Default Gateway Redundancy: VRRP & HSRP

Short answer: a first-hop redundancy protocol (FHRP) lets multiple routers provide one virtual default gateway on a LAN. Virtual Router Redundancy Protocol (VRRP) is an IETF standard; Hot Standby Router Protocol (HSRP) is Cisco's protocol. They elect a forwarding router for a group, but do not automatically synchronize firewall sessions, NAT mappings, or the routers' routing tables.

Read ARP and the next hop, routing tables, and campus design.

One duty desk, two operators

A building's service desk has one published extension, but two operators can cover it. Callers use the same extension when a relief operator takes over. The virtual IP is that stable extension; the virtual MAC is the LAN delivery identity; the active router is the operator currently responsible. Advertisements are presence checks, priority selects the preferred operator, and preemption decides whether that operator takes the desk back after returning.

The limit matters: a relief operator needs access to the same procedures and working external lines. In the network, the backup needs valid routes, policy, and upstream connectivity. Taking over a virtual address doesn't copy those things into place.

The virtual gateway is not a third router

In this synthetic IPv4 LAN, router A has 10.20.0.2/24, router B has 10.20.0.3/24, and both participate in VRRP group 20. Hosts use virtual IP 10.20.0.1 as their gateway. The IPv4 VRRP virtual MAC is 00:00:5e:00:01:14: the final byte is VRID 20 expressed as hexadecimal 14.

The active router answers ARP for the virtual IP with the virtual MAC. When B takes over, the host's gateway IP and its virtual-MAC mapping can remain unchanged. Gratuitous ARP and frames sourced from the virtual MAC help the switches learn its new location. The switch's MAC-to-port entry changes even though the host's intended next hop doesn't.

VRRPv3 also supports IPv6, using separate IPv6 instances, Neighbor Discovery, and an IPv6-specific virtual MAC. Hosts normally learn their IPv6 default routers from Router Advertisements, not a DHCPv6 default-gateway option. The worked addresses and MAC above are IPv4 examples.

VRRP and HSRP are alternatives, not peers

Peers must use compatible protocol/version, group identifier, address family, virtual addresses, and LAN placement. HSRP v1 and v2 aren't interchangeable group members. VRRP IPv4 advertisements have TTL 255, checked on receipt; IPv6 uses Hop Limit 255. VRRPv3 provides no built-in authentication, so protect the local control-plane path and untrusted access ports rather than treating the protocol as a security boundary.

Only the active router sends periodic VRRP advertisements for an established group; backups listen. In established HSRP operation, both the active and standby routers send periodic hellos. Don't expect identical packet patterns from the two protocols.

Priority and preemption solve different problems

Higher VRRP priority is preferred. Ordinary backup-capable routers use 1 through 254, with default 100. Priority 255 belongs to the IP address owner; priority 0 signals that the active router is relinquishing responsibility. In the example, neither physical interface owns 10.20.0.1, so A uses 120 and B uses 100.

Failover lets B take over when A becomes unavailable. Preemption lets a higher-priority A replace a still-running B after A returns. Disabling preemption doesn't prevent takeover when the active router actually fails. For VRRP, the address owner still preempts regardless of that setting. Where supported, a recovery delay can allow routes and services to stabilize before resuming the duty desk.

Worked timer: not simply three missed seconds

For B at priority 100 with a learned advertisement interval of 1 second, RFC 9568 defines Skew_Time = (256 - Priority) / 256 * interval. Its Active_Down_Interval is 3 * interval + skew, measured from the last qualifying advertisement.

The elapsed time from a physical failure depends on where it occurs between advertisements. Graceful shutdown, interface state, vendor tracking, and accelerated detection can change behavior. Application recovery also includes forwarding updates and transport retries, so 3.609375 seconds is a timer calculation, not an outage guarantee. Aggressive timers can produce false transitions under load; validate them on the actual platform.

An alive gateway can still be the wrong gateway

If A's client-facing interface stays up but its upstream fails, A may continue sending VRRP advertisements and remain active. The duty-desk operator is present, but their outside line is broken. Routing reconvergence may restore a path through another link, or a supported tracking mechanism may lower A's priority or disable its group.

This is policy arithmetic, not portable configuration syntax. Track something meaningful: an interface-only check won't detect every upstream routing failure; a probe target can fail even when the rest of the network is healthy. Use stable targets, hysteresis/delays where supported, and a plan for asymmetric paths.

Verify the whole path

• Before a test: record both group states, priorities, timers, tracked objects, routes, virtual MAC location, and a real application transaction. On supported Cisco IOS platforms, show standby brief, show vrrp brief, and show track are useful read-only starting points; syntax varies.
• During an approved failure test: observe the role change and the duration of lost application delivery. Test upstream loss separately from complete router loss.
• After takeover: check new and existing sessions. NAT, firewall, VPN, and load-balancer state require their own supported synchronization or recovery design.
• After recovery: confirm whether preemption is intended, whether routes are ready, and whether the group flaps. Restore the planned topology and test the return path.

Two routers both claiming active can indicate lost control traffic, incompatible settings, or an unintended LAN partition. A successful role election with failed traffic points toward forwarding, policy, or upstream dependencies. Pinging the virtual IP alone is insufficient; VRRP's accept-mode/address-owner behavior can affect replies addressed to the router itself while transit forwarding works.

Related topics

Connect this to routing convergence, NAT state, stateful inspection, and failure verification.

Sources

• RFC 9568: VRRPv3: current terminology, timers, virtual MACs, and protocol behavior.
• RFC 2281: Cisco HSRP: historical informational description, not a current HSRPv2 configuration guide.
• Cisco HSRP features and functionality. Verify commands and defaults against the software release in use.