First Hop Redundancy Protocol: HSRP vs VRRP vs GLBP
FHRP is the family of protocols that lets multiple routers present one resilient virtual default gateway. Compare HSRP, VRRP, and GLBP, then see how tracking and failover protect the first hop.
Gateway Redundancy Learning Path
Start with the virtual-gateway idea, configure each major protocol, then compare and troubleshoot complete designs.
What is First Hop Redundancy Protocol?
First Hop Redundancy Protocol (FHRP) is the general name for protocols that let two or more routers or multilayer switches provide one resilient default gateway to a LAN. The hosts use a virtual IP address, while the participating network devices decide which one currently forwards the traffic.
The “first hop” is the first Layer 3 device a host uses to reach another IP network. A PC can have several DNS servers, but it normally has one active IPv4 default-gateway address. If that gateway disappears, the PC can still communicate inside its local subnet but cannot reach remote networks.
The single-gateway problem
Assume a user VLAN is 192.168.10.0/24. DSW1 uses 192.168.10.2 and DSW2 uses 192.168.10.3. Configuring all clients with DSW1 as their gateway makes DSW2 irrelevant during a DSW1 failure; the clients do not automatically try a different router address.
Without FHRP
Every host points to one physical router. Failure of that router or its LAN-facing SVI breaks off-subnet connectivity.
With FHRP
Every host points to 192.168.10.1. The active device owns the virtual identity and a peer can take it over.
What stays stable
The host’s IP settings and ARP target stay logically consistent while the forwarding device changes underneath.
Virtual gateway topology
How a virtual gateway works
Because clients send their gateway frames to the virtual MAC—not a physical interface MAC—the backup can start forwarding without changing the configured default-gateway IP. A gratuitous ARP may help refresh LAN tables, while the virtual MAC keeps host behavior predictable.
HSRP vs VRRP vs GLBP
| Protocol | Operational roles | Core design | Best-known strength |
|---|---|---|---|
| HSRP | Active, standby, listen | Cisco first-hop redundancy | Familiar Cisco IOS active/standby operation |
| VRRP | Master, backup | Open standards-based first-hop redundancy | Multivendor interoperability |
| GLBP | AVG and AVFs | Cisco redundancy with multiple virtual MAC forwarders | Host distribution across multiple gateways |
No protocol removes the need for sound Layer 2 and Layer 3 design. Align the preferred FHRP forwarder with the spanning-tree root and upstream routing path to avoid unnecessary traffic crossing between distribution devices.
Design checklist before configuration
- Reserve a virtual IP inside the VLAN subnet and exclude it from DHCP pools.
- Use a unique group number where platform rules or operational clarity require it.
- Set an explicit priority instead of depending on a tie-breaker.
- Decide whether the recovered preferred router should preempt the current forwarder.
- Track the uplink, next-hop reachability, or another object that represents real service health.
- Align FHRP forwarding and STP root placement per VLAN.
- Test both failure and recovery; asymmetric behavior often appears only during restoration.
Verify FHRP failover on Cisco IOS
Record the active device before introducing a failure, then repeat the same checks during failure and recovery. Use the command that matches the configured protocol: show standby brief for HSRP, show vrrp brief for VRRP, or show glbp brief for GLBP. Check tracked objects with show track.
- Confirm the expected active, standby, master, backup, AVG, or AVF roles.
- Ping the virtual IP and a destination beyond the active gateway.
- Fail the tracked uplink or test object, not only the LAN-facing interface.
- Confirm the peer assumes forwarding and note packet loss or convergence time.
- Restore the path and verify whether preemption returns the preferred device to its intended role.
First Hop Redundancy Protocol (FHRP) Frequently Asked Questions
What is FHRP?
First Hop Redundancy Protocol is a category of protocols that lets multiple routers present one resilient virtual default gateway to hosts on a LAN.
Why is a virtual IP address needed?
Hosts keep one stable default-gateway address while the physical device forwarding for that address can change during a failure.
Is FHRP a single protocol?
No. FHRP is a category. HSRP, VRRP, and GLBP are separate protocols that solve the first-hop availability problem differently.
Do hosts run HSRP, VRRP, or GLBP?
No. Hosts simply use a default-gateway IP. The participating routers exchange FHRP control messages and present the virtual identity.
Can FHRP load-balance?
GLBP was designed to distribute hosts across multiple active virtual forwarders. HSRP and VRRP commonly provide one forwarder per group; designers can also use multiple groups and make different devices active for different VLANs.
Does FHRP protect the complete network path?
No. FHRP protects first-hop gateway availability. Link, route, or object tracking is normally required to react to relevant upstream failures.
Does a lower or higher priority win?
For HSRP and VRRP, the higher priority is preferred. Exact defaults, timers, preemption behavior, and supported features depend on protocol version, platform, and software.
Authoritative references and next lesson
Check platform-specific defaults and supported features in the Cisco First Hop Redundancy Protocols Configuration Guide. VRRPv3 protocol behavior is standardized in RFC 5798.
Next: HSRP Configuration