You can have two of everything — two switches, two uplinks, two ISPs — and still lose the whole site when one router dies, because every host points at a single default gateway. HSRP and VRRP give that gateway a heartbeat: a virtual IP that fails over between two routers in a second, invisibly.
A host has exactly one default gateway, and it is a single point of failure. Build a beautifully redundant network — dual switches, bundled uplinks (see STP & EtherChannel), even dual ISPs (see Routing & OSPF) — and it still all funnels through one gateway IP burned into every DHCP scope. That router reboots and the entire subnet goes dark until someone repoints hundreds of devices. Unacceptable.
A First-Hop Redundancy Protocol fixes this by inventing a virtual IP and a virtual MAC that float between two (or more) routers. Hosts point at the virtual IP forever; behind the scenes one router is active and answers for it while the other stands by, listening for the active router's heartbeat. When the heartbeat stops, the standby takes over the virtual IP and MAC in about a second — no ARP re-learning, no host reconfiguration, usually not even a dropped ping. Cisco's version is HSRP; the open-standard equivalent is VRRP. This post builds both, adds interface tracking so a dead uplink also triggers failover, and covers the preempt behaviour that surprises everyone.
show output and the idea of a priority tie-break01
Two routers, one virtual IP, one group number. The higher priority becomes active; the other waits. Hosts use the virtual IP as their gateway and never know which physical router is answering.
# ── R1 — the intended active router ── R1(config)# interface vlan 10 R1(config-if)# ip address 192.168.10.2 255.255.255.0 # R1's REAL ip R1(config-if)# standby version 2 # v2: better timers, IPv6 R1(config-if)# standby 10 ip 192.168.10.1 # group 10, VIRTUAL ip .1 R1(config-if)# standby 10 priority 110 # higher = preferred active R1(config-if)# standby 10 preempt # reclaim active when back up R1(config-if)# standby 10 name VLAN10-GW # ── R2 — the standby (mirror, lower priority, its own real IP) ── R2(config-if)# ip address 192.168.10.3 255.255.255.0 R2(config-if)# standby version 2 R2(config-if)# standby 10 ip 192.168.10.1 # SAME virtual ip + group R2(config-if)# standby 10 priority 90 R2(config-if)# standby 10 preempt # Every host on VLAN 10 uses 192.168.10.1 as its default gateway.
A frequent beginner error is setting the standby ip to R1's own interface address. The virtual IP must be a third, unused address in the subnet (here .1), distinct from R1's .2 and R2's .3. The whole point is that .1 belongs to the group, not to a box — that's why it can move. Also: both routers must use the same group number and version, or they form two separate groups and both think they're active (you'll see duplicate-gateway symptoms).
02
One command tells you who's active, what the virtual IP and MAC are, and whether preempt is set. Then pull a cable and watch the standby take over.
R1# show standby brief P indicates configured to preempt. Interface Grp Pri P State Active Standby Virtual IP Vl10 10 110 P Active local 192.168.10.3 192.168.10.1 R1# show standby vlan 10 Vlan10 - Group 10 (version 2) State is Active Virtual IP address is 192.168.10.1 Active virtual MAC address is 0000.0c9f.f00a (v2 group 10 = ...f00a) Hello time 3 sec, hold time 10 sec Preemption enabled # Pull R1's uplink / shut its interface — R2 promotes within the holdtime: %HSRP-5-STATECHANGE: Vlan10 Grp 10 state Standby -> Active # Hosts keep pinging the gateway throughout — the VIP + virtual MAC moved.
Default HSRP hellos are 3 s with a 10 s holdtime — so a silent failure can dark the subnet for up to ten seconds. standby 10 timers msec 250 msec 800 cuts failover to under a second. Don't go absurdly low: too-aggressive timers cause false failovers under CPU load or brief congestion, which is worse than a slightly slower one. Sub-second is plenty; pair it with tracking (next section) so failover triggers on the real problem, not a missed hello.
03
HSRP by default only fails over if the active router dies entirely. But the common failure is subtler: the router is fine, its UPLINK is down. Tracking makes HSRP watch the uplink and step aside when the path — not the box — is broken.
# On R1: if the WAN/uplink interface goes down, drop priority by 30 R1(config)# track 1 interface GigabitEthernet0/0 line-protocol R1(config)# interface vlan 10 R1(config-if)# standby 10 track 1 decrement 30 # Math: R1 starts at 110. Uplink dies → 110 - 30 = 80, which is below # R2's 90. With preempt on R2, R2 takes over. Uplink returns → R1 back to # 110 → R1 preempts and reclaims active. Failover follows the PATH, not # just the chassis. R1# show track 1 Track 1 Interface GigabitEthernet0/0 line-protocol Line protocol is Up Tracked by: HSRP Vlan10 10
The decrement must be large enough to drop the active router below the standby's priority. If R1 is 110 and R2 is 105, a decrement 30 takes R1 to 80 — good, R2 wins. But if you'd left both near default (100), a small decrement might not cross over and failover silently never happens. Do the arithmetic: active_priority − decrement < standby_priority. And line-protocol tracks up/down; to fail over when the far end is unreachable-but-up, track an IP SLA object instead — which is exactly the next post in this series.
