Explain why hosts need a redundant default gateway and how HSRP delivers one — a shared virtual IP and virtual MAC with an active/standby pair — then read show standby and predict failover and fail-back behavior.
Week 5 · Lesson 7 · Active ~32 min · Video ~6 min (optional) · Domain: IP Connectivity
You should know that a host sends off-subnet traffic to its single configured default gateway. This lesson is about making that one gateway address survive a router failure.
Prerequisites: routing-fundamentals-forwarding-decision
Paths: Start lesson · Test out (jump to the quick check) · Review sheet
Baseline check
A subnet has two routers, R1 (.2) and R2 (.3), for redundancy. Every PC is configured with default gateway .2. R1 fails. What happens to the PCs, and what manual work would be needed to recover — before continuing?
The answer — every PC loses its gateway and someone must reconfigure all of them to .3 — is exactly the fragility FHRP eliminates. Hosts get one gateway address that never has to change.
One gateway, two routers, no host reconfiguration. A host has exactly one default gateway IP. Put two physical routers on the subnet and you face a dilemma: point all hosts at R1 and R1 becomes a single point of failure; split hosts between R1 and R2 and a failure still strands half of them, with manual recovery on every affected PC. First Hop Redundancy Protocols (FHRP) solve this by presenting a virtual gateway: a virtual IP (VIP) and a matching virtual MAC shared by the routers. Hosts use the VIP as their default gateway and never know — or care — which physical router is actually forwarding.
The CCNA FHRP family. Three protocols, one idea:
| Protocol | Standard | Model | Note |
|---|---|---|---|
| HSRP | Cisco proprietary | Active / standby | CCNA primary focus |
| VRRP | Open standard (RFC) | Active / standby | Very similar to HSRP |
| GLBP | Cisco proprietary | Active / active | Load-balances across gateways |
You do not need to memorize full virtual MAC addresses, but the OUI prefixes are quick to recognize: HSRP 0000.0C, VRRP 0000.5E, GLBP 0007. HSRP's full virtual MAC is 0000.0c07.acXX, where XX is the group number in hex.
Why does the virtual MAC matter, not just the virtual IP?
When a host ARPs for the VIP, the active router answers with the virtual MAC — not its own burned-in address. The host caches the virtual MAC and sends all off-subnet frames to it. If the active router fails, the standby takes over the same virtual MAC as well as the VIP, so the host's ARP cache is still valid — it keeps sending to the same MAC, now answered by the new active router. That shared virtual MAC is what makes failover invisible to the host: neither its gateway IP nor its ARP entry has to change. A gratuitous ARP from the new active helps switches relearn which port the virtual MAC lives on.
FHRP purpose, options, and virtual MAC prefixes (topic guide)
Active and standby. In an HSRP group, routers exchange Hellos and elect one Active router — it owns the VIP and virtual MAC and forwards traffic — while another is Standby, monitoring the active's Hellos. If the standby stops hearing the active, it promotes itself to active and assumes the VIP and virtual MAC. Each router also keeps its own physical IP on the interface (.2 and .3); only the VIP (.1, say) is shared.
Who becomes active — priority, then IP. HSRP priority is 0–255, default 100; the higher priority becomes active. If priorities tie, the tiebreaker is the highest physical IP on the interface. So to make R1 the preferred active, give it a higher priority than R2.
Preemption controls fail-back. By default HSRP is non-preemptive: if the active fails and the standby takes over, then the original (higher-priority) router returns, it does not automatically reclaim the active role — it becomes standby and lets the current active keep forwarding. Enable standby preempt on the higher-priority router if you want it to reclaim active when it recovers. Preemption off by default avoids the flapping a repeatedly-recovering router could cause.
Versions. HSRPv1 (default) supports groups 0–255 and uses multicast 224.0.0.2; HSRPv2 supports groups 0–4095 and uses 224.0.0.102. Both routers in a group must run the same version. And remember the key limit: standard HSRP is active/standby — only one router forwards per group. To use both routers at once you run multiple groups (one active per VLAN/subnet, priorities swapped) or use GLBP.
