First hop redundancy: reading HSRP and VRRP status

Why this matters

Every PC, printer and phone on a VLAN has one default gateway, and it can only hold one address. If that gateway is a single router and the router fails, every host on the VLAN loses everything beyond its own subnet, even though a second router sits on the same VLAN, powered on and idle. A first hop redundancy protocol lets two or more routers share one gateway address, so the hosts never notice which router is doing the work. Network technicians meet it on almost every pair of distribution switches or branch routers they touch.

The configuration is usually done once and then left alone, which is why the skill that matters day to day is reading its status. A help-desk analyst moving into networking gets a ticket saying "the network was slow after the outage" or "the console shows a duplicate address warning", and the answer is in show standby brief or show vrrp brief: which router is forwarding, which one is waiting, and whether the two can hear each other at all. Misread that output and you can spend an hour on the wrong router.

The lesson

Reading the state of HSRP and VRRP groups

A first hop redundancy protocol (FHRP) groups two or more routers so they answer for one virtual IP address. The hosts use that virtual IP as their default gateway, never a real router address. One router forwards for the group. The others wait and take over if it fails.

Two FHRPs are in scope:

• Hot Standby Router Protocol (HSRP), which is Cisco proprietary. The forwarding router is the active router. The one next in line is the standby router.
• Virtual Router Redundancy Protocol (VRRP), an open IETF standard. The forwarding router is the master. The others are backups.

Because VRRP is a standard, it is the choice when a Cisco router must share a gateway with another vendor's router. HSRP in either version, and Cisco's load-balancing GLBP, would leave the other router unable to join the group.

The virtual IP and the virtual MAC

The group owns a virtual IP and a matching virtual MAC address. When a host ARPs for the gateway, the forwarding router answers with the virtual MAC, not its own burned-in MAC. When the forwarding router fails, the new one takes over both the virtual IP and the virtual MAC, and sends a gratuitous ARP so the switches update their MAC tables. The host's ARP entry is still correct, so it keeps forwarding without relearning anything. This is also why DHCP must hand out the virtual IP as the default gateway. A host given a real router address works only until that router fails.

The virtual MAC tells you the protocol, the version and the group number. The group number is always written in hexadecimal.

Worked example, HSRP version 2 group 300. Convert 300 to hex: 300 divided by 16 is 18 remainder 12, and 18 divided by 16 is 1 remainder 2. Reading the remainders upward gives 1, 2, 12, which is 12C. Version 2 uses three hex digits, so the MAC is 0000.0c9f.f12c. Writing 0000.0c9f.f300 is the decimal mistake. Version 1 cannot carry group 300 at all, because it has room for only two hex digits.

Worked example, VRRP group 20. 20 is 16 plus 4, which is 14 in hex, so the MAC is 0000.5e00.0114. 0000.5e00.0120 is the same decimal slip.

Hellos, timers and addresses

The routers in a group exchange small multicast messages to agree who forwards and to prove they are alive.

• HSRP version 1 hellos go to 224.0.0.2 over UDP port 1985.
• HSRP version 2 hellos go to 224.0.0.102, also over UDP 1985.
• VRRP advertisements go to 224.0.0.18 as IP protocol 112, directly over IP with no UDP.

The default HSRP hello interval is 3 seconds, with a hold time of 10 seconds: if the standby hears nothing for 10 seconds, it takes over. VRRP sends an advertisement every 1 second by default, and a backup declares the master down after about three missed advertisements. A packet capture showing 224.0.0.18 and protocol 112 is VRRP, whatever else is on the VLAN.

Priority, election and preemption

Both protocols start every router at priority 100. The highest priority wins. When priorities tie, the router with the highest IP address on the group interface wins. MAC addresses and routing-protocol router IDs play no part. So if R1 is 10.1.10.2 and R2 is 10.1.10.3, both at the default priority, and they boot together, R2 becomes active.

Preemption decides what happens when a router with a better priority appears after the election. This is the biggest difference between the two protocols:

• In HSRP, preemption is off by default. A higher-priority router that comes back after a reload stays standby until the active router fails, unless you configure standby 10 preempt.
• In VRRP, preemption is on by default. A backup with a higher priority than the master takes over as soon as it is ready.

VRRP has one more rule. If a router's real interface address is the virtual IP, it is the address owner and runs at priority 255. It is master whenever it is up. The highest priority you can type is 254.

A typical HSRP configuration on R1's LAN interface, Gi0/1, which faces VLAN 10:

R1(config)#track 1 interface GigabitEthernet0/0 line-protocol
R1(config-track)#exit
R1(config)#interface GigabitEthernet0/1
R1(config-if)#ip address 10.1.10.2 255.255.255.0
R1(config-if)#standby version 2
R1(config-if)#standby 10 ip 10.1.10.1
R1(config-if)#standby 10 priority 110
R1(config-if)#standby 10 preempt
R1(config-if)#standby 10 track 1 decrement 20

The track line watches R1's uplink. If the uplink fails, HSRP lowers R1's priority by 20, and a peer at 100 with preemption can take over the gateway role, so hosts do not send traffic to a router that has lost its way out.

The VRRP equivalent, on a router R4 that should be master for group 20:

R4(config)#interface GigabitEthernet0/1
R4(config-if)#ip address 10.1.20.2 255.255.255.0
R4(config-if)#vrrp 20 ip 10.1.20.1
R4(config-if)#vrrp 20 priority 120

Newer IOS XE releases also offer a VRRP version 3 form under an address family, but the roles, priorities and preemption behave in the same way.

