FHRP: HSRP, VRRP, and GLBP Concepts

A First Hop Redundancy Protocol (FHRP) allows two or more routers to share a single virtual IP address and virtual MAC address, acting as a single default gateway for hosts on a LAN. If the active router fails, another router automatically takes over, ensuring uninterrupted connectivity. Without FHRP, hosts configured with a static default gateway would lose connectivity until the gateway IP is manually changed or DHCP renews. FHRP solves this by making the gateway itself redundant.

In a typical IP subnet, hosts are configured with a default gateway—usually a single router interface. If that router fails, all hosts lose off-subnet connectivity. Dynamic routing protocols can reroute traffic around the failed router, but hosts do not participate in routing protocols; they only know their configured gateway. FHRP provides a virtual gateway that is always available, transparent to the hosts.

CompTIA Network+ N10-009 focuses on three FHRPs: - HSRP (Hot Standby Router Protocol) – Cisco proprietary, defined in RFC 2281. - VRRP (Virtual Router Redundancy Protocol) – IEEE standard 376, defined in RFC 5798. - GLBP (Gateway Load Balancing Protocol) – Cisco proprietary, defined in RFC 2281-like but with load balancing.

HSRP is Cisco's original FHRP. It creates a virtual router with a virtual IP and virtual MAC (0000.0c07.ac where is the HSRP group number in hex). HSRP routers elect one Active router and one Standby router; the rest are listening. The Active forwards traffic for the virtual IP. The Standby monitors the Active and takes over if it fails.

Key HSRP values: - Hello timer: 3 seconds - Hold timer: 10 seconds (3 × hello + skew) - Active/Standby election: Higher priority (default 100) wins; if tie, higher IP wins. - Preemption: Disabled by default (a higher-priority router that comes up later will not take over). - Virtual MAC: 0000.0c07.acXX (XX = group number in hex)

HSRP States: 1. Initial – router not yet configured 2. Listen – router knows virtual IP but not active/standby 3. Speak – router sends hello messages and participates in election 4. Standby – candidate to become active 5. Active – currently forwarding traffic for the virtual IP

Configuration example (Cisco IOS):

interface GigabitEthernet0/0
 ip address 192.168.1.2 255.255.255.0
 standby 1 ip 192.168.1.1
 standby 1 priority 110
 standby 1 preempt

VRRP is an open standard (RFC 5798). It is very similar to HSRP but with some differences. VRRP uses the term Master instead of Active, and Backup instead of Standby. The virtual MAC is 0000.5e00.01XX where XX is the VRRP group number in hex.

Key VRRP values: - Advertisement interval: 1 second (default) - Master down interval: 3 × advertisement interval + skew time (based on priority) - Priority: 0-255 (default 100); 255 is reserved for the IP address owner - Preemption: Enabled by default - Virtual MAC: 0000.5e00.01XX

Key differences from HSRP: - VRRP allows the router that owns the virtual IP (IP address owner) to have priority 255 automatically. - VRRP uses a single multicast address (224.0.0.18) vs HSRP's 224.0.0.2 (HSRPv1) or 224.0.0.102 (HSRPv2). - VRRP supports authentication (simple text or MD5) – HSRP also supports authentication. - VRRP preempts by default; HSRP does not.

Configuration example (Cisco IOS):

interface GigabitEthernet0/0
 ip address 192.168.1.2 255.255.255.0
 vrrp 1 ip 192.168.1.1
 vrrp 1 priority 110

GLBP is Cisco proprietary and provides load balancing among multiple routers in addition to redundancy. Instead of a single active router, GLBP allows up to four routers to forward traffic simultaneously. GLBP introduces the concept of an Active Virtual Gateway (AVG) and multiple Active Virtual Forwarders (AVFs).