Priority, preemption, versions, and verification (topic guide)
Free CCNA | First Hop Redundancy Protocols | Day 29 | CCNA 200-301 Complete Course
~6 min
Optional overview of FHRP purpose and HSRP active/standby operation. The written lesson covers the exam-tested concepts.
Skip if you can explain the virtual IP/MAC and predict the active router from priority.
Watch on YouTubeConfigure HSRP and read show standby brief
! R1 -- preferred active
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip address 10.10.10.2 255.255.255.0
R1(config-if)# standby 1 ip 10.10.10.1
R1(config-if)# standby 1 priority 110
R1(config-if)# standby 1 preempt
! R2 -- standby
R2(config)# interface GigabitEthernet0/1
R2(config-if)# ip address 10.10.10.3 255.255.255.0
R2(config-if)# standby 1 ip 10.10.10.1
R2(config-if)# standby 1 priority 90
R1# show standby brief
P indicates configured to preempt.
|
Interface Grp Pri P State Active Standby Virtual IP
Gi0/1 1 110 P Active local 10.10.10.3 10.10.10.1
Read the output: Grp 1 is the HSRP group; Pri 110 with a P shows R1 is configured to preempt. State Active with Active = local means R1 is currently forwarding for the group; Standby = 10.10.10.3 is R2 watching; and the shared Virtual IP 10.10.10.1 is what every host uses as its default gateway. The hosts point at .1 — never at .2 or .3.
Pause and predict
Using the config above: 1) R1 (priority 110, preempt) fails. What does R2 do, and does the host's gateway or ARP entry change? 2) R1 recovers. Does it reclaim active — and would your answer differ if R1 had no preempt?
Reveal answer
- R2 stops hearing R1's Hellos and promotes itself to Active, taking over the same virtual IP (10.10.10.1) and virtual MAC. The host's default gateway is still 10.10.10.1 and its ARP entry (the virtual MAC) is still valid, so failover is transparent — no host reconfiguration. 2. Because R1 has
standby preemptand a higher priority (110 > 90), when it recovers it reclaims Active and R2 returns to standby. Withoutpreempt, R1 would come back as standby and leave R2 active despite R1's higher priority — preemption is what allows fail-back.
Quick check (3 items) · test
Answer from memory:
- What address do hosts configure as their default gateway in an HSRP deployment, and why is the virtual MAC important?
- Two HSRP routers have equal priority. Which becomes active?
- The higher-priority router recovers after a failover but does not reclaim active. What is missing from its configuration?
Review sheet
- FHRP = one virtual IP + virtual MAC shared by routers so hosts need only one default gateway.
- HSRP active forwards for the VIP; standby monitors Hellos and takes over on failure — VIP/MAC unchanged.
- Higher priority wins (default 100); tie broken by highest physical IP.
- Preempt (off by default) lets a recovered higher-priority router reclaim active.
- Verify with
show standby brief— active, standby, virtual IP, priority; HSRP MAC prefix0000.0C.
standby preempt, a recovered higher-priority router stays standby and the current active keeps forwarding. Exam questions lean on this: "the primary comes back — who is active?" Answer depends on preempt.Troubleshooting scenario
Symptom. Two routers in the same subnet are both configured for HSRP, but show standby on each shows its own state as Standby (or Active) with no peer, and hosts intermittently lose the gateway.
Diagnosis. Both routers acting independently -- each thinks it is alone -- points to a group mismatch (different standby group numbers), an HSRP version mismatch (v1 vs v2 use different multicast addresses), or an ACL blocking the HSRP multicast. The two routers never hear each other's Hellos, so they cannot coordinate active/standby.
Fix. Make the group number, HSRP version, and virtual IP identical on both interfaces (for example both standby 1, both standby version 2, both standby 1 ip 10.10.10.1) and ensure the HSRP multicast is not filtered. show standby brief should then show one Active and one Standby sharing the VIP.
Week 5 closes with gateway redundancy; Week 6 moves to the IP services every network depends on, starting with DHCP.
Next: DHCP, DNS, and NTP Basics