Lab: Configure HSRP for Gateway Redundancy

HSRP (Hot Standby Router Protocol) is a Cisco-proprietary First Hop Redundancy Protocol (FHRP) that provides default gateway redundancy. In a typical LAN, hosts are configured with a single default gateway IP address. If that router fails, hosts lose connectivity to remote networks. HSRP solves this by creating a virtual router—a combination of a virtual IP address and virtual MAC address—that is shared among a group of physical routers. One router is elected as Active and forwards packets for the virtual IP; another is elected as Standby and takes over if the Active fails. This allows hosts to use a single gateway IP while enjoying redundancy.

1. HSRP Group – A group of routers that share a virtual IP and MAC. Group number ranges from 0 to 255 (0-4095 for HSRPv2). 2. Virtual MAC Address – For HSRPv1: 0000.0c07.acXX where XX is the group number in hex. For HSRPv2: 0000.0c9f.fXXX where XXX is the group number in hex. 3. Hello Messages – Routers send Hellos every 3 seconds (default) to UDP port 1985 (HSRPv1) or 1986 (HSRPv2), destination IP 224.0.0.2 (all-routers multicast). 4. State Transitions – Each router goes through states: Initial → Learn → Listen → Speak → Standby → Active. - Initial: Router just started HSRP. - Learn: Router doesn't know virtual IP, waiting to hear from Active. - Listen: Router knows virtual IP, monitoring Hellos. - Speak: Router sends Hellos, participating in election. - Standby: Router is next in line to become Active. - Active: Router forwards packets for the virtual IP. 5. Election – The router with the highest priority (default 100) becomes Active. If tie, highest IP wins. Priority can be configured from 0 to 255 (0 means router will never become Active). 6. Preemption – By default, a router with higher priority will not take over an already Active router. Preemption must be enabled to allow it. 7. Timers – Hello timer: 3 seconds (default). Hold timer: 10 seconds (default). The Standby router declares Active dead if no Hello is received within the Hold time.

Below is a typical HSRP configuration on two routers (R1 and R2) for VLAN 10.

R1 Configuration:

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 10.0.10.2 255.255.255.0
 standby 10 ip 10.0.10.1
 standby 10 priority 110
 standby 10 preempt
 standby 10 authentication md5 key-string CISCO

R2 Configuration:

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 10.0.10.3 255.255.255.0
 standby 10 ip 10.0.10.1
 standby 10 priority 100
 standby 10 preempt
 standby 10 authentication md5 key-string CISCO

`show standby` – Displays HSRP status for all groups.

R1# show standby
GigabitEthernet0/0.10 - Group 10
  State is Active
    2 state changes, last state change 00:01:23
  Virtual IP address is 10.0.10.1
  Active virtual MAC address is 0000.0c9f.f00a
  Local virtual MAC address is 0000.0c9f.f00a (v2 default)
  Hello time 3 sec, hold time 10 sec
  Next hello sent in 1.456 secs
  Authentication MD5, key-string
  Preemption enabled
  Active router is local
  Standby router is 10.0.10.3, priority 100 (expires in 9.456 sec)
  Priority 110 (configured 110)
  Group name is "hsrp-Gi0/0.10-10" (default)

`show standby brief` – Compact view.

R1# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Gi0/0.10    10   110 P Active  local           10.0.10.3       10.0.10.1

In enterprise networks, HSRP is commonly deployed at the distribution layer where two routers (or multilayer switches) provide redundant Layer 3 access to users. For example, in a campus network with multiple VLANs, each VLAN may have its own HSRP group. A typical design is to load-balance by making one switch Active for half the VLANs and Standby for the other half. This is achieved by configuring different priorities per group.

Another scenario is at the WAN edge, where two routers connect to different ISPs. HSRP provides a virtual gateway for internal hosts, while each router handles its own ISP link. If one router fails, the other takes over all traffic. In this case, you might use HSRP with tracking—where the router's priority is reduced if its uplink goes down, forcing failover to the other router.

Misconfigurations are common. One frequent issue is forgetting to enable preemption—after a failure, the original Active router may come back but not reclaim its role, leading to suboptimal routing. Another is mismatched authentication keys, which silently prevents HSRP adjacency. Also, if the virtual IP is accidentally assigned to a physical interface (e.g., as a secondary IP), it can cause IP address conflicts.

In production, you should also consider HSRP timers. The default 3-second hello and 10-second hold may be too slow for some applications. You can adjust them with standby <group> timers <hello> <hold>. However, setting them too low can cause flapping. A common production setting is 1 second hello / 3 second hold for faster convergence.

Finally, remember that HSRP operates at Layer 3—it requires IP connectivity between the routers. If the link between them goes down, they can't exchange Hellos, and both may become Active (split-brain). To prevent this, use a separate management VLAN or configure interface tracking to reduce priority when a critical interface fails.