12.1 First Hop Redundancy Protocols (HSRP, VRRP & GLBP)

12.1 First Hop Redundancy Protocols (HSRP, VRRP & GLBP)

Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topic 3.3.c (configure first hop redundancy protocols such as HSRP and VRRP), reinforced by topic 1.1.b, requires candidates to configure and verify First Hop Redundancy Protocols (FHRP), including Hot Standby Router Protocol (HSRP), Virtual Router Redundancy Protocol (VRRP), and Gateway Load Balancing Protocol (GLBP). Mastery requires analyzing virtual MAC address generation, timer tuning, state machines, preemption mechanics, and Enhanced Object Tracking (EOT) integration.

In enterprise access layer architectures, client endpoints (PCs, IP phones, wireless access points, IoT controllers) are configured with a single static default gateway or obtain one via DHCP. If that physical default gateway router fails, endpoints lose all off-subnet reachability even if alternative physical routers exist on the same subnet segment. First Hop Redundancy Protocols (FHRPs) solve this single point of failure by clustering two or more Layer 3 devices into a single logical gateway abstraction sharing a Virtual IP (VIP) and Virtual MAC (VMAC) address.

+-----------------------------------------------------------------------------------+
|                         FIRST HOP REDUNDANCY TOPOLOGY                             |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|                              [ Upstream Core / WAN ]                              |
|                                    /         \                                    |
|                        Link A     /           \     Link B                        |
|                                  v             v                                  |
|                      +----------------+   +----------------+                      |
|                      | Router-1 (R1)  |   | Router-2 (R2)  |                      |
|                      | Physical IP:   |   | Physical IP:   |                      |
|                      |  192.168.1.2   |   |  192.168.1.3   |                      |
|                      +----------------+   +----------------+                      |
|                         (Active / Master)    (Standby / Backup)                   |
|                              \             /                                      |
|                               \           /                                       |
|                                v         v                                        |
|                      ================================== VLAN 10                   |
|                      Logical Default Gateway:                                     |
|                      Virtual IP (VIP) : 192.168.1.1                               |
|                      Virtual MAC (VMAC): 0000.0c9f.f00a (HSRPv2 Group 10)         |
|                                      |                                            |
|                                      v                                            |
|                            +-------------------+                                  |
|                            | End-User Host     |                                  |
|                            | IP:  192.168.1.50 |                                  |
|                            | GW:  192.168.1.1  |                                  |
|                            | ARP: VMAC -> R1   |                                  |
|                            +-------------------+                                  |
+-----------------------------------------------------------------------------------+

1. Hot Standby Router Protocol (HSRPv1 vs HSRPv2)

Hot Standby Router Protocol (HSRP) is a Cisco-proprietary redundancy protocol (RFC 2281 for v1) designed to allow transparent failover of the first-hop IP router. In an HSRP group, one router is elected as the Active Router (responsible for forwarding packets sent to the group VIP and answering ARP requests for the VIP), one is elected as the Standby Router (monitoring the active router's health and prepared to assume active forwarding), and all remaining routers reside in the Listen state.

Architectural Evolution: HSRPv1 vs HSRPv2

+-----------------------------------------------------------------------------------+
|                         HSRP VIRTUAL MAC ADDRESS STRUCTURE                        |
+-----------------------------------------------------------------------------------+
| HSRPv1 IPv4 Virtual MAC (e.g., Group 10 -> Hex 0x0A):                             |
| +--------------------------------+-----------------+----------------------------+ |
| |     Cisco OUI (24 bits)        | HSRP ID (16 bits) |  Group Number (8 bits Hex) | |
| |           00:00:0C             |      07:AC      |             0A             | |
| +--------------------------------+-----------------+----------------------------+ |
| Resulting VMAC: 0000.0c07.ac0a                                                    |
|                                                                                   |
| HSRPv2 IPv4 Virtual MAC (e.g., Group 100 -> Hex 0x064):                           |
| +--------------------------------+-----------------+----------------------------+ |
| |     Cisco OUI (24 bits)        | HSRPv2 (12 bits)| Group Number (12 bits Hex) | |
| |           00:00:0C             |      9F:F       |            064             | |
| +--------------------------------+-----------------+----------------------------+ |
| Resulting VMAC: 0000.0c9f.f064                                                    |
|                                                                                   |
| HSRPv2 IPv6 Virtual MAC (e.g., Group 10 -> Hex 0x00A):                            |
| +--------------------------------+-----------------+----------------------------+ |
| |     Cisco OUI (24 bits)        | IPv6 ID (12 bits| Group Number (12 bits Hex) | |
| |           00:05:73             |      A0:0       |            00A             | |
| +--------------------------------+-----------------+----------------------------+ |
| Resulting VMAC: 0005.73a0.000a                                                    |
+-----------------------------------------------------------------------------------+

