Back to Blogs

HSRP Configuration on Cisco IOS

Configure an active/standby virtual gateway, control the election, track upstream health, and prove failover with Cisco IOS show commands.

HSRPCisco IOSFHRPConfiguration
HSRP Configuration on Cisco IOS cheat sheet: use this quick map before reading the detailed sections.
5-part learning path

Gateway Redundancy Learning Path

Start with the virtual-gateway idea, configure each major protocol, then compare and troubleshoot complete designs.

Part 2 of 5
Lesson overview

In This Lesson

Configure HSRP as a complete availability design, not just a pair of commands. Priority, preemption, tracking, verification, and failure testing are treated as one workflow.

  1. How HSRP works
  2. Lab addressing
  3. Configure HSRP step by step
  4. Track the upstream path
  5. Verify and test HSRP
  6. Common HSRP problems
From idea to operation

Quick Learning Map

Keep these three decisions in view as you work through the detailed lesson.

1

Form the group

Give both routers the same standby group and virtual IP.

2

Choose the active router

Use priority and preemption to make the preferred path predictable.

3

Track and test

Reduce priority when upstream service fails, then verify host continuity.

Fast orientation

HSRP Configuration on Cisco IOS at a Glance

Use this summary to establish the big picture before moving into commands, examples, and troubleshooting.

Roles

One active router forwards while one standby router is ready.

Identity

Hosts send traffic to a shared virtual IP and virtual MAC.

Design detail

Interface tracking makes failover respond to path health, not only router failure.

How HSRP works

Hot Standby Router Protocol (HSRP) lets routers in one group present a shared virtual IP and virtual MAC. One router is active and forwards frames sent to that virtual identity. One is standby and is the first candidate to take over; other members may remain in listen state.

Active

Answers for the virtual gateway and forwards its traffic.

Standby

Monitors hellos and takes over if the active member fails.

Listen

Understands the group but is neither active nor standby.

Higher HSRP priority is preferred. If priorities tie, the device with the higher interface IP address wins the election. Configure priority explicitly so the outcome documents the design.

Lab addressing

DeviceVLAN 10 addressHSRP rolePriority
DSW1192.168.10.2/24Preferred active110
DSW2192.168.10.3/24Preferred standby100
Virtual gateway192.168.10.1/24Host default gateway—

Configure HSRP step by step

DSW1: preferred active

DSW1(config)# interface vlan 10
DSW1(config-if)# ip address 192.168.10.2 255.255.255.0
DSW1(config-if)# standby version 2
DSW1(config-if)# standby 10 ip 192.168.10.1
DSW1(config-if)# standby 10 priority 110
DSW1(config-if)# standby 10 preempt
DSW1(config-if)# no shutdown

DSW2: preferred standby

DSW2(config)# interface vlan 10
DSW2(config-if)# ip address 192.168.10.3 255.255.255.0
DSW2(config-if)# standby version 2
DSW2(config-if)# standby 10 ip 192.168.10.1
DSW2(config-if)# standby 10 priority 100
DSW2(config-if)# standby 10 preempt
DSW2(config-if)# no shutdown

Configure clients with 192.168.10.1 as their gateway. Both HSRP peers must agree on version, group, virtual IP, authentication when used, and compatible timers.

Track the upstream path

Interface tracking prevents DSW1 from remaining active after its uplink fails. The decrement must lower its effective priority below the peer.

DSW1(config)# interface vlan 10
DSW1(config-if)# standby 10 track GigabitEthernet1/0/48 20

DSW1 starts at 110. A 20-point decrement produces 90, so DSW2 at 100 becomes preferred. For a more representative health check, supported platforms can track an IP SLA or route through an object.

Preempt matters: priority changes do not force a healthy lower-priority active router to yield unless preemption is enabled on the higher-priority peer.

Verify and test HSRP

DSW1# show standby brief
                     P indicates configured to preempt.
Interface   Grp Pri P State   Active          Standby         Virtual IP
Vl10        10  110 P Active  local           192.168.10.3    192.168.10.1

DSW1# show standby vlan 10
DSW1# show track
DSW1# show ip arp 192.168.10.1
  1. Start a continuous ping from a VLAN 10 client to a remote address.
  2. Confirm DSW1 is active and DSW2 is standby.
  3. Shut the tracked DSW1 uplink in a controlled lab or maintenance window.
  4. Confirm DSW2 becomes active and traffic resumes.
  5. Restore the link and observe preemption and any configured preempt delay.

Common HSRP problems

SymptomLikely causeCheck
Both peers appear activeHellos cannot cross the VLAN, group/version mismatch, or filteringVLAN, trunk, SVI state, ACL, HSRP version
Wrong router stays activePriority or preempt is missingshow standby brief and running config
Gateway works but upstream failsNo useful trackingTracked object and priority decrement
Peers do not authenticateAuthentication mismatchKey string/key chain and exact group config

HSRP FAQs

Should both routers use preempt?

That is common when deterministic recovery is desired. Consider a preempt delay so routing, trunks, and services stabilize before a recovered router takes the active role.

Does HSRP v1 interoperate with v2?

No. Configure the same version on all group members. Version 2 expands group numbering and uses different protocol details.

Can HSRP balance traffic?

A single HSRP group has one active forwarder. Use different active devices for different VLANs or groups when that design is appropriate.

Next: VRRP Configuration