If your internet goes down for two minutes during a video call or a financial transaction, you lose money, patience, and trust. That is the problem high availability solves: networks must never stop working, even when a router crashes, a cable is cut, or software needs an update. For the 350-501 exam, you need to know exactly how Cisco routers achieve this near-perfect uptime using Non-Stop Forwarding, Non-Stop Routing, and redundancy protocols — because the exam will make you choose the right mechanism for a specific failure scenario.
Jump to a section
A simple way to picture High Availability and Redundancy Mechanisms
A busy restaurant kitchen has three chefs. The head chef is responsible for serving every order. One evening, during the dinner rush, the head chef suddenly gets sick and has to leave. Without any plan, the kitchen would go into chaos — orders pile up, food burns, and customers wait for hours.
This restaurant uses a high availability kitchen. Two backup chefs are always watching the head chef. They know every recipe by heart and have the same pre-prepared ingredients. The moment the head chef drops a ladle, the first backup chef immediately takes over, already holding the same spatula at the same point in the current order. The second backup chef stays ready in case the new head chef also falters.
The restaurant also uses non-stop cooking for its signature pasta. Even while the head chef is still working, backup chefs continuously taste the sauce and check the stove temperature. If the head chef suddenly stops stirring, the backup keeps stirring from the exact same second — not from the start of the recipe. The restaurant never pauses service. Customers get their meals without ever knowing there was a problem. This is exactly how NSF, NSR, and redundancy protocols work in a service provider network: multiple chefs (routers) and continuous handovers keep the network serving data non-stop, even when a router fails.
In a network, the head chef is the active router. The backup chefs are standby routers. NSF (Non-Stop Forwarding) lets the backup keep forwarding traffic while the routing brain reboots. NSR (Non-Stop Routing) keeps the routing brain itself running without interruption during a failover. Redundancy protocols like VRRP and BFD are the kitchen's emergency plans — they detect the dropped ladle in milliseconds and trigger the handover. Without all three, the network kitchen would crash and all digital customers would be left hungry.
High availability means designing a network so that services keep running even when something breaks. It is not about preventing failures — failures happen all the time. It is about making the failure invisible to users. In a service provider network, routers run the internet. If a router fails, every connection through it drops: every email being sent, every video call mid-conversation, every sensor reading from a smart city system. High availability prevents this disruption.
Redundancy is the foundation of high availability. You have multiple copies of critical components: two routers, two power supplies, two links between buildings. If one fails, the other takes over. But redundancy alone is not enough. You need mechanisms to make the switchover fast and seamless. That is where NSF, NSR, and redundancy protocols come in.
Non-Stop Forwarding (NSF) is a feature that lets a router keep forwarding data packets even while its control plane — the brain that makes routing decisions — is restarting or failing over. Here is how it works: Two routers share the same forwarding table. Normally, if the primary router's control plane fails, it stops telling the forwarding hardware where to send packets, so the router stops forwarding everything. With NSF, the backup router sends a 'keep forwarding with my table' message to the forwarding hardware. The data keeps flowing using the existing table, even though the brain is offline. The packets might take a suboptimal path for a few seconds, but the connection stays alive. This is critical for voice calls and VPNs, which drop if traffic stops for more than a few milliseconds.
Non-Stop Routing (NSR) is a more advanced cousin. With NSR, the routing protocol state — the detailed conversation about network topology — is synchronised in real time between the active router and the standby router. The standby has exactly the same routing information moment by moment. When a failover happens, the standby does not need to re-learn the network. It already knows every neighbour, every route, every timer. The routing neighbours (other routers) do not even notice that the active router changed. NSF requires the standby to ask neighbours for updated routing information during a failover, which adds a few seconds of disruption. NSR removes that disruption entirely. The routing neighbours see no change in the routing protocol adjacency — they keep sending traffic as if nothing happened.
