FHRP Explained: HSRP, VRRP and GLBP for Gateway Redundancy

A host knows exactly one default gateway. If that router fails, the host does not look for another — it simply cannot reach anything off its own subnet. First Hop Redundancy Protocols solve this by letting two or more routers share a single virtual gateway address, so the host's configuration never has to change and failover happens without the host knowing.

The problem

Redundant links, redundant switches, and redundant uplinks all count for nothing if every host on the segment points at one router's address. That address is a single point of failure sitting in the configuration of every device.

Changing it on failure is not an option: hosts learn it from DHCP and hold it for the lease duration, and statically configured devices never change it at all. The gateway address has to stay constant while the router behind it changes.

How the virtual gateway works

Two or more routers share a virtual IP address and a virtual MAC address. Hosts are configured — usually via DHCP — with the virtual IP as their default gateway and never know how many physical routers exist.

One router is active and actually forwards traffic; the others stand by. The routers exchange hello messages so each knows the others are alive, and when the active router stops sending them, a standby takes over the virtual addresses.

Taking over the virtual MAC as well as the IP is the detail that makes this seamless. Hosts have the virtual MAC in their ARP cache and keep sending frames to it; because the new active router now answers to that MAC, nothing on the host side needs to update and no ARP timeout has to expire first.

The three protocols

HSRP is Cisco proprietary. One router is Active, one is Standby, and any others are in a listening state. Selection is by priority, with the highest winning and the IP address breaking ties. By default a recovered higher-priority router does not take back the active role — preemption must be enabled explicitly, which surprises people who expect automatic return.

VRRP is the open standard equivalent, supported across vendors. The terminology differs — Master and Backup rather than Active and Standby — and preemption is enabled by default, the opposite of HSRP. Choose VRRP in a mixed-vendor environment; the behavioral difference is otherwise minor.

GLBP is Cisco proprietary and does something the others do not: it load balances. A single active virtual gateway responds to ARP requests but hands out different virtual MAC addresses to different hosts, so traffic from the segment is distributed across several routers simultaneously rather than one forwarding while the rest idle. With HSRP or VRRP the standby capacity is purchased and unused unless you split VLANs between routers to balance manually.

Tracking is what makes failover correct

Without tracking, a router stays active as long as it is running — even if its uplink has failed. Traffic then flows to a gateway that cannot forward it anywhere, which is worse than the router being down, because failover never triggers.

Interface and object tracking fixes this by reducing the router's priority when a monitored uplink or reachability test fails. The priority drops below the peer's, and with preemption enabled the peer takes over. Configuring FHRP without tracking is the most common real-world mistake in this area.

The priority-and-preemption model should feel familiar — it is the same election logic as the spanning tree root bridge, and the same principle applies: set the values deliberately so the topology is the one you designed rather than the one the defaults produced.

Security and design notes

Enable authentication on the FHRP group. Without it, a device on the segment can advertise a higher priority, claim the virtual address, and become the gateway for everyone — a machine-in-the-middle position obtained with no exploit.

Align the FHRP active router with the spanning tree root for each VLAN. If the active gateway sits on one switch and the root bridge on another, traffic crosses the inter-switch link unnecessarily on every flow, which works and wastes capacity.

Finally, put a number on what this buys. Sub-second failover with tuned timers, or a few seconds with defaults, is a meaningful improvement only if the rest of the design supports it — and expressing that as a recovery objective, as under RPO and RTO, is how you decide whether tuned timers are worth the extra control traffic.

Exam angles

Know FHRP as providing a redundant default gateway through a shared virtual IP and virtual MAC. Identify HSRP as Cisco proprietary with Active and Standby and preemption off by default, VRRP as the open standard with Master and Backup and preemption on by default, and GLBP as Cisco proprietary with active load balancing across routers. Recognize interface tracking as necessary for correct failover, and authentication as the control against a rogue router claiming the gateway.