LogoفارسیFA

First Hop Redundancy Protocols: HSRP, VRRP, and GLBP Explained

Every host on a network relies on a single default gateway, and that gateway becoming a single point of failure would undermine the redundancy carefully built everywhere else in the network. This article explains why first hop redundancy matters, walks through HSRP's active/standby model, compares it against the open-standard VRRP, and covers GLBP's added ability to load-balance traffic across multiple routers simultaneously.

HSRP ConfigurationVRRPGLBP Load Balancing

~6 min read · Updated Sep 11, 2026

Why the Default Gateway Is a Critical Single Point of Failure

Every host on a subnet is configured with a single default gateway address, discussed earlier in this series regarding IP routing, used to reach any destination outside its local subnet. Even with fully redundant routing protocols like OSPF and EIGRP, discussed earlier in this series, providing multiple paths through the network, if the specific router acting as a host's default gateway fails, that host has no way to reach anything beyond its local subnet — its statically configured gateway address simply stops responding.

The Core Idea: A Shared Virtual Gateway Address

First Hop Redundancy Protocols (FHRPs) solve this by allowing two or more physical routers to share a single Virtual IP Address (and virtual MAC address) that hosts are configured to use as their default gateway, with the protocol determining which physical router actually forwards traffic sent to that virtual address at any given moment.

Conceptual FHRP setup:

Router A (physical IP: 192.168.1.2)
Router B (physical IP: 192.168.1.3)
Virtual IP (shared): 192.168.1.1

Hosts are configured with default gateway
192.168.1.1 -- they never need to know or care
which physical router is currently handling
that address

HSRP: Cisco's Active/Standby Protocol

HSRP (Hot Standby Router Protocol) is a Cisco-proprietary FHRP using a simple active/standby model: one router actively forwards all traffic for the virtual IP, while one or more standby routers wait to take over if the active router fails.

Router A (config)# interface gigabitethernet 0/1
Router A (config-if)# ip address 192.168.1.2 255.255.255.0
Router A (config-if)# standby 1 ip 192.168.1.1
Router A (config-if)# standby 1 priority 110
Router A (config-if)# standby 1 preempt

Router B (config)# interface gigabitethernet 0/1
Router B (config-if)# ip address 192.168.1.3 255.255.255.0
Router B (config-if)# standby 1 ip 192.168.1.1
Router B (config-if)# standby 1 priority 100

The router with the higher priority (Router A at 110, versus Router B's default of 100) becomes the active router. The preempt keyword is essential and easy to forget: without it, if Router A fails and Router B takes over, Router A will not reclaim the active role when it comes back online, even though it has the higher configured priority — traffic would continue flowing through the lower-priority router indefinitely until a manual intervention or another failure.

HSRP States

Initial:  the starting state before HSRP begins
Learn:    the router does not yet know the
          virtual IP address
Listen:   the router knows the virtual IP but is
          neither active nor standby
Speak:    the router participates in the election
          process, sending and receiving hellos
Standby:  the router is the designated backup,
          ready to take over immediately
Active:   the router is currently forwarding
          traffic for the virtual IP

Verifying HSRP Status

Router A# show standby brief

Interface  Grp  Pri P State   Active         Standby        Virtual IP
Gi0/1      1    110 P Active  local          192.168.1.3    192.168.1.1

This output confirms exactly what should be expected: Router A shows itself as Active with the higher priority of 110, and correctly identifies Router B as the current standby — any unexpected state here, such as both routers claiming to be active simultaneously, points directly to a misconfiguration or a connectivity problem between the two routers preventing hello messages from being exchanged.

VRRP: The Open-Standard Alternative

VRRP (Virtual Router Redundancy Protocol) serves the identical purpose as HSRP but is a vendor-neutral open standard, making it the correct choice whenever a redundancy group needs to include non-Cisco equipment — directly analogous to the LACP-versus-PAgP choice discussed earlier in this series regarding EtherChannel.

Router A(config)# interface gigabitethernet 0/1
Router A(config-if)# vrrp 1 ip 192.168.1.1
Router A(config-if)# vrrp 1 priority 110

-- VRRP terminology differs slightly from HSRP:
-- the active router is called "Master" rather
-- than "Active," and standby routers are called
-- "Backup" rather than "Standby" -- functionally
-- nearly identical to HSRP, but this vocabulary
-- distinction matters when reading documentation
-- or troubleshooting output

One meaningful technical distinction: VRRP allows the virtual IP address to actually be one of the physical routers' own real interface addresses, rather than always requiring a separate dedicated virtual address as HSRP does — a subtle difference that occasionally simplifies migration scenarios.

