First Hop Redundancy Protocols (FHRPs)

This document outlines a collection of First Hop Redundancy Protocols (FHRPs) designed to provide seamless default gateway failover for end hosts. These protocols operate by sharing a virtual IP and MAC address between routers on the same subnet. With the aid of gratuitous ARP, failover occurs quickly and transparently to clients.

FHRP Comparison Table

Feature	HSRP	VRRP
Standard	Cisco proprietary / RFC 2281	Industry standard / RFC 3768
Terminology	Active / Standby	Master / Backup
Priority Range	0–255 (default: 100)	0–255 (default: 100)
Preemption	Optional	Enabled by default
Timers (hello/hold)	3s / 10s (default)	1s / 3s (default)
Multicast Group	224.0.0.2	224.0.0.18
Transport	UDP port 1985	IP Protocol 112
Authentication	Clear Text / MD5	Clear Text / MD5
Virtual MAC	`0000.0c07.acXX`	`0000.5E00.01XX`

HSRP (Hot Standby Router Protocol)

Cisco proprietary, also documented in RFC 2281.
Uses active/standby roles.
The router with the highest priority becomes active. In the event of a tie, the router with the highest IP address wins.
Preemption must be manually enabled.
Operates using UDP multicast to 224.0.0.2, port 1985.
Virtual MAC format: 0000.0c07.acXX (where XX = group ID in hex).
Supports Clear Text and MD5 authentication.

Basic HSRP Configuration

interface Ethernet1/1
  ip address 192.168.1.10 255.255.255.0
  standby 0 ip 192.168.1.1
  standby 0 priority 110
  standby 0 preempt
  standby 0 timers 5 15

standby 0 timers 5 15: 5s hello, 15s hold time.

HSRP Additional Configs

Delays and BFD

interface Ethernet1/1
  standby 0 preempt delay minimum 10
  standby delay minimum 30 reload 60
  bfd interval 250 min_rx 250 multiplier 4

standby delay minimum 30 reload 60 configures the delay period before the initialization of HSRP groups, where minimum is after a link comes up, and reload is after a device reboot.

standby 1 preempt delay minimum 380 determines the amount of seconds a group will wait before initiating preemption. Default is immediately.

Basic Tracking

[[IP Service Level Agreement (SLA) & Enhanced Object Tracking (EOT)]]

track 100 interface GigabitEthernet 0/0/0 { line-protocol | ip routing }
interface Ethernet1/1
  standby 0 track 100 [ decrement 20 | shutdown ]

HSRP Authentication

MD5 key-chain:

key chain HSRP1
  key 1
    key-string cisco1234

interface Ethernet1/1
  standby 0 authentication md5 key-chain HSRP1

MD5 key-chain:

interface Ethernet1/1
  standby 0 authentication md5 key-string HSRP1

Plain-text authentication:

interface Ethernet1/1
  standby 0 authentication text cisco1234

HSRP with Object Tracking

[[IP Service Level Agreement (SLA) & Enhanced Object Tracking (EOT)]]

ip sla 1
  icmp-echo 10.0.0.1
ip sla schedule 1 start-time now life forever
track 1 ip sla 1

interface Ethernet1/1
  standby 0 track 1 decrement 255

HSRPv2 Enhancements

Supports more groups per interface.
Uses dedicated multicast address: 224.0.0.102.
Supports IPv6.

interface Ethernet1/1
  standby version 2

VRRP (Virtual Router Redundancy Protocol)

Defined in RFC 3768, vendor-neutral standard.
Uses master/backup roles.
Priority-based master election:
- Higher priority wins; tie-breaker = highest IP address.
- Preemptive behavior is enabled by default.
Uses IP protocol 112 over multicast 224.0.0.18.
Virtual MAC: 0000.5E00.01XX (where XX = group ID in hex).
Supports Clear Text and MD5 authentication.

Most configurations copy over from HSR, but with vrrp instead of standby.

Priority Behavior

Valid priority range: 1–254
Default: 100

255 is reserved for a special case: If a router is configured with the interface IP address as the virtual IP (VIP), it must always be the master. In this case, VRRP automatically sets the priority to 255, and no other router is allowed to override it, not even with a higher manual priority.

This makes sense, because that router is literally the owner of the IP and can’t have another box claim it.

Priority Value	Meaning
1–254	Normal configured range (higher wins)
255	Reserved — used when a router owns the VIP directly
0	Resign — causes the router to stop being master

Basic VRRP Configuration

interface Ethernet1/1
  ip address 192.168.1.10 255.255.255.0
  vrrp 1 ip 192.168.1.1
  vrrp 1 priority 110
  vrrp 1 preempt

VRRP-Specific Timer Configuration

interface Ethernet1/1
  vrrp 1 timers advertise 3
  vrrp 1 timers learn

VRRPv3 Enhancements

Adds IPv6 support and protocol extensibility.
Enable globally with:

fhrp version vrrp v3