3.6 First Hop Redundancy Protocols (FHRP)

Cisco Certified Network Associate CCNA

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the CCNA 200-301 Exam Domains and Weights Study Strategies and Tips

2 Chapter 1: Network Fundamentals (20%)

1.1 Network Components 1.2 Network Topology Architectures 1.3 Physical Interfaces and Cabling 1.4 TCP vs. UDP 1.5 IPv4 Addressing and Subnetting 1.6 IPv6 Addressing and Prefix 1.7 Wireless Principles 1.8 Virtualization Fundamentals 1.9 Switching Concepts 1.10 OSI and TCP/IP Reference Models 1.11 Verifying IP Parameters on Client Operating Systems

3 Chapter 2: Network Access (20%)

2.1 VLANs — Configuration and Verification 2.2 Trunking and 802.1Q 2.3 Layer 2 Discovery Protocols (CDP and LLDP) 2.4 EtherChannel (Link Aggregation) 2.5 Spanning Tree Protocol (STP) and RSTP 2.6 Wireless Architectures and AP Modes 2.7 Network Access Troubleshooting 2.8 Inter-VLAN Routing — Deep Dive

4 Chapter 3: IP Connectivity (25%)

3.1 Routing Table Components 3.2 Router Forwarding Decisions 3.3 IPv4 and IPv6 Static Routing 3.4 Single-Area OSPFv2 — Concepts 3.5 Single-Area OSPFv2 — Configuration 3.6 First Hop Redundancy Protocols (FHRP) 3.7 Troubleshooting IP Connectivity 3.8 OSPF Troubleshooting Scenarios

5 Chapter 4: IP Services (10%)

4.1 NAT (Network Address Translation) 4.2 DHCP and DNS 4.3 NTP, SNMP, and Syslog 4.4 QoS Fundamentals 4.5 TFTP/FTP and Remote Access 4.6 IP Services — Comprehensive Review

6 Chapter 5: Security Fundamentals (15%)

5.1 Key Security Concepts 5.2 Device Access Control and Password Policies 5.3 VPN Fundamentals 5.4 Access Control Lists (ACLs) 5.5 Layer 2 Security Features 5.6 Network Security Best Practices and Hardening 5.7 Threat Mitigation and Incident Response

7 Chapter 6: Automation and Programmability (10%)

6.1 Impact of Automation on Network Management 6.2 Controller-Based and Software-Defined Architectures 6.3 AI and Machine Learning in Network Operations 6.4 REST-Based APIs 6.5 Configuration Management Tools 6.6 JSON-Encoded Data 6.7 Automation and Programmability — Comprehensive Review

3.6 First Hop Redundancy Protocols (FHRP)

Key Takeaways Explain This Topic AI

FHRPs provide gateway redundancy so that if the default-gateway router fails, another takes over transparently.

HSRP (Cisco proprietary) uses an active/standby model with a virtual IP and virtual MAC address.

VRRP (IEEE RFC 5798) uses a master/backup model similar to HSRP but is vendor-neutral.

GLBP (Cisco proprietary) provides both gateway redundancy and active load balancing across routers.

HSRP and VRRP keep one active forwarder; GLBP distributes traffic across multiple forwarders.

Last updated: June 2026

The Problem FHRPs Solve

End devices (PCs, phones, servers) are configured with a single default gateway IP. If that one router fails, every device on the subnet loses access to other networks — even if a second, perfectly healthy router sits on the same subnet — because the hosts have no way to learn about it.

First Hop Redundancy Protocols (FHRPs) fix this by sharing a virtual IP address (VIP) and a virtual MAC address across two or more routers. Hosts point at the VIP as their gateway. If the active router dies, a standby router assumes the same VIP and virtual MAC, so end devices keep sending to the unchanged gateway address and ARP entry — failover is invisible to them.

HSRP (Hot Standby Router Protocol)

Feature Detail
Standard Cisco proprietary
Model Active / Standby
Virtual IP Configured by administrator
Virtual MAC 0000.0c07.acXX (XX = group in hex)
Multicast 224.0.0.2 (v1) / 224.0.0.102 (v2)
Hello timer 3 seconds (default)
Hold timer 10 seconds (default)
Preemption Disabled by default
Groups v1: 0-255; v2: 0-4095
HSRP States

State Meaning
Initial HSRP is starting
Learn Router hasn't yet learned the VIP
Listen Knows the VIP, is neither active nor standby
Speak Sending Hellos, participating in election
Standby Backup, ready to take over
Active Currently forwarding for the VIP
HSRP Election and Preemption

The highest priority router becomes Active (default priority 100, range 0-255).