Redundancy protocols are the glue that makes failover decisions. The two most important for the exam are VRRP and BFD. - VRRP (Virtual Router Redundancy Protocol): A group of routers share a single virtual IP address. The active router responds to that IP; the backups wait. If the active fails, a standby becomes active and takes the same IP. Hosts (like your home computer) are configured with this virtual IP as their default gateway, so they never notice the switch. - BFD (Bidirectional Forwarding Detection): This is an ultra-fast failure detection protocol. It sends hello packets every few milliseconds instead of the usual 5-30 seconds used by routing protocols. BFD can detect a link failure in 50 milliseconds or less. When BFD detects a failure, it tells the routing protocol immediately, triggering the failover. BFD is like a heart monitor that beeps constantly — the moment it stops, the defibrillator fires.
Why do we need both NSF/NSR and redundancy protocols? Because they solve different parts of the problem. Redundancy protocols detect the failure and switch the virtual IP. NSF/NSR ensure that after the switch, traffic keeps flowing without losing routing state. They work together. Without BFD, a routing protocol might take 30 seconds to notice a link is down — during that time, all traffic is black-holed. Without NSF/NSR, the new active router would drop every packet while it rebuilds its routing table.
The 350-501 exam expects you to know the exact differences: NSF preserves forwarding during control-plane reboot, NSR preserves routing state without neighbour involvement, BFD detects failures in milliseconds, and VRRP provides a virtual gateway for hosts. You will get scenario questions: 'A router's control plane crashes — which mechanism keeps traffic flowing?' The answer: NSF. 'The routing neighbours must not detect a change during failover' — the answer: NSR.
1. Identify the single point of failure
Before configuring any mechanism, find which component — router, link, power supply — would cause a full outage if it failed. This step determines where redundancy is needed. For example, if only one router connects a data centre to the internet, that router is a single point of failure.
2. Deploy redundant hardware and links
Install a second router and a second physical path (fibre cable, switch, etc.). This provides the physical foundation for high availability. Without two routers, no software mechanism can help. The two routers are configured identically in terms of interfaces and routing protocols.
3. Configure BFD on all critical links
Enable BFD on both routers for each interface towards neighbours. Set the detection multiplier to 3 and the minimum interval to 50ms. This ensures that if a link or the active router's control plane fails, BFD detects it in under 200ms and immediately triggers a failover, bypassing slow routing protocol timers.
4. Set up VRRP with a virtual IP and object tracking
Create a VRRP group on the interface facing the local network. Assign a virtual IP (e.g., 10.0.0.1) and set the priority of the preferred router to 110 and the backup to 100. Then add object tracking: if the preferred router loses its upstream link (tracked via an IP SLA), its priority drops by 20, making the backup automatically become Master and route traffic out through its own upstream link.
5. Enable NSF and NSR on routing protocols
On both routers, enable NSF for OSPF and BGP gracefull restart. Then enable NSR for BGP and any other routing protocols requiring zero-disruption failover. Verify with 'show ip ospf nsf' and 'show bgp nsr status'. This step ensures that during a failover, the standby router has the current forwarding table (NSF) and routing state (NSR) so traffic continues without packet loss.
6. Test with a non-disruptive manual failover
During a maintenance window, gracefully shut down the active router's control plane. Monitor traffic flows, BFD sessions, VRRP state transitions, and routing protocol adjacencies. Verify that the standby takes over with zero packet loss and zero routing resets. Document the failover time (should be under 200ms with BFD and VRRP). This step validates that all mechanisms work together before a real failure occurs.
An IT engineer at a large ISP manages the core network that connects whole cities. One day, a router in the data centre starts logging memory errors. The engineer knows from experience that this router will fail completely within the next hour. The network carries traffic for a hospital's telehealth service, a stock exchange's trading feeds, and 10,000 corporate VPNs. Disruption is not an option.
