Virtual IP and First-Hop Redundancy Protocols

In a typical IP network, each host is configured with a default gateway IP address to reach subnets beyond its local segment. If that gateway router fails, all hosts lose connectivity to remote networks. First-Hop Redundancy Protocols (FHRPs) solve this by allowing two or more routers to share a virtual IP (VIP) and virtual MAC address. Hosts are configured with the VIP as their default gateway. One router is active and forwards traffic; the others are standby. If the active fails, a standby takes over transparently, with minimal or no packet loss.

The virtual IP is an IP address that is not assigned to any physical interface but is shared among the FHRP group members. The virtual MAC is a specially formatted MAC address that the active router uses to respond to ARP requests for the VIP. For example, HSRP uses the format 0000.0c07.acXX where XX is the group number in hex. VRRP uses 0000.5e00.01XX. GLBP uses a different scheme (0007.b400.XXYY). The virtual MAC ensures that when the active router fails, the new active router can start using the same MAC, so the ARP cache of hosts does not need to update.

HSRP is a Cisco proprietary protocol defined in RFC 2281. It operates on UDP port 1985 and uses multicast address 224.0.0.2 (all routers) with TTL 1. HSRP has an active/standby model. The active router forwards traffic for the virtual IP. The standby router monitors the active via hello messages every 3 seconds by default (hold time 10 seconds). HSRP supports up to 255 groups per interface, and each group has a priority (default 100). The router with the highest priority becomes active. If priorities are equal, the highest IP address wins. HSRP has two versions: version 1 uses group numbers 0-255 and virtual MAC 0000.0c07.acXX; version 2 increases group numbers to 0-4095, uses multicast 224.0.0.102, and supports IPv6. HSRP also supports preemption (disabled by default) and interface tracking to decrement priority if a tracked interface goes down.

VRRP is an open standard (RFC 5798) that is very similar to HSRP. It uses IP protocol 112 and multicast address 224.0.0.18. VRRP has an active/standby model where the active is called the master, and the standby are backups. The virtual MAC is 0000.5e00.01XX. VRRP default hello interval is 1 second (master advertisement interval), and the backup dead interval is 3 seconds (3 x advertisement interval). VRRP supports preemption by default (unlike HSRP). Priority range is 1-254 (default 100). The router with the highest priority becomes master; if equal, the highest IP wins. VRRP can track objects to adjust priority. VRRP is preferred in multi-vendor environments due to its open standard nature.

GLBP is another Cisco proprietary protocol that provides both redundancy and load balancing. Unlike HSRP/VRRP where only one router forwards traffic, GLBP allows multiple routers to forward traffic simultaneously. GLBP uses a single virtual IP and multiple virtual MACs. One router is elected as the Active Virtual Gateway (AVG) and assigns virtual MAC addresses to other routers (Active Virtual Forwarders, AVFs). The AVG responds to ARP requests with different virtual MACs in a round-robin fashion, distributing the load. GLBP uses multicast 224.0.0.102 and UDP port 3222. It supports up to 4 forwarders per group. GLBP has a hello interval of 3 seconds and hold time of 10 seconds. Preemption is disabled by default. GLBP is useful when you want to utilize all available gateway bandwidth, not just for failover.

In HSRP and VRRP, the election of the active/master router occurs when the group is first configured or when the current active fails. The router with the highest priority wins. If priorities are equal, the highest IP address is used as a tiebreaker. In VRRP, the master sends advertisements every 1 second. If a backup does not receive an advertisement for 3 seconds, it declares itself master. In HSRP, hello interval is 3 seconds, hold time 10 seconds. These timers are configurable. GLBP election is similar for AVG, but AVFs are assigned by the AVG.