How GLBP works: - One router is elected as AVG. The AVG assigns a virtual MAC address to each member router (AVF). - When a host sends an ARP request for the virtual IP, the AVG responds with one of the virtual MACs based on a load-balancing algorithm (round-robin, weighted, or host-dependent). - Each AVF forwards traffic for its assigned virtual MAC. - If an AVF fails, the AVG redistributes its virtual MAC to another AVF. - GLBP uses a virtual MAC range: 0007.b400.XXYY where XX is the GLBP group number and YY is the AVF number.

Key GLBP values: - Hello timer: 3 seconds - Hold timer: 10 seconds - AVG election: Higher priority (default 100) wins; if tie, higher IP wins. - Preemption: Disabled by default for AVG; can be enabled. - Load balancing methods: round-robin (default), weighted, host-dependent. - Maximum of 4 AVFs per group.

Configuration example (Cisco IOS):

interface GigabitEthernet0/0
 ip address 192.168.1.2 255.255.255.0
 glbp 1 ip 192.168.1.1
 glbp 1 priority 110
 glbp 1 preempt
 glbp 1 load-balancing round-robin

HSRP and GLBP have default hello of 3 seconds and hold of 10 seconds. VRRP has a default advertisement of 1 second, giving faster convergence (3 seconds). Sub-second timers can be configured for faster failover but increase CPU load.

Each FHRP uses a specific OUI for virtual MACs:

The XX is the group number in hex (0-255). For GLBP, YY is the AVF number (1-4).

All three protocols use priority (1-255) to determine the active/master/AVG. Higher priority wins. If priorities are equal, the highest IP address wins. HSRP and GLBP have preemption disabled by default; VRRP has it enabled by default.

HSRP and VRRP support simple text and MD5 authentication. GLBP does not support authentication in most implementations. Authentication prevents unauthorized routers from participating in the group.

FHRPs can track an interface or route. If the tracked object goes down, the router's priority is reduced, causing a failover. This is critical for detecting upstream failures.

Example:

interface GigabitEthernet0/0
 standby 1 ip 192.168.1.1
 standby 1 track GigabitEthernet0/1 20

If G0/1 goes down, priority decreases by 20, triggering a new election.

In enterprise campus networks, FHRP is deployed at the distribution layer to provide gateway redundancy for each VLAN. A typical design uses two distribution switches (e.g., Cisco 4500s) in a VSS or stack, but for physical redundancy, each switch runs its own routing engine. Each VLAN is configured with an FHRP group (HSRP or VRRP). The two switches are connected to multiple access switches via L2 trunks. The active router for VLAN 10 might be Distribution-1, while for VLAN 20 it might be Distribution-2, achieving load sharing. This is called 'gateway load balancing' even with HSRP/VRRP by using multiple groups with different active routers.

In data center environments, FHRP is often replaced by more advanced technologies like VPC (Virtual Port Channel) or FabricPath, but many legacy designs still use HSRP/VRRP. For example, a pair of Nexus 7000 switches running VRRP for each VLAN. The key consideration is convergence time—VRRP with sub-second timers can achieve failover under 1 second, which is critical for latency-sensitive applications.

A common misconfiguration is forgetting to enable preemption. If the primary router fails and later recovers, it will not reclaim its active role, leaving a lower-priority router as active. This can cause suboptimal traffic flows. Another issue is mismatched virtual IPs across routers—if one router has a different virtual IP, the group will not form. Also, if the physical IPs are not in the same subnet as the virtual IP, FHRP will not work.

In cloud environments (AWS, Azure), FHRP is not used because the hypervisor provides gateway redundancy natively. However, for on-premises hybrid cloud, FHRP may still be used for the on-premises segment.

Performance considerations: FHRP adds minimal overhead—hello packets are small (about 40 bytes). The main performance impact is during failover when the new active router must populate its ARP cache for all active flows. This can cause brief packet loss. Using preemption and object tracking helps maintain deterministic behavior.

Troubleshooting: Use debug standby (HSRP), debug vrrp, or debug glbp to see hello messages and state changes. Common issues include ACLs blocking multicast traffic (224.0.0.2, 224.0.0.18, 224.0.0.102), authentication mismatch, and duplicate virtual IPs.