GLBP: Adding Load Balancing to the Mix

Both HSRP and VRRP share a notable inefficiency: only the single active/master router ever forwards traffic, leaving any standby routers' bandwidth capacity completely unused during normal operation. GLBP (Gateway Load Balancing Protocol), another Cisco-proprietary protocol, solves this by allowing multiple routers to simultaneously forward traffic for the same virtual IP.

Router A(config-if)# glbp 1 ip 192.168.1.1
Router A(config-if)# glbp 1 priority 110

-- GLBP elects one "Active Virtual Gateway" (AVG)
-- responsible for responding to ARP requests
-- for the virtual IP, but the AVG can hand out
-- DIFFERENT virtual MAC addresses to different
-- hosts, each pointing to a different physical
-- router -- this is what actually distributes
-- the forwarding load across multiple routers
-- simultaneously, unlike HSRP/VRRP's single
-- active forwarder

The clever mechanism behind GLBP's load balancing is entirely at the ARP response level: when different hosts ARP for the same virtual IP's MAC address, discussed earlier in this series regarding address resolution, the AVG can respond with different virtual MAC addresses to different hosts, transparently spreading which physical router each host's traffic actually flows through, all while every host still believes it is using the exact same single default gateway address.

Comparing the Three Protocols

HSRP:
  - Cisco-proprietary
  - Active/Standby only -- one router forwards at a time
  - Widely deployed, well-understood, simple

VRRP:
  - Open standard, vendor-neutral
  - Active/Backup only -- one router forwards at a time
  - Correct choice for mixed-vendor environments

GLBP:
  - Cisco-proprietary
  - True load balancing -- multiple routers forward
    simultaneously
  - More complex, but makes full use of all
    available router bandwidth rather than
    leaving standby capacity idle

Why FHRPs Are a Standard Requirement in Enterprise Design

First hop redundancy is considered a baseline requirement in virtually every enterprise network design, since a redundant core and distribution layer, discussed throughout this series regarding routing protocols and Spanning Tree, provides little practical benefit if every single host still depends on one specific router as an unprotected single point of failure. Understanding the trade-offs between HSRP's simplicity, VRRP's vendor neutrality, and GLBP's load-balancing capability is essential for selecting the right protocol for a given network's specific redundancy and bandwidth-utilization requirements.

Written & researched by Dr. Shahin Siami

Related Articles

SDN and SD-WAN Fundamentals: Separating the Control Plane from the Data Plane

Traditional networking, covered throughout most of this series, distributes intelligence across every individual device, each making its own independent forwarding decisions. Software-Defined Networking fundamentally changes this by centralizing that intelligence, and this article explains the control plane and data plane separation underlying SDN, covers how SD-WAN applies these principles specifically to wide area network connectivity, and explains the practical benefits this architectural shift provides.

Continue

Enterprise Network Architecture: The Three-Tier Design Model

Every technology covered so far in this series -- VLANs, routing protocols, redundancy protocols -- needs an overall architectural framework to be deployed coherently rather than as an ad hoc collection of features. This article explains the classic three-tier hierarchical design model, covers the distinct role each layer plays, explains the simplified two-tier collapsed core alternative, and discusses how these models extend into modern data center design.

Continue

Multicast Fundamentals: IGMP and PIM Explained

Sending the same video stream individually to a thousand viewers would waste enormous bandwidth, and multicast solves this by delivering a single stream efficiently to exactly the devices that actually want it. This article explains how multicast addressing differs from unicast and broadcast, covers IGMP as the protocol hosts use to join multicast groups, and walks through how PIM builds the distribution trees that carry multicast traffic efficiently through a network.

Continue

Route Redistribution: Exchanging Routes Between Different Routing Protocols

Real enterprise networks often run multiple routing protocols simultaneously, whether due to mergers, legacy equipment, or vendor requirements, and these protocols do not automatically share routes with each other. This article explains why redistribution becomes necessary, covers the critical metric mismatch problem between protocols, walks through configuring redistribution between OSPF and EIGRP, and covers the routing loop risks that make careful redistribution design essential.

Continue

BGP Fundamentals: The Protocol That Runs the Internet

Every interior routing protocol covered so far in this series operates within a single organization's network, but connecting separate organizations together across the internet requires an entirely different protocol built around policy rather than pure shortest-path calculation. This article explains what makes BGP a path-vector protocol, covers the distinction between eBGP and iBGP, walks through essential path attributes used for path selection, and covers basic BGP configuration and verification.

Continue

Multi-Area OSPF: Scaling with Areas, LSA Types, and Route Summarization

A single-area OSPF design, discussed earlier in this series, does not scale to large networks, since every router must process the full topology database of every other router. This article explains why OSPF areas exist, covers the different Link-State Advertisement types that carry information between areas, explains the role of Area Border Routers, and walks through configuring route summarization to keep large multi-area networks efficient.

Continue
Previous ArticleNext Article