one generator runs at a time to power the building. Generator A is the Active generator—it supplies power and sends a heartbeat signal (a 'still alive' pulse) every 3 seconds to a monitoring panel. Generator B listens for this heartbeat. If Generator B misses three consecutive heartbeats (9 seconds), it assumes Generator A has failed and starts its own engine, taking over power delivery. The monitoring panel tracks which generator is active and updates a status display. In networking terms, the generators are routers, the heartbeat is an HSRP hello message, the 3-second timer is the hello timer, and the 9-second timer is the hold timer. The monitoring panel is like the 'show standby' command output. If both generators try to run simultaneously, they could overload the panel—just like two routers both claiming to be Active would cause traffic loops. To prevent this, the generators use a priority scheme: the one with higher priority (e.g., 150) becomes Active; if priorities are equal, the higher IP address wins. This ensures a clear, orderly failover.
What are HSRP and VRRP?
HSRP (Hot Standby Router Protocol) and VRRP (Virtual Router Redundancy Protocol) are First Hop Redundancy Protocols (FHRPs) that provide default gateway redundancy. They allow multiple routers to share a virtual IP (VIP) and virtual MAC address. One router is the Active/Forwarding router, handling all traffic for the VIP; the others are Standby/Backup, ready to take over if the Active fails. HSRP is Cisco proprietary; VRRP is an open standard (RFC 5798). The exam tests your ability to interpret their operational status using show commands.
How They Work at the Packet Level
Virtual IP and MAC: An HSRP group uses a virtual MAC address (0000.0c07.acXX for HSRPv1, 0000.0c9f.fXXX for HSRPv2) where XX/XXX is the group number in hex. VRRP uses 0000.5e00.01XX. Routers in the group send periodic hello messages to the multicast address 224.0.0.2 (HSRPv1) or 224.0.0.102 (HSRPv2/VRRP) using UDP port 1985 (HSRP) or IP protocol 112 (VRRP).
State Machine: HSRP has six states: Initial, Learn, Listen, Speak, Standby, Active. VRRP has three: Initialize, Master, Backup. The key transition: A router in Standby/Backup becomes Active/Master when it no longer hears hellos from the current Active/Master.
Timers and Defaults:
HSRP default hello timer: 3 seconds; hold timer: 10 seconds (3.3 x hello).
VRRP default advertisement interval: 1 second; master down interval: 3.609 seconds (3 x advertisement + skew time).
Timers can be adjusted per group.
Election: The router with the highest priority (default 100, range 1-255) becomes Active/Master. If priorities are equal, the highest IP address wins. Preemption is disabled by default in HSRP, meaning a higher-priority router that joins later does not take over unless configured with 'standby preempt'.
Verification Commands
Use 'show standby' and 'show vrrp' to check status. Example output for HSRP:
Router# show standby
GigabitEthernet0/0 - Group 10
Local state is Active, priority 150, may preempt
Hellotime 3 holdtime 10
Virtual IP address 192.168.1.1
Active virtual MAC address 0000.0c07.ac0a
Local virtual MAC address 0000.0c07.ac0a
Standby virtual MAC address 0000.0c07.ac0a
Standby router is 192.168.1.3, priority 100 expires in 00:00:08
Standby virtual MAC address is 0000.0c07.ac0a
2 state changes, last state change 00:10:23Key fields: state (Active/Standby), priority, hellotime/holdtime, virtual IP, active router, standby router, and timers.
For VRRP:
Router# show vrrp
GigabitEthernet0/0 - Group 1
State is Master
Virtual IP address 192.168.1.1
Virtual MAC address 0000.5e00.0101
Advertisement interval 1.000 sec
Preemption enabled
Priority 150
Master Router is 192.168.1.2 (local), priority 150
Master Advertisement interval 1.000 sec
Master Down interval 3.609 secInteraction with Related Protocols
HSRP/VRRP operate independently of the routing protocol (OSPF, EIGRP). The Active router still participates in dynamic routing. FHRPs rely on the fact that hosts send traffic to the VIP; the Active router then forwards it. If the Active fails, the Standby takes over the VIP and MAC, so traffic flow resumes seamlessly.
Exam-Specific Details
HSRPv1 vs v2: v2 supports IPv6 and group numbers up to 4095, uses different multicast address.
VRRP allows multiple virtual routers on one physical router (VRRP group).
'show standby brief' gives a quick summary.
Verify HSRP State with show standby
Use 'show standby' to view detailed state information for all HSRP groups. Look for 'Local state is Active' or 'Local state is Standby'. Also note the priority, hellotime, and holdtime. If the state is 'Init', the interface may be down or the group is misconfigured. Check that the virtual IP is correct and that the standby router IP is listed. The 'expires in' field shows the hold timer countdown; if it resets, hellos are being received.