When the active router fails, the standby router detects the failure (via missed hellos) and takes over the virtual IP and MAC. In HSRP, the new active router sends a gratuitous ARP to update the switch MAC table. In VRRP, the master sends an ARP reply. The failover time is typically 3-10 seconds depending on timers. Subsecond failover can be achieved with features like HSRP Fast Hello (200ms hello, 700ms hold) or VRRP with millisecond timers. Convergence also depends on the switch learning the new MAC location. In GLBP, if an AVF fails, the AVG reassigns its virtual MAC to another AVF.

HSRP (Cisco IOS):

interface GigabitEthernet0/0
 ip address 192.168.1.2 255.255.255.0
 standby 1 ip 192.168.1.1
 standby 1 priority 110
 standby 1 preempt
 standby 1 track GigabitEthernet0/1 20

VRRP (Juniper):

set interfaces ge-0/0/0 unit 0 family inet address 192.168.1.2/24 vrrp-group 1 virtual-address 192.168.1.1
set interfaces ge-0/0/0 unit 0 family inet address 192.168.1.2/24 vrrp-group 1 priority 110
set interfaces ge-0/0/0 unit 0 family inet address 192.168.1.2/24 vrrp-group 1 preempt

GLBP (Cisco IOS):

interface GigabitEthernet0/0
 ip address 192.168.1.2 255.255.255.0
 glbp 1 ip 192.168.1.1
 glbp 1 priority 110
 glbp 1 preempt

FHRPs often interact with STP (Spanning Tree Protocol). If the active router's uplink fails, STP may cause a topology change, but FHRP can track interfaces to failover faster. FHRPs also interact with DHCP: the virtual IP should be used as the default gateway in DHCP scopes. In cloud environments, FHRPs are often replaced by cloud-native load balancers or floating IPs (e.g., AWS Elastic IP).

| Protocol | Hello Interval | Hold/Dead Interval | Preemption Default | Multicast Address | |----------|----------------|--------------------|--------------------|-------------------| | HSRP v1 | 3 seconds | 10 seconds | Disabled | 224.0.0.2 | | HSRP v2 | 3 seconds | 10 seconds | Disabled | 224.0.0.102 | | VRRP | 1 second | 3 seconds | Enabled | 224.0.0.18 | | GLBP | 3 seconds | 10 seconds | Disabled | 224.0.0.102 |

A large enterprise has a data center with two Cisco routers acting as default gateways for hundreds of servers in a VLAN. They use HSRP with preemption disabled to avoid flapping. The virtual IP is 10.0.0.1. The primary router has priority 110, the secondary has priority 100. Interface tracking is configured: if the primary's uplink to the WAN fails, its priority drops by 20, causing the secondary to take over. This setup provides automatic failover within 10 seconds. The network team monitors HSRP state via SNMP and logs. Misconfiguration often occurs when preemption is enabled but not desired: if the primary comes back after a brief outage, it preempts and causes a second failover, disrupting traffic. Another common issue is mismatched authentication strings (HSRP supports MD5 authentication) causing group members to ignore each other.

A university campus uses switches from different vendors (Cisco, Juniper, HP) in the distribution layer. They deploy VRRP because it is an open standard and works across vendors. Each building has two distribution switches with VRRP group 1. The virtual IP is the default gateway for the building's access VLANs. Preemption is left enabled (default) so that the primary router with higher priority always resumes forwarding after a failure. This is acceptable because the failover is fast (3 seconds). The network team uses show vrrp to verify state. A common pitfall is forgetting that VRRP uses IP protocol 112, which must be allowed in any ACLs between the routers. Also, the virtual MAC 0000.5e00.01XX must not be blocked by switch port security.

A company migrating to a hybrid cloud uses GLBP in their on-premises network to distribute outbound traffic across two routers. The AVG assigns virtual MACs to both routers. Hosts receive different default gateway MACs via ARP, so traffic is load-balanced. This maximizes WAN link utilization. The network engineer configures GLBP with weighted load balancing instead of round-robin. A misconfiguration occurs when the AVG fails: the new AVG reassigns virtual MACs, but if the routers have different forwarding capabilities, the load balance becomes uneven. The solution is to use GLBP with host-dependent load balancing if needed.