Here is what the engineer does, step by step:
First, she checks whether the router is part of a VRRP group. It is paired with an identical standby router in the same rack. The virtual IP is already configured. Hosts in the building point to that virtual IP as their default gateway. She confirms the VRRP preempt mode is disabled — that means the standby will not automatically hand back to the original router when it recovers, preventing a second disruption.
Second, she enables BFD on the link between the two routers and on all upstream links. BFD sessions are set to a 50ms detection interval. This means the standby will know within 50 milliseconds if the active router goes completely silent. Without BFD, the routing protocol OSPF would take 40 seconds to declare the active router dead.
Third, she confirms that NSF is configured on both routers. The forwarding hardware of the failing router will keep forwarding packets using the existing forwarding table, even after its control plane crashes. She checks the NSF configuration with a command that shows the NSF status: 'show ip ospf nsf'. The output confirms NSF is enabled and the graceful restart timer is set to 60 seconds — meaning the forwarding hardware will continue for 60 seconds while the control plane tries to recover.
Fourth, for the most critical traffic — the stock exchange feeds — she configures NSR on the BGP routing sessions. This is an extra step because the stock exchange's router is a business partner, not under the ISP's control. With NSR, the standby router already has real-time synchronised BGP state. When the active router fails, the standby takes over the BGP session without the stock exchange's router ever knowing. The stock exchange sees no BGP reset, no routing flap, no dropped trades.
Fifth, the engineer initiates a manual failover during the lowest-traffic period (3 AM). She gracefully shuts down the active router's control plane. The BFD timer expires in 50ms. The standby becomes the VRRP master. Because NSR is configured, the standby already has all BGP routes. Because NSF is configured, existing flows continue without packet loss. The engineer watches the monitoring dashboard: zero packet loss, zero routing flaps, zero customer complaints.
The engineer then replaces the faulty hardware. When the old router comes back online as the new standby, she re-synchronises its configuration. The network never missed a beat. This is real-world high availability in action: a combination of VRRP, BFD, NSF, and NSR working together to make a router failure invisible to everyone on the internet.
The tools the engineer used:
CLI commands: show ip vrrp brief, show bfd neighbors, show ip ospf nsf, show bgp nsr status
- Configuration: router vrrp, router bfd, router ospf nsf, router bgp nsr
- Monitoring: SNMP traps for BFD state changes, syslog for NSR synchronisation status
The 350-501 exam tests high availability and redundancy mechanisms in three specific ways: multiple-choice scenario questions, drag-and-drop ordering, and 'choose two' / 'choose three' questions. You will not be asked to configure anything — you need to understand the conceptual differences and when to use each technology.
Here are the exam topics you must know stone-cold:
NSF vs NSR: The exam loves to give a scenario describing a router that needs to maintain forwarding during a control-plane reload. If the scenario says 'neighbours must not detect any change', the answer is NSR. If it says 'forwarding continues but neighbours may see a brief interruption to learn new routes', the answer is NSF.
BFD timers: You must know that BFD can detect failures in milliseconds (typical values: 50ms, 100ms, 200ms). The exam will give you a routing protocol convergence time (like OSPF's 40 seconds) and ask which technology reduces it to milliseconds. Answer: BFD.
VRRP states: Initialise, Master, Backup. Know that the VRRP master sends advertisements every 1 second by default. Know that preempt means a higher-priority router can take over even if the current master is working.
VRRP object tracking: This lets VRRP change priority based on an external condition (like an upstream link being down). If the master loses its upstream link, VRRP reduces priority so the standby takes over.
Graceful restart in OSPF and BGP: This is another name for NSF. The exam asks: 'Which mechanism allows OSPF to continue forwarding during a control-plane restart?' Answer: OSPF Graceful Restart (a form of NSF).
NSF vs Graceful Restart: They are the same concept. Cisco uses both terms. The exam uses both interchangeably.
