VRRP Configuration on Cisco IOS
Build a standards-based virtual gateway with predictable master/backup election, upstream tracking, verification, and controlled failure testing.
Gateway Redundancy Learning Path
Start with the virtual-gateway idea, configure each major protocol, then compare and troubleshoot complete designs.
In This Lesson
Build VRRP around service availability rather than device status alone. You will configure the group, understand master ownership, add tracking, and test the real forwarding path.
Quick Learning Map
Keep these three decisions in view as you work through the detailed lesson.
Create the virtual router
Configure the same VRID and virtual IP on participating routers.
Control master selection
Use priority and address ownership to predict which router forwards.
Verify service failover
Track upstream health and confirm traffic survives a controlled failure.
VRRP Configuration on Cisco IOS at a Glance
Use this summary to establish the big picture before moving into commands, examples, and troubleshooting.
Standard
VRRP is an open standard for redundant default gateways.
Roles
The master forwards while backup routers monitor advertisements.
Failure signal
Tracking should represent service reachability whenever possible.
How VRRP works
Virtual Router Redundancy Protocol (VRRP) groups physical routers into one virtual router. The master forwards traffic for the virtual IP, while one or more backups listen for advertisements and can take over.
VRRP is the usual standards-based FHRP choice in a multivendor design. Confirm that all devices support compatible VRRP versions, address families, timers, and authentication options before assuming interoperability.
VRRP terminology compared with HSRP
| Function | VRRP term | HSRP term |
|---|---|---|
| Current forwarder | Master | Active |
| First takeover candidate | Backup | Standby |
| Group identifier | VRID / group | Group |
| Control message | Advertisement | Hello |
Configure VRRP
DSW1: preferred master
DSW1(config)# interface vlan 10 DSW1(config-if)# ip address 192.168.10.2 255.255.255.0 DSW1(config-if)# vrrp 10 ip 192.168.10.1 DSW1(config-if)# vrrp 10 priority 110 DSW1(config-if)# vrrp 10 preempt DSW1(config-if)# no shutdown
DSW2: backup
DSW2(config)# interface vlan 10 DSW2(config-if)# ip address 192.168.10.3 255.255.255.0 DSW2(config-if)# vrrp 10 ip 192.168.10.1 DSW2(config-if)# vrrp 10 priority 100 DSW2(config-if)# vrrp 10 preempt DSW2(config-if)# no shutdown
Track service health, not only chassis health
A master with a failed uplink can still advertise on the user VLAN. On supported IOS releases, decrement its VRRP priority when an important interface or tracked object fails.
DSW1(config)# interface vlan 10 DSW1(config-if)# vrrp 10 track GigabitEthernet1/0/48 decrement 20
If this syntax is unavailable, inspect the platform’s object-tracking integration. The design objective is unchanged: the router with the usable end-to-end path should be master.
Verify VRRP and test failover
DSW1# show vrrp brief Interface Grp Pri Time Own Pre State Master addr Group addr Vl10 10 110 3414 Y Master 192.168.10.2 192.168.10.1 DSW1# show vrrp DSW1# show track DSW1# show ip arp 192.168.10.1
Check the same group on both peers. Then maintain a continuous client ping while failing the master’s LAN SVI, tracked uplink, and finally the entire device in separate tests. Restore each condition and verify that preemption matches the intended recovery policy.
VRRP troubleshooting checklist
- Confirm both interfaces are in the same VLAN and IP subnet.
- Match VRRP version, group/VRID, virtual IP, and address family.
- Compare priority and preemption settings.
- Check whether multicast control traffic is filtered.
- Verify the tracked object changes state and decrements enough priority.
- Look for a duplicate use of the virtual IP outside the VRRP group.
- Confirm the host ARP entry maps the gateway IP to the expected virtual MAC.
Design Decisions Before You Configure VRRP
Choose the virtual IP and interface before touching priority values. Every router participating in the group must agree on the virtual address, and hosts must use that address as their default gateway. Confirm that the VLAN or routed segment permits the protocol advertisements and that both routers can reach the same client networks.
Priority determines the preferred master, but preemption determines whether that router will take the role back after recovery. Decide whether automatic preemption matches the business requirement. In some environments, keeping the recovered router in backup state avoids a second traffic interruption while the team verifies upstream paths.
Test the failure that matters to users: the gateway, the uplink, the tracked service or the complete router. Then observe both the control-plane role and client traffic. A role change without successful forwarding is not a successful failover.
VRRP FAQs
What is a VRRP address owner?
It is the router whose physical interface address equals the virtual IP. It has priority 255 and is preferred as master. Many designs instead use a separate virtual IP so ownership is not tied to a physical address.
Does VRRP support IPv6?
Modern VRRP specifications cover IPv4 and IPv6, but implementation and CLI support depend on the platform.
Why might both routers claim master?
They are not receiving compatible advertisements. Check VLAN continuity, multicast filtering, version, VRID, authentication, and timer configuration.
Next: GLBP Configuration