If priorities tie, the highest interface IP wins.

Preemption is off by default — without standby <grp> preempt , a recovered higher-priority router will not reclaim the Active role; it waits as Standby until the current Active fails. Router(config-if)# standby 1 ip 10.0.0.1

Router(config-if)# standby 1 priority 110
Router(config-if)# standby 1 preempt
VRRP (Virtual Router Redundancy Protocol)

Feature Detail
Standard IEEE / IETF (RFC 5798) — vendor-neutral
Model Master / Backup
Virtual IP May equal the Master's real interface IP
Virtual MAC 0000.5e00.01XX (XX = group number)
Preemption Enabled by default
Multicast 224.0.0.18

VRRP behaves much like HSRP but is an open standard, so it interoperates across vendors. A key contrast: VRRP preempts by default , while HSRP does not.

GLBP (Gateway Load Balancing Protocol)

Feature Detail
Standard Cisco proprietary
Model AVG (Active Virtual Gateway) + AVFs (Active Virtual Forwarders)
Key advantage Active load balancing across multiple routers
Virtual MAC 0007.b400.XXYY (one per AVF)

GLBP's distinguishing trait: HSRP and VRRP keep one router actively forwarding while the others sit idle, but GLBP forwards through multiple routers at once. A single AVG hands out different virtual MAC addresses to different clients (round-robin by default), so client traffic spreads across all active forwarders simultaneously.

FHRP Comparison

Feature HSRP VRRP GLBP
Standard Cisco IEEE (RFC 5798) Cisco
Active forwarders 1 1 Multiple
Native load balancing No No Yes
Preemption default Off On Off
Virtual MAC prefix 0000.0c07.acXX 0000.5e00.01XX 0007.b400.XXYY
Roles Active/Standby Master/Backup AVG/AVF

On the Exam: The CCNA tests FHRP concepts , not deep configuration. Lock in three facts: (1) FHRPs give transparent default-gateway failover via a shared virtual IP/MAC; (2) HSRP and GLBP are Cisco-proprietary while VRRP is the IEEE open standard ; and (3) only GLBP load-balances across multiple active routers. Distractors love to claim HSRP or VRRP load-balances — they do not.

How Failover Actually Happens

The magic of an FHRP is the virtual MAC . When a host ARPs for its gateway VIP, the Active/Master router replies with the virtual MAC, not its own burned-in address. The host caches the VIP-to-virtual-MAC mapping. If the Active router fails, the Standby promotes itself, claims the same virtual MAC, and sends a gratuitous ARP so switches relearn which port owns that MAC. Because the host's ARP entry (VIP to virtual MAC) never changes, the PC keeps forwarding without re-ARPing — failover completes in seconds and is invisible to the user. This is why FHRPs use a virtual MAC rather than swapping in the new router's real MAC.

Object Tracking and Uplink Failures

A subtle real-world problem: the Active router can stay Active even if its uplink to the rest of the network fails, blackholing traffic. FHRPs solve this with interface or object tracking — the Active router monitors its uplink and decrements its priority when that uplink goes down. If preemption is enabled and the Standby's priority now exceeds the wounded Active's, the Standby takes over and forwards through its healthy uplink. The CCNA expects you to understand the concept: tracking lets an FHRP react to failures beyond the immediate LAN segment, not just to the gateway router crashing.

Picking the Right FHRP

If you need... Choose
All-Cisco shop, simple active/standby HSRP
Multi-vendor interoperability VRRP (open standard)
Active use of every gateway router GLBP

In practice HSRP dominates Cisco-only enterprises, VRRP appears wherever non-Cisco gear must participate, and GLBP shows up when an organization wants to recoup the cost of its standby routers by load-sharing. For the exam, anchor on the standards body (Cisco vs. IEEE) and the load-balancing distinction — those two facts answer most FHRP questions.