Common exam traps:
Trap 1: A question describes a failover that takes 5 seconds, and asks which technology caused that. Many candidates pick BFD. Wrong. BFD detects in milliseconds. The 5-second delay is because the protocol needs to re-establish adjacencies. The correct answer is that NSF without NSR was used, or only VRRP was used.
Trap 2: A question says 'the router failed and all traffic stopped. Which technology was NOT configured?' They list VRRP, BFD, NSF, NSR. The answer is VRRP — because without a virtual IP failover, hosts do not know where to send traffic after the active router dies.
Trap 3: A question says 'the active router fails, but the backup takes over and all sessions continue without any BGP reset.' Candidates pick NSF. Wrong. NSF still requires BGP to re-establish the session. The correct answer is NSR, because NSR synchronises BGP state in real time.
Key definitions to memorise:
NSF: Forwarding continues during control-plane restart; routing neighbours are involved in re-synchronisation.
NSR: Control-plane state is synchronised to standby; routing neighbours are NOT involved.
BFD: Sub-second failure detection independent of routing protocol.
VRRP: Virtual IP for default gateway redundancy; uses a master/backup model.
Graceful Restart: Same as NSF in OSPF/BGP context.
Non-Stop Forwarding (NSF) keeps data packets flowing through a router's forwarding hardware even when the control plane restarts, but it still requires neighbouring routers to help rebuild routing information.
Non-Stop Routing (NSR) synchronises the entire routing protocol state (including BGP, OSPF, IS-IS) to a standby router in real time, so neighbours never detect any change during a failover.
BFD (Bidirectional Forwarding Detection) detects link failures in as little as 50 milliseconds, which is 100x faster than OSPF's default 40-second dead interval.
VRRP provides a virtual IP address that multiple routers share; only one router is the active Master at any time, and failover is transparent to end hosts.
High availability in service provider networks requires redundancy (multiple routers/links), failure detection (BFD), and state preservation (NSF/NSR) working together — no single mechanism is enough.
The 350-501 exam differentiates NSF and NSR by whether the routing neighbour is involved in the recovery process: NSF involves neighbours, NSR does not.
Graceful Restart is Cisco's implementation of NSF in OSPF and BGP contexts; the terms are used interchangeably in the exam.
VRRP object tracking allows the Master router's priority to change based on the status of an upstream interface, forcing a failover when the Master loses its connection to the rest of the network.
These come up on the exam all the time. Here's how to tell them apart.
Non-Stop Forwarding NSF
Preserves only the forwarding table during control-plane restart
Requires routing neighbours to resupply routing information after restart
Lower memory and CPU overhead on standby router
Non-Stop Routing NSR
Preserves the full routing protocol state (including BGP, OSPF, IS-IS) on standby
Routing neighbours detect no change during failover; no re-synchronisation needed
Higher memory and CPU overhead due to real-time state synchronisation
Bidirectional Forwarding Detection BFD
Detects link failure in milliseconds (typical 50ms)
Works with any routing protocol, not tied to a specific one
Lightweight, does not carry routing information
OSPF Hello Protocol
Detects link failure in seconds (default 40 seconds)
Only works for OSPF neighbour discovery and maintenance
Carries OSPF routing information within hello packets
VRRP Virtual Router Redundancy Protocol
Only one router is active (Master) at a time
All traffic uses a single virtual IP address
Sim to configure and widely supported
GLBP Gateway Load Balancing Protocol
Multiple routers can be active simultaneously
Uses multiple virtual IP addresses or MAC addresses for load sharing
More complex configuration; Cisco proprietary (not used in service provider core as widely)
Active-Passive Redundancy
One router handles all traffic; the other sits idle until failure
Simpler to implement, no load balancing logic needed
Wasted capacity because backup router is unused during normal operation
Active-Active Redundancy
All routers handle traffic simultaneously, sharing the load
Requires load-balancing mechanisms and careful capacity planning
Efficiently uses all available hardware; no resource is idle
Mistake
NSF and NSR are the same thing — just different vendor terms for identical functionality.