04
With one HSRP group, the standby router forwards nothing until a failure — expensive hardware sitting idle. Two groups with flipped priorities make each router active for half the VLANs, so both work and both back each other up.
# VLAN 10 → R1 active (priority 110), R2 standby # VLAN 20 → R2 active (priority 110), R1 standby R1(config)# interface vlan 20 R1(config-if)# standby 20 ip 192.168.20.1 R1(config-if)# standby 20 priority 90 # R1 is STANDBY for VLAN 20 R1(config-if)# standby 20 preempt R2(config)# interface vlan 20 R2(config-if)# standby 20 ip 192.168.20.1 R2(config-if)# standby 20 priority 110 # R2 is ACTIVE for VLAN 20 R2(config-if)# standby 20 preempt # Point half your DHCP scopes' gateways at each router's active VLAN. # Both boxes forward in steady state; either covers both if its peer dies.
05
VRRP does the same job as HSRP with standardized syntax, so it interoperates with non-Cisco gear. If your environment is mixed vendor, reach for VRRP; if it's all Cisco, HSRP is equally fine.
R1(config)# interface vlan 10 R1(config-if)# vrrp 10 ip 192.168.10.1 # virtual ip R1(config-if)# vrrp 10 priority 110 R1(config-if)# vrrp 10 description VLAN10-GW # NOTE: in VRRP, preempt is ON by default (HSRP requires it explicitly). R1# show vrrp brief Interface Grp Pri Time Own Pre State Master addr Group addr Vl10 10 110 3218 Y Master 192.168.10.2 192.168.10.1
| HSRP | VRRP | |
|---|---|---|
| Origin | Cisco proprietary | IETF open standard |
| Terms | Active / Standby | Master / Backup |
| Preempt default | Off (must enable) | On |
| Virtual MAC | 0000.0c9f.fXXX (v2) | 0000.5e00.01XX |
| Use when | All-Cisco shop | Mixed vendor |
06
Most FHRP tickets are one of three things: both routers think they're active, failover doesn't trigger, or it flaps. These commands isolate all three.
| Command | Answers |
|---|---|
| show standby brief | State, priority, preempt, active/standby peers, virtual IP — the one-liner. |
| show standby vlan 10 | Timers, virtual MAC, tracking, and state-change history. |
| show track | Tracked objects and their up/down state. |
| show vrrp brief | The VRRP equivalent of standby brief. |
| debug standby terse | Live state transitions when chasing a flap (turn off after). |
If show standby reports both routers active, they aren't hearing each other's hellos. Usual causes: a group-number or version mismatch (R1 group 10 v2, R2 group 10 v1 — different protocols on the wire); the VLAN/SVI is down on one side; or the trunk between them doesn't carry that VLAN (back to the allowed-VLAN list from the trunking post). Two "active" routers both answer for the virtual MAC → intermittent, maddening connectivity. Confirm the same group + version and that the two SVIs can actually reach each other before touching anything else.
07
RouterOS speaks VRRP natively, so the crossover is clean — the concepts map one-to-one.
| MikroTik / RouterOS | Cisco IOS |
|---|---|
| /interface vrrp add vrid=10 | vrrp 10 … (or standby 10 for HSRP) |
| priority=110 | standby 10 priority 110 |
| The VRRP interface holds the virtual IP | Virtual IP via standby/vrrp … ip |
| Netwatch/script lowers priority on failure | track object + decrement |
| preemption-mode=yes | standby 10 preempt (HSRP) / default on VRRP |
FHRP is the last piece of a three-layer story this series has built: EtherChannel keeps links up, STP keeps the L2 topology loop-free, OSPF reroutes around dead paths — and HSRP/VRRP keeps the gateway alive so hosts never care that any of it happened. A network is only as redundant as its least-redundant hop, and for most sites the forgotten hop is the default gateway.
Takeaways
preempt set explicitly (VRRP has it on by default) or a recovered primary stays standby.NOCTIS designs redundant gateways — HSRP/VRRP with proper tracking and load sharing — for hotels, clinics, and SMBs that can't afford a subnet going dark. Tested by pulling power, documented so your team understands the failover.
Book a Discovery Call →