3.3.c Configure first hop redundancy protocols, such as HSRP, VRRP

What this objective tests

The objective says "configure". The exam wants a working First Hop Redundancy Protocol (FHRP) pair and proof that failover works.

Hosts point to one default gateway. If that gateway fails, the host has no backup. An FHRP gives hosts a virtual default gateway. Two routers share a virtual IP address. One device forwards. The other waits.

ENCOR covers Hot Standby Router Protocol (HSRP) and Virtual Router Redundancy Protocol (VRRP).

Example: HSRPv2 with priority and preempt

Topology:

VLAN 10 hosts -- default gateway 10.10.10.1 (virtual)
   |
DSW1 Vlan10 10.10.10.2 -- priority 110
DSW2 Vlan10 10.10.10.3 -- priority 100

DSW1:

interface Vlan10
 description Users gateway
 ip address 10.10.10.2 255.255.255.0
 standby version 2
 standby 10 ip 10.10.10.1
 standby 10 priority 110
 standby 10 preempt

DSW2:

interface Vlan10
 description Users gateway
 ip address 10.10.10.3 255.255.255.0
 standby version 2
 standby 10 ip 10.10.10.1
 standby 10 priority 100
 standby 10 preempt

DSW1 becomes active because 110 is higher than 100. Preempt lets DSW1 take the role back after a recovery.

Expected show standby brief output

On DSW1:

DSW1# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Vl10        10   110 P Active  local           10.10.10.3      10.10.10.1

On DSW2:

DSW2# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Vl10        10   100 P Standby 10.10.10.2      local           10.10.10.1

Correct output shows:

• One device is Active. The other is Standby. They agree on the active address.
• Both use the same virtual IP.
• The P flag confirms preempt is configured.

HSRP tracking

Priority alone is not enough. If DSW1 loses its uplink but VLAN 10 stays up, DSW1 stays active and drops traffic. Track the uplink and lower the priority when it fails.

DSW1:

track 10 interface GigabitEthernet1/0/48 line-protocol
!
interface Vlan10
 standby 10 track 10 decrement 30

If the uplink fails, DSW1 priority drops from 110 to 80. DSW2 at 100 becomes active.

Verify:

show track 10
show standby brief

Example: VRRP equivalent

VRRP is the open standard. The forwarding device is the master. The others are backups.

DSW1:

interface Vlan10
 ip address 10.10.10.2 255.255.255.0
 vrrp 10 ip 10.10.10.1
 vrrp 10 priority 110
 vrrp 10 preempt

DSW2:

interface Vlan10
 ip address 10.10.10.3 255.255.255.0
 vrrp 10 ip 10.10.10.1
 vrrp 10 priority 100
 vrrp 10 preempt

Expected output on DSW1:

DSW1# show vrrp brief
Interface          Grp Pri Time  Own Pre State   Master addr     Group addr
Vl10               10  110 1000       Y  Master  10.10.10.2      10.10.10.1

On DSW2 the state is Backup and the master address is 10.10.10.2.

Lab: HSRP failover test

Topology: the DSW1 and DSW2 diagram from the example above. Both switches have an uplink to a core router. A test host in VLAN 10 uses gateway 10.10.10.1.

Do these steps:

1. Configure HSRPv2 on DSW1 and DSW2 with the configs above.
2. Verify with show standby brief on both switches. Confirm DSW1 is active.
3. Ping the virtual IP and an upstream address from the test host. Confirm both work.
4. Add tracking on DSW1 with a decrement of 30.
5. Shut the DSW1 uplink. Start a continuous ping from the host before you do this.
6. Check show standby brief on DSW2. Confirm DSW2 is now active. Count the lost pings.
7. Check show track 10 on DSW1. Confirm the track is down and the priority is 80.
8. Restore the DSW1 uplink. Watch preempt give the active role back to DSW1.
9. Remove the tracking config. Repeat the failover. Explain why DSW1 now keeps the active role and drops traffic.

Exam traps

• Hosts must point to the virtual IP, not a physical interface IP.
• Higher priority wins. Preempt controls whether a recovered device takes the role back.
• Tracking lowers the priority when an upstream condition fails.
• The FHRP can be healthy while upstream routing is broken. Tracking prevents this black hole.
• Both devices active means the peers cannot hear each other. Check the VLAN, trunks, and STP first.
• HSRP active/standby and VRRP master/backup are the same idea with different names.

Pass check

You are ready when you can do these things:

• Configure an HSRPv2 pair with priority, preempt, and tracking.
• Read show standby brief and show vrrp brief and name the forwarding device.
• Predict the failover result of a priority change and an uplink failure.
• Explain why both-active is a peer communication problem, not a priority problem.