Check HSRP Summary with show standby brief
Use 'show standby brief' for a one-line summary per interface. Output includes: interface, group, priority, state (Active/Standby/Init), Active router IP, Standby router IP, and timers. This is useful for a quick health check across multiple groups. If a group shows 'Init', investigate the interface status and IP configuration.
Verify VRRP State with show vrrp
Use 'show vrrp' to see VRRP group details. Look for 'State is Master' or 'State is Backup'. Check the advertisement interval, preemption status, and Master router. The 'Master Down interval' shows the time before a Backup takes over. If the state is 'Initialize', the interface may be down. Compare the virtual IP with the expected gateway.
Check VRRP Summary with show vrrp brief
Use 'show vrrp brief' for a compact view. It shows interface, group, priority, state, Master IP, and Backup IP. This command is fast and helps identify which router is currently the Master. If no Master is listed, there may be a layer 2 issue or all routers are in Initialize state.
Interpret State Transitions Using Debug
Use 'debug standby' or 'debug vrrp' to see state changes in real time. For example, 'debug standby events' shows hello messages and timer expirations. This is useful for troubleshooting why a router is not becoming Active. Look for 'Active router is 0.0.0.0' indicating no Active heard. Remember that debug commands are CPU-intensive and should be used carefully in production.
Analyze Timers and Preemption
Check if preemption is enabled ('standby preempt' or 'vrrp preempt'). If preemption is off, a higher-priority router joining later will not become Active/Master until the current one fails. This can cause unexpected behavior. Also verify timer values: default HSRP hellotime 3, holdtime 10; VRRP advertisement 1 sec. Mismatched timers can cause flapping.
Scenario 1: Campus Network Core Redundancy A university has two distribution switches (Cisco 9300) acting as default gateways for multiple VLANs. Each VLAN has an HSRP group. The network engineer configures priority 150 on the primary switch and 100 on the secondary, with preemption enabled. This ensures that after a failure, the primary resumes forwarding when it recovers. The engineer uses 'show standby brief' to verify all groups have the expected Active router. In production, they set hello timers to 1 second and hold to 3 seconds for faster failover, but this increases CPU load. They monitor with SNMP traps for state changes.
Scenario 2: Data Center Active-Standby Gateway A data center uses VRRP for the server farm default gateway. Two routers (Cisco ASR 1000) are in a VRRP group. The engineer sets priority 200 on the primary and 100 on the backup, with preemption enabled. The advertisement interval is set to 1 second. During maintenance, they shut down the primary interface; the backup becomes Master within 3.6 seconds. They verify with 'show vrrp' and see 'State is Master'. After re-enabling the primary, it preempts and becomes Master again. The engineer notes that VRRP's preemption is enabled by default, unlike HSRP.
Scenario 3: Troubleshooting a Flapping HSRP Group A company reports intermittent connectivity. The engineer finds HSRP is flapping between Active and Standby. Using 'debug standby events', they see 'Hello packet lost' messages. They discover that the switchport connecting the two routers has a spanning-tree portfast misconfiguration causing brief outages. After fixing the portfast and setting 'standby timers 1 3', the group stabilizes. This highlights the importance of layer 2 stability for FHRPs.
Common Misconfiguration: Forgetting to configure the virtual IP on both routers. This leads to 'Init' state. Always verify 'show standby' shows the virtual IP.
Exam Objective 3.4: Interpret HSRP and VRRP operational status
The 200-301 v2.0 exam expects you to read 'show standby' and 'show vrrp' output and determine which router is Active/Master, which is Standby/Backup, and whether timers and preemption are configured correctly. You will not be asked to configure from scratch but may need to identify misconfigurations.
Common Wrong Answers and Traps: 1. Confusing HSRP states: Candidates often think 'Standby' means the router is not ready. In HSRP, 'Standby' is a normal state meaning it is the backup and ready to take over. 'Listen' and 'Speak' are transient states during election. 2. Assuming preemption is enabled by default: HSRP preemption is disabled by default; VRRP preemption is enabled. Many candidates miss this and think a higher-priority router will always become Active immediately. 3. Misreading timers: The hold timer in HSRP is 10 seconds by default, not 3. The 'expires in' field shows remaining time before the hold timer expires. If it keeps resetting, hellos are being received. If it reaches 0, the router declares Active dead. 4. VRRP Master Down interval: Candidates often think it's exactly 3 seconds, but it's 3 * advertisement + (256 - priority)/256. For default priority 100, it's 3.609 seconds. 5. Virtual MAC confusion: HSRPv1 MAC is 0000.0c07.acXX; VRRP is 0000.5e00.01XX. The exam may ask which MAC belongs to which protocol.
Decision Rule for Scenario Questions:
If the question asks which router forwards traffic for the virtual IP, look for the router in 'Active' (HSRP) or 'Master' (VRRP) state.
If both routers show 'Init', the virtual IP is missing or the interface is down.
If a higher-priority router is not taking over, check if preemption is disabled.
Specific Values to Memorize:
HSRP default hello: 3s, hold: 10s.
