4 First-Hop Redundancy

Purpose and limits of gateway redundancy

A host normally sends traffic for remote networks to a default gateway. If that gateway fails, the host may lose access to those networks even when another router is available on the LAN. A first-hop redundancy protocol (FHRP) lets multiple routers share a virtual gateway address: hosts use the shared address as their default gateway, one router forwards traffic, and another can take over if needed.

FHRP protects only the host-to-gateway hop. It does not by itself ensure that a router has a working path beyond the LAN. Static routes or a routing protocol such as OSPF still provide routes through the network; tracking can help an FHRP group respond when an important uplink or route fails.

Compare the main protocols

HSRP, VRRP, and GLBP provide different approaches to first-hop redundancy:

• HSRP is Cisco-developed. Routers elect an active router and a standby router for a virtual IP. It is common in Cisco environments where straightforward active/standby gateway redundancy is wanted.

• VRRP is a standards-track protocol. Routers elect an Active Router and backups for a virtual router, and it supports IPv4 and IPv6. It is useful when standards-based interoperability matters; the current specification is VRRPv3, RFC 9568.

• GLBP is a Cisco protocol that provides gateway redundancy and can share host traffic among multiple forwarding routers. It is useful when first-hop load sharing is wanted as well as redundancy.

With HSRP or VRRP, a single virtual gateway is generally active on a LAN at a time. Load can still be shared by configuring different groups or virtual gateways for different subnets. GLBP can assign hosts different virtual MAC addresses so multiple routers forward traffic under one virtual gateway IP. Choose a protocol supported by the network devices, and ensure all group members use compatible settings.

Configure an HSRP example

The example uses host LAN 192.168.10.0/24 and HSRP group 10. R1 has LAN address 192.168.10.2, R2 has LAN address 192.168.10.3, and they share virtual gateway 192.168.10.1. The interface names are examples; use the matching LAN-facing interface in the topology.

R1 — preferred active router

R2 — standby router

Configure hosts, or their DHCP option for the default gateway, to use 192.168.10.1, not either router’s physical address. Both routers need appropriate routes toward networks beyond the LAN.

HSRP priority determines router preference. The preempt setting lets the higher-priority router reclaim the active role when it returns. Tracking the uplink interface GigabitEthernet0/1 lowers a router’s priority when the tracked object fails. Verify tracking syntax and supported features for the device and software version.

Verify routing and test failover

Use these checks to confirm the group, routing, forwarding, and failover behavior:

1. Check group state on both routers:

   Confirm that R1 is active, R2 is standby, and both show the same virtual IP and group.

2. Check routing. Confirm each router has the needed routes. For an OSPF-based lab, useful checks include:

   A healthy FHRP state does not prove that OSPF is established or that an end-to-end route exists.

3. Test normal forwarding. From a host, ping 192.168.10.1, then a destination beyond the LAN. If possible, check that traffic is using the intended router.

4. Test router failover in a lab. Shut down R1’s LAN-facing interface or otherwise simulate its failure. Check that R2 becomes active and that the host can still reach the gateway and remote destination. Restore R1 and observe whether it preempts R2.

5. Test uplink tracking separately. Keep both routers’ LAN interfaces up and simulate failure of R1’s tracked uplink. R1’s priority should fall, allowing R2 to become active if R2 has the better effective priority and working routes. This tests whether the preferred router can still reach beyond the LAN, not just whether its gateway interface is working.

If a test fails, verify the matching group number and virtual IP, compatible protocol version, LAN connectivity between routers, priority and preemption settings, tracking status, and the routers’ routes. Use platform-specific commands, and conduct disruptive tests only in a controlled environment.