HSRP State Machine

An HSRP-enabled interface transitions through six deterministic states during initialization and election:

1. Disabled: Initial state before configuration or when the interface is administratively shutdown (shutdown).
2. Initial: The interface is up, HSRP is configured, but operational parameters are not yet running.
3. Learn: The router has not configured a static Virtual IP address and is waiting to receive a Hello packet from the Active router to discover the group VIP.
4. Listen: The router knows the Virtual IP address. It monitors periodic Hello packets from the Active and Standby routers. It is neither Active nor Standby (additional routers in a multi-router group remain in this state).
5. Speak: The router transmits periodic Hello packets and actively participates in the election for Active and Standby roles.
6. Standby: The router is the immediate candidate to take over active forwarding if the Active router fails. It transmits periodic Hello packets (default: every 3 seconds).
7. Active: The router is actively forwarding packets addressed to the Virtual MAC and answering ARP requests for the Virtual IP. It transmits periodic Hello packets (default: every 3 seconds) to suppress elections.

HSRP Election, Priority & Preemption Mechanics

• Priority Evaluation: Routers compare configured priority values (range 1 to 255, default = 100). The router with the highest priority wins the election and becomes the Active router. The router with the second-highest priority becomes the Standby router.
• Tie-Breaker: If priorities are identical, the router with the highest configured primary IPv4 address on the HSRP interface wins.
• Preemption (standby <group> preempt):
  • By default, preemption is disabled in HSRP. If a higher-priority router boots up or recovers from a failure, it will not displace an existing Active router operating with a lower priority.
  • Enabling preemption allows a newly available higher-priority router to seize the Active role immediately by transmitting an HSRP Coup message.
• Preemption Delay (preempt delay minimum <sec> reload <sec>):
  • In production enterprise environments, seizing the Active role immediately upon interface initialization causes catastrophic traffic black-holing if upstream routing protocols (OSPF, EIGRP, BGP) or Spanning Tree have not yet converged.
  • preempt delay minimum <sec> forces the recovering router to wait a specified duration after interface initialization before asserting active forwarding.
  • preempt delay reload <sec> forces the delay specifically after a full system reboot.

2. Virtual Router Redundancy Protocol (VRRPv2 vs VRRPv3)

Virtual Router Redundancy Protocol (VRRP) is an open, multivendor standard defined in RFC 3768 (VRRPv2) and RFC 5798 (VRRPv3). VRRP dynamically assigns responsibility for a virtual router to one of the VRRP routers on an IPv4 or IPv6 LAN.

VRRP Terminology & Roles

• Master Router: The router actively forwarding packets sent to the Virtual IP address and answering ARP/ND queries. Unlike HSRP, the Master is the only router that transmits periodic VRRP Advertisement packets (default interval: 1 second).
• Backup Router(s): One or more routers monitoring the Master. Backup routers remain completely silent and do not send periodic advertisements, minimizing control plane overhead.
• IP Address Owner: A VRRP router configured with a Virtual IP address that is identical to the physical IP address assigned to its local interface. The IP Address Owner automatically operates with the maximum priority of 255 and is immutable.

