3.3.c Configure first hop redundancy protocols, such as HSRP, VRRP

Hosts usually point to one default gateway. If that gateway fails, the host does not automatically know a better next hop.

First-Hop Redundancy Protocols solve that problem by giving hosts a virtual default gateway. Two or more routers or multilayer switches share a virtual IP address. One device forwards actively. Another is ready to take over.

ENCOR focuses on HSRP and VRRP.

The simple idea

VLAN 10 hosts · default gateway 10.10.10.1
Virtual IP/MAC · HSRP or VRRP
Dist1 · Active/master · 10.10.10.2
Dist2 · Standby/backup · 10.10.10.3

Hosts use 10.10.10.1 as their default gateway. Dist1 and Dist2 run HSRP or VRRP. The active/master device owns the virtual IP and MAC at any moment.

HSRP protects the default gateway only. It does not fix a bad routing table, missing VLAN, or broken upstream path by itself.

HSRP basics

HSRP is Cisco proprietary. One router is active, one is standby.

Dist1:

interface Vlan10
 description Users VLAN
 ip address 10.10.10.2 255.255.255.0
 standby version 2
 standby 10 ip 10.10.10.1
 standby 10 priority 110
 standby 10 preempt

Dist2:

interface Vlan10
 description Users VLAN
 ip address 10.10.10.3 255.255.255.0
 standby version 2
 standby 10 ip 10.10.10.1
 standby 10 priority 100
 standby 10 preempt

Dist1 should become active because it has higher priority.

Verify:

show standby brief
show standby vlan 10
show ip interface brief | include Vlan10

HSRP tracking

Priority alone is not enough. If Dist1 loses its upstream link but VLAN 10 stays up, it may remain active and blackhole traffic. Track the upstream path and reduce priority when it fails.

track 10 interface GigabitEthernet1/0/48 line-protocol
!
interface Vlan10
 standby 10 track 10 decrement 30

If Dist1 priority is 110 and the decrement is 30, it drops to 80 when the tracked interface fails. Dist2 priority 100 can then become active.

Verify:

show track 10
show standby brief

VRRP basics

VRRP is standards-based. The forwarding device is called the master. Others are backups.

Dist1:

interface Vlan10
 ip address 10.10.10.2 255.255.255.0
 vrrp 10 ip 10.10.10.1
 vrrp 10 priority 110
 vrrp 10 preempt

Dist2:

interface Vlan10
 ip address 10.10.10.3 255.255.255.0
 vrrp 10 ip 10.10.10.1
 vrrp 10 priority 100
 vrrp 10 preempt

Verify:

show vrrp brief
show vrrp

HSRP vs VRRP

For ENCOR, do not overcomplicate it. Both create a resilient default gateway.

Preemption

Preemption lets a higher-priority device take back the active/master role after it recovers.

Without preemption, a lower-priority device may remain active after failover even when the better device returns.

HSRP:

standby 10 preempt

VRRP:

vrrp 10 preempt

Preemption is useful, but in production you may add delay to avoid flapping during boot or convergence.

Example HSRP preempt delay:

standby 10 preempt delay minimum 60

The idea is to let routing, trunks, and upstream reachability settle before a recovered device takes the active role back.

Lab: HSRP with tracking

Topology

ISP/Core uplink
Dist1 · SVI 10.10.10.2 · HSRP priority 110
Dist2 · SVI 10.10.10.3 · HSRP priority 100
VLAN 10 hosts · virtual gateway 10.10.10.1

Virtual gateway: 10.10.10.1. Dist1 SVI: 10.10.10.2. Dist2 SVI: 10.10.10.3.

Task 1: Configure HSRP

Dist1:

interface vlan 10
 ip address 10.10.10.2 255.255.255.0
 standby version 2
 standby 10 ip 10.10.10.1
 standby 10 priority 110
 standby 10 preempt

Dist2:

interface vlan 10
 ip address 10.10.10.3 255.255.255.0
 standby version 2
 standby 10 ip 10.10.10.1
 standby 10 priority 100
 standby 10 preempt

Task 2: Verify active and standby

show standby brief
show standby vlan 10

Task 3: Add tracking on Dist1

track 10 interface gi1/0/48 line-protocol
!
interface vlan 10
 standby 10 track 10 decrement 30

Task 4: Fail the upstream

Shut Dist1 upstream interface:

interface gi1/0/48
 shutdown

Verify Dist2 becomes active:

show standby brief
show track 10

Task 5: Restore and observe preemption

interface gi1/0/48
 no shutdown

Dist1 should become active again after tracking recovers.

Troubleshooting symptoms

Hosts cannot reach the default gateway

Check:

show standby brief
show ip arp | include 10.10.10.1
show interfaces vlan 10
show vlan brief

Possible causes:

• SVI down because VLAN missing or no active ports.
• Virtual IP not configured correctly.
• Both devices not in same VLAN/subnet.
• Trunk not carrying the VLAN.

Both devices think they are active

This is usually a communication problem between FHRP peers.

Check:

show standby brief
show interfaces trunk
show spanning-tree vlan 10
show access-lists

Possible causes:

• VLAN partition.
• Trunk allowed list issue.
• STP blocking unexpectedly.
• ACL or control-plane issue.
• FHRP hello/control traffic filtered or not crossing the VLAN.
• Mismatched group, version, authentication, or virtual IP.

In a split-brain symptom, first prove whether the peers hear each other's hellos. If they do not, troubleshoot VLAN reachability, trunks, STP, and control-plane filtering before changing priorities.

Useful protocol clues:

• HSRP version 1 uses multicast 224.0.0.2 over UDP/1985.
• HSRP version 2 uses multicast 224.0.0.102 over UDP/1985.
• VRRP uses multicast 224.0.0.18 with IP protocol 112.

Exam traps

• The host default gateway should be the virtual IP, not the physical SVI address.
• Higher priority wins, but preempt controls whether a recovered higher-priority device takes back the role.
• Preempt delay can prevent a recovering device from taking over before the rest of the path is stable.
• Tracking reduces priority when an upstream condition fails.
• FHRP can be fine while routing beyond the active device is broken; tracking helps prevent blackholing.
• HSRP active/standby and VRRP master/backup are similar ideas with different terms.

Quick checklist

1. Do hosts point to the virtual IP, not a physical router IP?
2. Which router is active/master?
3. Do priorities and preemption match the design?
4. Is interface tracking changing priority as expected?
5. Are hellos visible between peers on the VLAN?
6. Are VLAN, trunk, ACL, or CoPP issues blocking FHRP control traffic?