PracticeLabs
Week 50%

Lesson 7 — First-Hop Redundancy (HSRP)

Week 5Lesson 7Required32 min estimated0% progress

First-Hop Redundancy (HSRP)

Explain why hosts need a redundant default gateway and how HSRP delivers one — a shared virtual IP and virtual MAC with an active/standby pair — then predict failover and fail-back behaviour.

Lesson orientation

What you'll learn (4 objectives)~32 min: video → lesson → check → apply → lab prep

Learning objectives

  • Explain the single-gateway problem FHRP solves and the role of the virtual IP and virtual MAC
  • Describe HSRP active/standby operation and what happens when the active router fails
  • Predict the active router from priority and the physical-IP tiebreaker, and explain preemption
  • Read show standby brief to identify active, standby, virtual IP, and priority

Terms you will see

FHRPVirtual IPVirtual MACHSRPVRRPGLBPActive / standbyPreemptionGratuitous ARP

Time breakdown

  • Read the notes20 min
  • Failover prediction12 min

Assigned video

Opens on YouTube
Optional video

Free CCNA | First Hop Redundancy Protocols | Day 29 | CCNA 200-301 Complete Course

By Jeremy's IT Lab · Opens externally on YouTube

Assigned watch
~6 min
Watch on YouTube(opens in a new tab)

The link opens in a new browser tab. Return here when you finish watching.

Watch for these concepts

  • FHRP purpose and HSRP active/standby operation

Go beyond the video

The assigned video introduces the idea. CCNA Practice Labs completes the learning path: clarify core concepts, explore how each device behaves, visualize the communication path, check your understanding, and prepare for hands-on lab work.

Watch the concept → understand it → visualize it → practice it → apply it.

One gateway, two routers, no host reconfiguration

A host has exactly one default gateway address. Put two physical routers on the subnet and you face a dilemma: point every host at R1 and R1 becomes a single point of failure; split the hosts between R1 and R2 and a failure still strands half of them, with manual recovery needed on every affected PC.

First Hop Redundancy Protocols solve this by presenting a virtual gateway: a virtual IP and a matching virtual MAC, shared by the routers. Hosts use the virtual IP as their default gateway and never know — or need to care — which physical router is actually forwarding.

The CCNA FHRP family — three protocols, one idea
ProtocolStandardModelVirtual MAC prefix
HSRPCisco proprietaryActive / standby0000.0C — full form 0000.0c07.acXX
VRRPOpen standard (RFC)Active / standby0000.5E
GLBPCisco proprietaryActive / active, load-balancing0007
Why the virtual MAC matters, not just the virtual IP
When a host ARPs for the virtual IP, the active router answers with the virtual MAC rather than its own burned-in address. The host caches that virtual MAC and sends all off-subnet frames to it. If the active router fails, the standby takes over the same virtual MAC as well as the same virtual IP, so the host's ARP cache is still valid — it keeps sending to the same MAC, now answered by a different router. That shared virtual MAC is what makes failover invisible to the host: neither its gateway address nor its ARP entry has to change. A gratuitous ARP from the new active helps the switches relearn which port that MAC now lives on.

Active, standby, and who wins

In an HSRP group, routers exchange Hellos and elect one Active router, which owns the virtual IP and virtual MAC and forwards traffic, while another is Standby, monitoring the active's Hellos. If the standby stops hearing them it promotes itself and assumes the virtual IP and MAC. Each router also keeps its own physical address on the interface; only the virtual IP is shared.

Election and fail-back
RuleDetail
Priority0 to 255, default 100. Higher priority becomes active.
TiebreakerIf priorities tie, the highest physical IP on the interface wins.
PreemptionOff by default. Without standby preempt, a recovered higher-priority router stays standby.
VersionsHSRPv1 supports groups 0–255 on multicast 224.0.0.2; HSRPv2 supports 0–4095 on 224.0.0.102. Both routers must run the same version.
Preemption is the exam's favourite detail
By default HSRP is non-preemptive. If the active fails, the standby takes over, and then the original higher-priority router returns, it does not automatically reclaim the active role — it becomes standby and lets the current active keep forwarding. Enable standby preempt on the higher-priority router if you want it to reclaim. The default is off deliberately, to avoid the flapping a repeatedly-recovering router would cause. Exam questions lean on this: 'the primary comes back — who is active?' The answer depends entirely on preempt.

One further limit worth holding: standard HSRP is active/standby, so only one router forwards per group. To use both routers at once you run multiple groups — one active per VLAN or subnet, with the priorities swapped — or you use GLBP, which is genuinely active/active.

Configure and read the result

R1 preferred active, R2 standby
! R1 — preferred active
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip address 10.10.10.2 255.255.255.0
R1(config-if)# standby 1 ip 10.10.10.1
R1(config-if)# standby 1 priority 110
R1(config-if)# standby 1 preempt

! R2 — standby
R2(config)# interface GigabitEthernet0/1
R2(config-if)# ip address 10.10.10.3 255.255.255.0
R2(config-if)# standby 1 ip 10.10.10.1
R2(config-if)# standby 1 priority 90
show standby brief
R1# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Gi0/1       1    110 P Active  local           10.10.10.3      10.10.10.1

Grp 1 is the HSRP group. Pri 110 with a P shows R1 is configured to preempt. State Active with Active shown as local means R1 is currently forwarding for the group, Standby is R2 watching, and the shared Virtual IP is what every host uses as its default gateway. The hosts point at .1 — never at .2 or .3.

Troubleshooting — two routers, no peer
Symptom: both routers are configured for HSRP, but show standby on each shows its own state with no peer listed, and hosts intermittently lose the gateway. Diagnosis: each router thinks it is alone, which points to a group-number mismatch, an HSRP version mismatch — v1 and v2 use different multicast addresses, so they simply cannot hear each other — or an ACL blocking the HSRP multicast. Fix: make the group number, version, and virtual IP identical on both interfaces, and confirm the multicast is not filtered. show standby brief should then show one Active and one Standby sharing the virtual IP.

What you should retain

  • FHRP gives one virtual IP and virtual MAC shared by routers, so hosts need only one gateway address.
  • HSRP active forwards for the virtual IP; standby monitors Hellos and takes over on failure with the same IP and MAC.
  • Higher priority wins, default 100; ties break on the highest physical IP.
  • Preemption is off by default — without it, a recovered higher-priority router stays standby.
  • Verify with show standby brief; the HSRP virtual MAC prefix is 0000.0C.
  • HSRP is active/standby per group — use multiple groups or GLBP to forward on both routers at once.
Pause and predictNot scored — nothing is recorded

Before you read on

Using the configuration above: (1) R1 — priority 110, preempt — fails. What does R2 do, and does the host's gateway address or ARP entry change? (2) R1 recovers. Does it reclaim active, and would your answer differ if R1 had no preempt?

Study deeper

Topic guides extend this lesson — they do not replace the first-party walkthrough above.

HSRP & Redundancy

For FHRP purpose, the virtual MAC prefixes, priority and preemption, and fuller verification output

Open guide