VRRP default advertisement: 1s, Master Down: 3.609s.
HSRP multicast: 224.0.0.2 (v1), 224.0.0.102 (v2).
VRRP multicast: 224.0.0.18.
HSRP UDP port 1985, VRRP IP protocol 112.
HSRP default hello timer is 3 seconds, hold timer is 10 seconds.
VRRP default advertisement interval is 1 second, Master Down interval is approximately 3.609 seconds (3 x adv + skew).
HSRP preemption is disabled by default; VRRP preemption is enabled by default.
Use 'show standby' to see HSRP state, priority, and timers; 'show vrrp' for VRRP.
HSRPv1 uses multicast 224.0.0.2, HSRPv2 uses 224.0.0.102; VRRP uses 224.0.0.18.
Virtual MAC: HSRPv1 = 0000.0c07.acXX, VRRP = 0000.5e00.01XX.
[CCNA v2 NEW] This objective requires interpreting 'show standby' and 'show vrrp' output—a skill not tested in v1.1. Candidates must now read operational states and timers, not just configure.
These come up on the exam all the time. Here's how to tell them apart.
HSRP
Cisco proprietary
Uses UDP port 1985, multicast 224.0.0.2 (v1) or 224.0.0.102 (v2)
Default hello 3s, hold 10s
Preemption disabled by default
Virtual MAC: 0000.0c07.acXX (v1) or 0000.0c9f.fXXX (v2)
States: Initial, Learn, Listen, Speak, Standby, Active
VRRP
Open standard (RFC 5798)
Uses IP protocol 112, multicast 224.0.0.18
Default advertisement 1s, Master Down ~3.609s
Preemption enabled by default
Virtual MAC: 0000.5e00.01XX
States: Initialize, Backup, Master
Mistake
HSRP Standby state means the router is not ready to forward traffic.
Correct
In HSRP, Standby is a normal state where the router is the backup and ready to immediately become Active if the Active fails. It is fully operational.
Candidates confuse 'Standby' with 'Init' or 'Listen' states.
Mistake
VRRP preemption is disabled by default.
Correct
VRRP preemption is enabled by default (RFC 5798). A higher-priority Backup will preempt the current Master.
HSRP has preemption disabled by default, so candidates assume VRRP is the same.
Mistake
The hold timer in HSRP is always three times the hello timer.
Correct
The default hold timer is 10 seconds, which is approximately 3.3 times the default hello of 3 seconds. It can be configured independently.
Many resources oversimplify as '3 times hello', but the actual default is 10 seconds.
Mistake
Both HSRP and VRRP use UDP port 1985.
Correct
Only HSRP uses UDP port 1985. VRRP uses IP protocol 112 (not UDP or TCP).
Candidates often lump both protocols together as using the same transport.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Both indicate the router is ready to take over as the forwarding router. In HSRP, Standby is a stable state after the router has learned the virtual IP and is monitoring the Active. In VRRP, Backup is the equivalent. The main difference is that HSRP has additional transient states (Listen, Speak) while VRRP only has Initialize, Backup, Master. For the exam, remember that both protocols have a backup role that is ready for failover.
For HSRPv1, the virtual MAC is 0000.0c07.acXX, where XX is the group number in hex. For example, MAC 0000.0c07.ac0a corresponds to group 10 (0x0A). For HSRPv2, the MAC is 0000.0c9f.fXXX (3 hex digits for group). For VRRP, the MAC is 0000.5e00.01XX, where XX is the group number in hex (up to 255).
Yes, you can configure multiple HSRP groups on the same interface, each with its own virtual IP and MAC. This is called MHSRP (Multiple HSRP). Each group operates independently. This allows load balancing by having different groups active on different routers. The same applies to VRRP with multiple virtual routers.
The Init state means the interface is not yet ready for HSRP. Common causes: the interface is administratively down, the interface has no IP address, or the virtual IP is not configured. Check the interface status with 'show ip interface brief'. Also ensure the virtual IP is configured with 'standby <group> ip <ip>'.
The skew time is (256 - priority) / 256 seconds. It is added to the Master Down interval to stagger failover among multiple backups. For priority 100, skew = (256-100)/256 = 156/256 = 0.609 seconds. So Master Down = 3 * adv + skew = 3 + 0.609 = 3.609 seconds. This prevents multiple backups from becoming Master simultaneously.
Use 'show standby' for HSRP or 'show vrrp' for VRRP. The output includes 'Active virtual MAC address' or 'Virtual MAC address'. You can also use 'show mac address-table' on the switch to see which MAC is associated with the router port.
If priorities are equal, the router with the higher IP address on the interface becomes Active. This is the tiebreaker. For VRRP, the same rule applies: higher IP address wins if priorities are equal.
You've just covered Interpreting HSRP and VRRP Operational Status — now see how well it sticks with free CCNA 200-301 practice questions. Full explanations included, no account needed.
Done with this chapter?