+-----------------------------------------------------------------------------------+
|                         VRRPv2 vs VRRPv3 SPECIFICATION                            |
+-----------------------------------------------------------------------------------+
|                                                                                   |
| Feature / Metric           VRRP Version 2 (RFC 3768)     VRRP Version 3 (RFC 5798)|
| -------------------------  --------------------------    -------------------------|
| Protocol Support           IPv4 Only                     Unified IPv4 & IPv6      |
| IP Protocol Number         IP Protocol 112               IP Protocol 112          |
| Multicast Address          224.0.0.18                    IPv4: 224.0.0.18         |
|                                                          IPv6: FF02::12           |
| Virtual MAC (IPv4)         0000.5e00.01XX                0000.5e00.01XX           |
| Virtual MAC (IPv6)         N/A                           0000.5e00.02XX           |
|                            (XX = VRID in Hex 01-FF)      (XX = VRID in Hex 01-FF) |
| Default Advertisement      1 Second                      1 Second (or centisecs)  |
| Sub-second Timer Support   Vendor proprietary millisecond Native Centisecond (10ms)|
| Default Preemption State   ENABLED (Default)             ENABLED (Default)        |
| Priority Range             1 to 254 (255 = IP Owner)     1 to 254 (255 = IP Owner)|
| Priority 0 Mechanism       Master shutdown signal        Master shutdown signal   |
| Authentication             Plain Text / MD5 (Deprecated) Removed in RFC 5798      |
+-----------------------------------------------------------------------------------+

VRRP State Machine

VRRP utilizes a simplified, 3-state finite state machine:

1. Initialize: Waiting for the underlying interface to become operational. No packets are sent or received.
2. Backup: The router listens for periodic Advertisements from the Master. If no advertisement is received within the Master_Down_Interval ($3 \times \text{Advertisement_Interval} + \text{Skew_Time}$), the Backup transitions to Master. $\text{Skew\_Time} = \frac{256 - \text{Priority}}{256} \text{ seconds}$
3. Master: Actively forwards traffic to the Virtual MAC, answers ARP/ND requests for the VIP, and transmits periodic Advertisements. When shutting down cleanly, the Master transmits an Advertisement with Priority 0, causing the highest-priority Backup to immediately transition to Master without waiting for the full Master_Down_Interval.

[!IMPORTANT] Critical Exam Difference: In HSRP, preemption is disabled by default (no standby preempt). In VRRP, preemption is enabled by default (vrrp preempt). To disable preemption in VRRP, you must explicitly issue no vrrp <group> preempt.

3. Gateway Load Balancing Protocol (GLBP)

Both HSRP and VRRP operate in an Active/Standby or Master/Backup paradigm where only a single router actively forwards data plane traffic for a given subnet VIP, leaving redundant hardware uplinks idle unless multi-group active/active slicing (e.g., odd VLANs active on R1, even VLANs active on R2) is manually engineered. Gateway Load Balancing Protocol (GLBP) is a Cisco-proprietary protocol that eliminates idle hardware by providing simultaneous active-active per-host load balancing over a single Virtual IP address.

+-----------------------------------------------------------------------------------+
|                         GLBP ARCHITECTURAL COMPONENTS                             |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|                           [ Active Virtual Gateway (AVG) ]                        |
|                           - Router 1 (Priority 150)                               |
|                           - Owns VIP: 192.168.1.1                                 |
|                           - Intercepts and answers all ARP Requests               |
|                           - Assigns distinct VMACs to AVFs                        |
|                                    /             \                                |
|                                   /               \                               |
|                                  v                 v                              |
|             [ Active Virtual Forwarder 1 ]     [ Active Virtual Forwarder 2 ]     |
|             - Router 1                         - Router 2                         |
|             - VMAC: 0007.b400.0101             - VMAC: 0007.b400.0102             |
|             - Forwards traffic sent to VMAC 1  - Forwards traffic sent to VMAC 2  |
|                                  |                 |                              |
|                        +---------+                 +---------+                    |
|                        |                                     |                    |
|                        v                                     v                    |
|                 [ Host A (PC-1) ]                     [ Host B (PC-2) ]           |
|                 - Default GW: 192.168.1.1             - Default GW: 192.168.1.1   |
|                 - ARP resolves to VMAC 1              - ARP resolves to VMAC 2    |
|                 - Traffic exits via R1                - Traffic exits via R2      |
+-----------------------------------------------------------------------------------+

