First Hop Redundancy Protocols

What it is

A first hop redundancy protocol keeps a host's default gateway working when one router fails.

Every host has a default gateway, the router it sends traffic to when the destination is outside its own subnet. Most hosts have only one gateway address configured. If that router fails, the hosts cannot leave the subnet, even if a second router is sitting right next to the first.

A first hop redundancy protocol (FHRP) removes that single point of failure. Two or more routers share a virtual IP address, and hosts use it as their default gateway.

One router answers for the address at any time. If it fails, another takes over, with no change needed on the hosts.

How it works

The routers in a group act as one virtual router, and a standby router takes over when the active one stops responding.

The basic idea

The virtual router has:

• a virtual IP address, which is the hosts' default gateway
• a virtual MAC address, so that the hosts' ARP entry stays the same after a failover

The routers exchange hello messages to monitor each other. One is chosen to forward traffic for the virtual address, and the other waits.

If the hellos from the active router stop, the standby router takes over the virtual address and virtual MAC address. The hosts keep sending to the same IP and MAC address as before, and they notice at most a brief pause.

The three protocols

HSRP (Hot Standby Router Protocol) is the Cisco protocol. One router is active and forwards traffic for the virtual IP address. Another is standby and ready to take over.

• The router with the highest priority becomes active, and the highest IP address breaks a tie.
• By default, HSRP does not pre-empt, so a higher priority router that comes back later does not take over unless preempt is configured.
• Hellos are sent every 3 seconds, and the standby router takes over if it hears nothing for 10 seconds.
• HSRP version 1 uses virtual MAC 0000.0C07.ACxx and multicast 224.0.0.2. Version 2 uses 0000.0C9F.Fxxx and 224.0.0.102, and also supports IPv6.

VRRP (Virtual Router Redundancy Protocol) does the same job but is an open standard, so it works with other vendors' routers. One router is the master and the others are backups.

VRRP also differs in that the virtual IP address can be the real address of one of the routers, and that pre-emption is on by default.

GLBP (Gateway Load Balancing Protocol) is a Cisco protocol that also shares the load. HSRP and VRRP have one active router per group, so the others sit idle.

In GLBP, one router acts as the active virtual gateway (AVG). It hands out different virtual MAC addresses to different hosts in reply to ARP requests.

Each router in the group, called an active virtual forwarder (AVF), then forwards for one of those MAC addresses. The hosts all use the same gateway IP address, but their traffic is spread across the routers.

Load sharing with HSRP or VRRP

With HSRP or VRRP, you can still share traffic by creating two groups.

For example, router A is active for the VLAN 10 group and standby for the VLAN 20 group, and router B does the opposite. Half the hosts use one virtual address, and half use the other.

A short HSRP example

This configuration makes one router the preferred gateway.

interface GigabitEthernet0/0
 ip address 192.168.10.2 255.255.255.0
 standby version 2
 standby 1 ip 192.168.10.254
 standby 1 priority 110
 standby 1 preempt

Each router has its own real address on the interface (here .2 and .3). Both are given the same virtual address, 192.168.10.254, and the same group number.

The router with priority 110 becomes active. Hosts are set to use 192.168.10.254 as their gateway.

To check the state:

show standby
show standby brief

The output lists the group, the priority, the state (Active or Standby), the virtual IP address and the addresses of the active and standby routers.