Reading show standby brief

This is the command to know best.

R1#show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Gi0/1       10   110 P Active  local           10.1.10.3       10.1.10.1

Read it column by column. Grp is the group, Pri the current priority, P shows preemption is configured. State is this router's role. Active and Standby name the routers in those roles, and local means this router. Here R1 is active and forwards for 10.1.10.1, and 10.1.10.3 is waiting as standby.

The HSRP states are Init (also shown as Initial), Learn, Listen, Speak, Standby and Active. Three are worth recognising in output:

R2#show standby brief
Gi0/1       10   100   Init    unknown         unknown         10.1.10.1

Init means the group is configured but the interface is not up and passing traffic. Check the interface first.

R3#show standby brief
Gi0/1       10   90    Listen  10.1.10.2       10.1.10.3       10.1.10.1

Listen means R3 hears the active (10.1.10.2) and the standby (10.1.10.3) but holds neither role. It moves up only if one of them fails. In a group of three, this is normal for the lowest-priority router.

Now a fault. Output from both routers in group 10:

R1#show standby brief
Gi0/1       10   110 P Active  local           unknown         10.1.10.1
R2#show standby brief
Gi0/1       10   100 P Active  local           unknown         10.1.10.1

Two active routers, each with the standby unknown, means neither hears the other's hellos. Each believes it is alone. Likely causes: the two interfaces sit in different VLANs, an ACL drops UDP port 1985, or the routers run different HSRP versions. A version mismatch shows in the virtual MAC: if R1 lists 0000.0c9f.f00a and R2 lists 0000.0c07.ac0a, both are group 10 (0a), but R1 runs version 2 and R2 version 1. Preemption has nothing to do with this symptom, because preemption only matters between routers that can hear each other.

The detailed command explains why a router holds its role:

R1#show standby GigabitEthernet0/1
GigabitEthernet0/1 - Group 10 (version 2)
  State is Standby
  Virtual IP address is 10.1.10.1
  Active virtual MAC address is 0000.0c9f.f00a (MAC Not In Use)
  Hello time 3 sec, hold time 10 sec
  Preemption enabled
  Active router is 10.1.10.3, priority 100
  Standby router is local
  Priority 90 (configured 110)
    Track object 1 state Down decrement 20

R1 is configured for 110 and preempts, so normally it would be active. But track object 1 is down, which takes 20 off, leaving 90. That is below the active router's 100, so R1 waits. When the tracked uplink returns, R1's priority goes back to 110 and preemption lets it take over.

Several groups can coexist on one router, one per VLAN:

R2#show standby brief
Interface   Grp  Pri P State    Active          Standby         Virtual IP
Gi0/1       10   100   Standby  10.1.10.2       local           10.1.10.1
Gi0/2       20   110 P Active   local           10.1.20.2       10.1.20.1

R2 forwards for 10.1.20.1 and stands by for 10.1.10.1, taking over if 10.1.10.2 fails. The blank P on Gi0/1 means R2 does not preempt in group 10. This is also how load is shared: one group per VLAN, with R1 given the higher priority in the VLAN 10 group and R2 the higher priority in the VLAN 20 group. Each router is active for one VLAN and the backup for the other. A single group for both VLANs leaves one router doing all the work.

Reading show vrrp brief

R2#show vrrp brief
Interface          Grp Pri Time  Own Pre State   Master addr     Group addr
Gi0/1              20  100 3609       Y  Backup  10.1.20.2       10.1.20.1

Pri is the priority. Time is the master down interval in milliseconds: three advertisement intervals plus a small skew based on priority. Own shows whether this router owns the virtual address, and it is empty here. Pre shows Y because VRRP preempts by default. State is Backup, and Master addr shows that 10.1.20.2 is the master forwarding for the Group addr 10.1.20.1. That master is R4 from the configuration above, at priority 120.

The VRRP states are Initialize, Backup and Master. Only the master forwards. HSRP's Listen, Speak, Standby and Active never appear in VRRP output.

What the exam is really asking

• Names map across protocols. HSRP active and standby; VRRP master and backup. "Designated router" belongs to OSPF, not to any FHRP.
• Preemption defaults are opposite. HSRP off, VRRP on. A higher-priority HSRP router that reloads comes back as standby unless preempt is set.
• Ties go to the highest interface IP. Not the MAC, not a router ID.
• Virtual MAC formats. 0000.0c07.acXX for HSRPv1, 0000.0c9f.fXXX for HSRPv2, 0000.5e00.01XX for VRRP, group number always in hex.
• Addresses and ports. HSRPv1 224.0.0.2, HSRPv2 224.0.0.102, both UDP 1985; VRRP 224.0.0.18, IP protocol 112.
• Timers. HSRP hello 3 seconds, hold 10; VRRP advertisement 1 second.
• Two actives means no hellos heard. Look for a VLAN mismatch, a filter on UDP 1985 or a version mismatch.
• Priority lower than configured means tracking. Read the track line before blaming preemption.
• Hosts point at the virtual IP. Never at a router's real address. Lesson 7 covers the DHCP side, and lesson 13 shows how the gateway's own routing table decides where the traffic goes next.