This document outlines a collection of **First Hop Redundancy Protocols (FHRPs)** designed to provide seamless default gateway failover for end hosts. These protocols operate by sharing a **virtual IP and MAC address** between routers on the same subnet. With the aid of **gratuitous ARP**, failover occurs quickly and transparently to clients. --- ## FHRP Comparison Table | Feature | HSRP | VRRP | | ------------------- | ---------------------------- | ---------------------------- | | Standard | Cisco proprietary / RFC 2281 | Industry standard / RFC 3768 | | Terminology | Active / Standby | Master / Backup | | Priority Range | 0–255 (default: 100) | 0–255 (default: 100) | | Preemption | Optional | Enabled by default | | Timers (hello/hold) | 3s / 10s (default) | 1s / 3s (default) | | Multicast Group | 224.0.0.2 | 224.0.0.18 | | Transport | UDP port 1985 | IP Protocol 112 | | Authentication | Clear Text / MD5 | Clear Text / MD5 | | Virtual MAC | `0000.0c07.acXX` | `0000.5E00.01XX` | --- ## HSRP (Hot Standby Router Protocol) - **Cisco proprietary**, also documented in RFC 2281. - Uses **active/standby** roles. - The router with the highest priority becomes **active**. In the event of a tie, the router with the highest IP address wins. - **Preemption** must be manually enabled. - Operates using **UDP multicast** to `224.0.0.2`, port `1985`. - Virtual MAC format: `0000.0c07.acXX` (where `XX` = group ID in hex). - Supports **Clear Text** and **MD5** authentication. ### Basic HSRP Configuration ``` interface Ethernet1/1 ip address 192.168.1.10 255.255.255.0 standby 0 ip 192.168.1.1 standby 0 priority 110 standby 0 preempt standby 0 timers 5 15 ``` > `standby 0 timers 5 15`: 5s hello, 15s hold time. ### HSRP Additional Configs **Delays and BFD** ``` interface Ethernet1/1 standby 0 preempt delay minimum 10 standby delay minimum 30 reload 60 bfd interval 250 min_rx 250 multiplier 4 ``` > `standby delay minimum 30 reload 60` configures the delay period before the initialization of HSRP groups, where `minimum` is after a link comes up, and `reload` is after a device reboot. > `standby 1 preempt delay minimum 380` determines the amount of seconds a group will wait before initiating preemption. Default is immediately. **Basic Tracking** [[IP Service Level Agreement (SLA) & Enhanced Object Tracking (EOT)]] ``` track 100 interface GigabitEthernet 0/0/0 { line-protocol | ip routing } interface Ethernet1/1 standby 0 track 100 [ decrement 20 | shutdown ] ``` ### HSRP Authentication **MD5 key-chain:** ``` key chain HSRP1 key 1 key-string cisco1234 interface Ethernet1/1 standby 0 authentication md5 key-chain HSRP1 ``` **MD5 key-chain:** ``` interface Ethernet1/1 standby 0 authentication md5 key-string HSRP1 ``` **Plain-text authentication:** ``` interface Ethernet1/1 standby 0 authentication text cisco1234 ``` ### HSRP with Object Tracking [[IP Service Level Agreement (SLA) & Enhanced Object Tracking (EOT)]] ``` ip sla 1 icmp-echo 10.0.0.1 ip sla schedule 1 start-time now life forever track 1 ip sla 1 interface Ethernet1/1 standby 0 track 1 decrement 255 ``` --- ### HSRPv2 Enhancements - Supports **more groups per interface**. - Uses dedicated multicast address: `224.0.0.102`. - Supports **IPv6**. ``` interface Ethernet1/1 standby version 2 ``` --- ## VRRP (Virtual Router Redundancy Protocol) - Defined in **RFC 3768**, vendor-neutral standard. - Uses **master/backup** roles. - Priority-based master election: - Higher priority wins; tie-breaker = highest IP address. - **Preemptive** behavior is **enabled by default**. - Uses **IP protocol 112** over multicast `224.0.0.18`. - Virtual MAC: `0000.5E00.01XX` (where `XX` = group ID in hex). - Supports **Clear Text** and **MD5** authentication. > Most configurations copy over from HSR, but with `vrrp` instead of `standby`. ### Priority Behavior - Valid priority range: **1–254** - Default: **100** **255 is reserved** for a special case: If a router is configured with the **interface IP address as the virtual IP (VIP)**, it **must always be the master**. In this case, VRRP **automatically sets the priority to 255**, and no other router is allowed to override it, not even with a higher manual priority. This makes sense, because that router is **literally** the owner of the IP and can't have another box claim it. | Priority Value | Meaning | | -------------- | ------------------------------------------------------- | | 1–254 | Normal configured range (higher wins) | | 255 | **Reserved** — used when a router owns the VIP directly | | 0 | Resign — causes the router to stop being master | ### Basic VRRP Configuration ``` interface Ethernet1/1 ip address 192.168.1.10 255.255.255.0 vrrp 1 ip 192.168.1.1 vrrp 1 priority 110 vrrp 1 preempt ``` ### VRRP-Specific Timer Configuration ``` interface Ethernet1/1 vrrp 1 timers advertise 3 vrrp 1 timers learn ``` --- ### VRRPv3 Enhancements - Adds **IPv6 support** and protocol extensibility. - Enable globally with: ```bash fhrp version vrrp v3 ```