GLBP Roles & Virtual MAC Structure

• Active Virtual Gateway (AVG):
  • One router elected per GLBP group (highest priority, tie-breaker highest IP).
  • Responsible for answering ARP requests for the virtual IP address. When a client broadcasts an ARP query for the VIP, the AVG replies with the Virtual MAC address of one of the available Active Virtual Forwarders based on the configured load-balancing algorithm.
  • Assigns unique Virtual Forwarder numbers (1 to 4) and Virtual MACs to participating routers.
• Standby Virtual Gateway (SVG): The backup router elected to take over the AVG role if the primary AVG fails.
• Active Virtual Forwarder (AVF):
  • Up to four routers (including the AVG itself) that actively forward traffic addressed to their assigned Virtual MAC.
• GLBP Virtual MAC Format: 0007.b400.XXYY
  • 0007.b4 = Cisco GLBP OUI
  • 00.XX = 6-bit zeros + 10-bit GLBP Group Number (XX in hex, 01 to FF for groups 1–1024)
  • YY = Virtual Forwarder Number (01 to 04 in hex)
• Multicast Transport: Multicast IP 224.0.0.102, UDP Port 3222.

GLBP Load-Balancing Algorithms

1. Round-Robin (Default): The AVG distributes AVF MAC addresses sequentially across consecutive client ARP requests. (Client 1 gets VMAC 1, Client 2 gets VMAC 2, Client 3 gets VMAC 1, etc.).
2. Weighted: The AVG distributes ARP replies proportionally based on the advertised weighting value configured on each forwarder (glbp <group> weighting <val>). A router with weight 200 receives twice as many ARP mappings as a router with weight 100.
3. Host-Dependent: The AVG guarantees that a specific client endpoint (identified by client MAC address) always receives the exact same AVF Virtual MAC in ARP replies. Essential for stateful state tracking (e.g., stateful firewalls or asymmetric NAT).

Forwarder Failover & Timers

If an AVF fails, another router in the GLBP group assumes responsibility for the failed AVF's Virtual MAC (Primary Virtual Forwarder vs Secondary Virtual Forwarder) while retaining its own VMAC. Two timers govern this process:

• Redirect Timer (Default 600s / 10 min): The interval during which the AVG continues to include the failed router's VMAC in ARP replies, expecting the failed forwarder to recover.
• Secondary Holddown / Timeout Timer (Default 14400s / 4 hours): When this timer expires, the failed AVF's VMAC is permanently purged from the GLBP group, and clients must re-ARP.

4. Comprehensive FHRP Comparison Matrix

5. Enhanced Object Tracking (EOT) & SLA Integration

FHRP protocols operate at the LAN interface level. If a primary router's upstream WAN/Core interface fails, the LAN interface remains up, and the router continues sending FHRP Hellos, maintaining the Active/Master role and black-holing all outbound traffic. Enhanced Object Tracking (EOT) solves this by coupling FHRP priority to upstream interface states, IP route table presence, IP SLA probe results, or complex Boolean logic.

+-----------------------------------------------------------------------------------+
|                         ENHANCED OBJECT TRACKING ARCHITECTURE                     |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|                  +----------------------------------------------+                 |
|                  |   Upstream WAN / ISP Gateway (203.0.113.1)   |                 |
|                  +----------------------------------------------+                 |
|                                         ^                                         |
|                         IP SLA Probe #1 | (ICMP Echo every 5 sec)                 |
|                                         v                                         |
|                  +----------------------------------------------+                 |
|                  | Router 1 (Active Gateway)                    |                 |
|                  | - Track Object 10: State of IP SLA Probe 1   |                 |
|                  | - Normal Priority: 110                       |                 |
|                  | - If Track 10 FAILS -> Decrement Priority 20 |                 |
|                  | - Degraded Priority: 90                      |                 |
|                  +----------------------------------------------+                 |
|                                         |                                         |
|                     HSRP Priority Drop  | (R1 Priority 90 < R2 Priority 100)      |
|                     Triggers Preempt    v                                         |
|                  +----------------------------------------------+                 |
|                  | Router 2 (Standby Gateway)                   |                 |
|                  | - Priority: 100 with 'standby 10 preempt'    |                 |
|                  | - Seizes ACTIVE Gateway role immediately!    |                 |
|                  +----------------------------------------------+                 |
+-----------------------------------------------------------------------------------+

Tracking Mechanisms

1. Interface State Tracking: Tracks physical link or line protocol state (track 1 interface GigabitEthernet0/0/1 line-protocol).
2. IP Route Reachability / Metric: Tracks if a specific prefix exists in the RIB (track 2 ip route 0.0.0.0/0 reachability).
3. IP SLA Probes: Tracks latency, jitter, or packet loss to an upstream cloud/ISP target (track 3 ip sla 100 reachability).
4. Boolean List Tracking: Combines multiple track objects using and / or logic (track 10 list boolean and).