Correct
NSF preserves forwarding during a control plane restart but still requires neighbours to resynchronise routing information. NSR preserves the entire routing protocol state on the standby, so neighbours are never even aware of a failure.
The names sound similar and both involve 'non-stop' behaviour. Beginners assume they are interchangeable because they solve a similar problem at a high level.
Mistake
BFD is a routing protocol that helps routers exchange traffic.
Correct
BFD is not a routing protocol. It is a lightweight, independent protocol that only detects link failures quickly and then notifies the routing protocol (like OSPF or BGP) to act. It does not carry routes or make forwarding decisions.
Because BFD is often discussed alongside OSPF and BGP, beginners mistakenly classify it as a routing protocol. Its actual purpose is specific and narrow.
Mistake
VRRP provides load balancing by distributing traffic across multiple routers at the same time.
Correct
VRRP uses a master/backup model — only one router is active at any time. The backup routers sit idle until the master fails. Load balancing requires a different protocol like GLBP (Gateway Load Balancing Protocol) or multiple VRRP groups with different virtual IPs.
The phrase 'redundancy' implies multiple active paths to many beginners. They assume that any group of redundant routers must automatically share the load.
Mistake
If you have two routers with VRRP, you do not need NSF or NSR.
Correct
VRRP only switches the virtual IP. Without NSF or NSR, when the VRRP failover occurs, the new master router starts with an empty routing table. It must learn all routes from neighbours, which takes seconds. During that time, packets arriving at the new master have no destination — they are dropped.
Beginners think that switching the IP address is enough. They overlook that the new router literally does not know where to send packets until it rebuilds its routing table.
Mistake
NSR is always better than NSF, so you should always use it.
Correct
NSR requires more memory and CPU on the standby router, and it must synchronise all routing state in real time, which adds overhead. In smaller networks or on older hardware, NSF is sufficient and more resource-efficient. The choice depends on the criticality of the traffic and hardware capabilities.
People naturally think 'more advanced = always better'. They ignore the tradeoff of resource consumption and complexity.
Mistake
High availability mechanisms mean the network never has any downtime, even during planned maintenance.
Correct
High availability mechanisms aim for near-continuous operation, but planned maintenance still requires careful procedures like graceful shutdowns and manual failovers. Even with NSF/NSR, a router can still drop traffic if not properly configured or if the backup router is also undergoing maintenance.
The term 'non-stop' creates a false impression of absolute invulnerability. In reality, human error and misconfiguration are still major sources of outage.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
In Cisco networks, they are essentially the same thing. Graceful Restart is the feature name used in OSPF and BGP routing protocols. NSF is the umbrella term. Both allow a router to continue forwarding traffic while its routing control plane reboots.
No, VRRP uses a single active master. All traffic goes to the master. For load balancing, you need multiple VRRP groups with different virtual IPs or use a protocol like GLBP (Gateway Load Balancing Protocol).
BFD only detects failures; it does not handle IP address failover. Without VRRP (or a similar protocol), hosts configured with a default gateway IP cannot automatically switch to another router. BFD plus VRRP together give fast detection and seamless IP handover.
NSR uses more memory and CPU because it must synchronise all routing state in real time. On older or resource-constrained routers, NSF is sufficient and consumes fewer resources. Also, NSR requires both routers to be from the same vendor to synchronise state properly.
High availability cannot survive a simultaneous failure of both routers. In that scenario, traffic will drop completely. The solution is to have a third backup router in a different geographic location, which involves multi-region architecture — a different topic beyond core redundancy.
Primarily, yes. VRRP creates a virtual default gateway IP that multiple routers share. However, it can also be used for other VIPs (Virtual IPs) in service provider networks, such as for router loopback addresses, but its most common use is default gateway redundancy.
You've finished High Availability and Redundancy Mechanisms. Continue through the 350-501 study guide to build a complete picture of the exam.
Done with this chapter?