6. Cisco IOS-XE Configuration & Verification CLI

1. HSRPv2 with Millisecond Timers and IP SLA Object Tracking

! Step 1: Configure IP SLA ICMP Echo Probe to ISP
ip sla 100
 icmp-echo 203.0.113.1 source-interface GigabitEthernet0/0/0
 frequency 5
ip sla schedule 100 life forever start-time now

! Step 2: Bind IP SLA probe to Enhanced Object Track
track 10 ip sla 100 reachability
 delay down 10 up 15

! Step 3: Configure HSRPv2 on Access Interface
interface GigabitEthernet0/0/1.10
 encapsulation dot1Q 10
 ip address 192.168.10.2 255.255.255.0
 standby version 2
 standby 10 ip 192.168.10.1
 standby 10 priority 110
 standby 10 preempt delay minimum 30 reload 60
 standby 10 timers msec 250 msec 750
 standby 10 authentication md5 key-string Enc0r#Pass2026
 standby 10 track 10 decrement 25

2. VRRPv3 Multi-Protocol Configuration

interface GigabitEthernet0/0/1.20
 encapsulation dot1Q 20
 ip address 192.168.20.2 255.255.255.0
 ipv6 address 2001:DB8:CAD:20::2/64
 !
 ! VRRPv3 IPv4 Address Family
 fhrp version vrrp v3
 vrrp 20 address-family ipv4
  priority 120
  preempt delay minimum 15
  address 192.168.20.1 primary
  track 10 decrement 30
 !
 ! VRRPv3 IPv6 Address Family
 vrrp 20 address-family ipv6
  priority 120
  address FE80::CAD:20:1 link-local
  address 2001:DB8:CAD:20::1 primary

3. GLBP Weighted Load Balancing Configuration

interface GigabitEthernet0/0/1.30
 encapsulation dot1Q 30
 ip address 192.168.30.2 255.255.255.0
 glbp 30 ip 192.168.30.1
 glbp 30 priority 120
 glbp 30 preempt delay minimum 20
 glbp 30 load-balancing weighted
 glbp 30 weighting 110 lower 85 upper 105
 glbp 30 weighting track 10 decrement 30
 glbp 30 forwarder preempt delay minimum 30

4. Verification and Troubleshooting Output

Router-1# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Gi0/0/1.10  10   110 P Active  local           192.168.10.3    192.168.10.1

Router-1# show standby GigabitEthernet0/0/1.10
GigabitEthernet0/0/1.10 - Group 10 (version 2)
  State is Active
    2 state changes, last state change 00:12:45
  Virtual IP address is 192.168.10.1
  Active virtual MAC address is 0000.0c9f.f00a (cfgd local)
    Local virtual MAC address is 0000.0c9f.f00a (v2 default)
  Hello time 250 msec, hold time 750 msec
    Next hello sent in 0.080 secs
  Preemption enabled, min delay 30 secs, reload delay 60 secs
  Active router is local
  Standby router is 192.168.10.3, priority 100 (expires in 0.620 sec)
  Priority 110 (configured 110)
  Track object 10 state Up decrement 25
  Authentication MD5, key-string "Enc0r#Pass2026"
  Group name is "hsrp-Gi0/0/1.10-10" (default)

Router-1# show glbp 30
GigabitEthernet0/0/1.30 - Group 30
  State is Active
    1 state change, last state change 00:08:12
  Virtual IP address is 192.168.30.1
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 1.456 secs
  Redirect time 600 sec, forwarder timeout 14400 sec
  Preemption enabled, min delay 20 secs
  Active is local
  Standby is 192.168.30.3, priority 100 (expires in 8.120 sec)
  Priority 120 (configured 120)
  Weighting 110 (configured 110), thresholds: lower 85, upper 105
    Track object 10 state Up decrement 30
  Load balancing: weighted
  There are 2 forwarders (1 active)
  Forwarder 1
    State is Active
    MAC address is 0007.b400.1e01 (default)
    Owner ID is 5006.0420.0001, redundancy state is Local
  Forwarder 2
    State is Listen
    MAC address is 0007.b400.1e02 (learnt GLBP)
    Owner ID is 5006.0420.0002, redundancy state is Remote