CCNA 200-301 · 12 of 16

First hop redundancy: what happens when the default gateway dies

Why a host cannot fail over on its own, how two routers share one virtual address and MAC, the differences between HSRP, VRRP and GLBP, and why tracking an uplink matters more than tracking the router.

Updated 2026-09-09

On this page

You can build a network with two of everything — two switches, two uplinks, two routers, two internet connections — and still have every desk stop working when one box reboots. The weak point is the one device with no redundancy at all: the host, which knows exactly one default gateway address and has no mechanism for trying another. First hop redundancy protocols exist to hide a second router behind the address the host already has.

The map

Read this first when short on time. Every branch is a section below.

Figure 1. The whole article on one page. Every branch is a section below; fold what you know, open what you do not.

The host is the single point of failure

A host's routing logic is short. If the destination is on my subnet, ARP for it and send directly. Otherwise, send to the default gateway. That is the entire algorithm, and it names one gateway.

Two things make this worse than it first sounds.

The gateway address is static, from the host's point of view. It came from DHCP or was typed in, and nothing in IP tells a host that its gateway has stopped working. There is no timeout, no retry with a different address, no protocol event. The host keeps sending frames to an address that no longer answers, indefinitely.

The ARP cache holds the wrong MAC. Even if a second router were configured with the same IP address, the host has cached the MAC of the first one, typically for four hours on Linux and Windows defaults. Frames continue to be addressed to a MAC that is no longer on the network.

Some workarounds exist and none is good. Proxy ARP lets a router answer on behalf of remote networks, so a host with a /8 mask ARPs for everything and any live router can answer — slow, fragile, and dependent on ARP timeouts. ICMP redirects can point a host at a better router, but only after the first one has already received the packet. Neither survives the router being gone entirely.

So the redundancy has to be invisible to the host. The address it was given must simply keep working.

The mechanism: a virtual address with a virtual MAC

Every first hop redundancy protocol works the same way, and the second half is the part people forget.

Two or more routers are configured with a shared virtual IP address. That address — not either router's real address — is what DHCP hands to hosts as the default gateway.
The group also has a virtual MAC address. Whichever router currently holds the role answers ARP requests for the virtual IP with that virtual MAC, and accepts frames sent to it.
The routers exchange hellos. If the active one stops speaking, the standby takes the role — and with it the virtual MAC.

The virtual MAC is what makes failover instant from the host's perspective. Because the MAC moves with the role, every cached ARP entry on every host remains correct. The switches relearn the MAC on a different port within one frame, and nothing else changes. Without a virtual MAC, failover would take as long as the slowest ARP cache in the building.

Figure 2. The shared identity. The virtual IP is the gateway hosts know; the virtual MAC is what keeps their ARP caches valid when the role moves.

HSRP

Hot Standby Router Protocol is Cisco's own, and the most common choice on Cisco equipment. One router is active and forwards; one is standby and waits; any others simply listen.

! Router A
RouterA(config)# interface vlan 10
RouterA(config-if)# ip address 10.1.1.2 255.255.255.0
RouterA(config-if)# standby version 2
RouterA(config-if)# standby 10 ip 10.1.1.1
RouterA(config-if)# standby 10 priority 110
RouterA(config-if)# standby 10 preempt
RouterA(config-if)# standby 10 name VLAN10-GW

! Router B — same virtual IP, lower priority
RouterB(config-if)# standby version 2
RouterB(config-if)# standby 10 ip 10.1.1.1
RouterB(config-if)# standby 10 priority 100
RouterB(config-if)# standby 10 preempt

Points that matter:

Priority decides, then IP address. Default priority is 100. Higher wins; on a tie the higher interface IP address wins.

Preemption is off by default, and you almost always want it on. Without it, a router that boots after the election does not take the active role even with a higher priority. The consequence is that after any maintenance, the roles end up wherever the reboot order left them, which quietly undoes whatever design you intended. Turn it on, on every router in the group.

The virtual MAC encodes the group number. HSRP version 1 uses 0000.0c07.ac plus the group in hex, so group 10 gives 0000.0c07.ac0a. Version 2 uses 0000.0c9f.f plus three hex digits, supporting group numbers up to 4095 rather than 255 — which matters because the usual practice is one group per VLAN.

Version 1 and version 2 do not interoperate. They use different multicast addresses and different packet formats, so a group with one router on each version has two active routers and a duplicate address. Configure the version explicitly.

Default timers are a 3-second hello and a 10-second hold time, so failover takes up to ten seconds. They can be tuned down to milliseconds:

RouterA(config-if)# standby 10 timers msec 200 msec 750

Aggressive timers give sub-second failover and risk false positives if the control plane is busy, so they are used where the application genuinely cares — voice, trading — and left alone otherwise.

RouterA# show standby brief

                     P indicates configured to preempt.
Interface   Grp  Pri P State    Active          Standby         Virtual IP
Vl10        10   110 P Active   local           10.1.1.3        10.1.1.1
Vl20        20   100 P Standby  10.1.1.3        local           10.1.20.1

VRRP and GLBP

VRRP: the standard version

Virtual Router Redundancy Protocol is the IETF standard, defined in RFC 5798, and it does the same job in a way that works between vendors. The differences from HSRP are small but exam-worthy.

	HSRP	VRRP	GLBP
Standard	Cisco	RFC 5798	Cisco
Roles	Active, standby	Master, backup	AVG, AVF
Virtual MAC	0000.0c07.acXX	0000.5e00.01XX	0007.b400.XXYY
Default priority	100	100	100
Preemption	Off by default	On by default	Off by default
Virtual IP can be a real address	No	Yes — the owner then has priority 255	No
Hello interval	3 s	1 s	3 s
Forwarding routers	One	One	All of them

The two genuinely useful differences: VRRP preempts by default, which is usually the behaviour you want anyway, and VRRP allows the virtual address to be one router's actual interface address. That router is then the address owner and automatically has priority 255, which cannot be beaten. It saves an address, and it means that particular router is always master when it is up.

RouterA(config-if)# vrrp 10 ip 10.1.1.1
RouterA(config-if)# vrrp 10 priority 110
RouterA(config-if)# vrrp 10 description VLAN10-GW

GLBP: use both routers at once

HSRP and VRRP leave the standby router idle. Gateway Load Balancing Protocol keeps one virtual IP but gives out several virtual MAC addresses, so different hosts end up sending to different routers.

One router is elected the active virtual gateway. It alone answers ARP requests for the virtual IP, and it replies to different hosts with different virtual MACs — round robin, weighted, or consistently per host. Each router that owns one of those MACs is an active virtual forwarder and forwards the traffic sent to it. If a forwarder fails, the gateway reassigns its MAC to a surviving router.

It is elegant, it is Cisco-only, and it has largely been overtaken. Modern designs get the same effect either by alternating which router is active per VLAN — half the VLANs on each — or by removing the problem entirely with a switch stack or virtual chassis that presents one logical device.

Tracking: the failure that actually happens

Here is the scenario the basic configuration handles badly. Router A is active. Router A's uplink fails, but Router A itself is perfectly healthy and keeps sending hellos. It remains the active gateway, hosts keep sending it their traffic, and it has nowhere to send it. Everything is up, and nothing works.

Object tracking fixes this by tying the priority to something that matters:

! track the uplink interface itself
RouterA(config)# track 1 interface GigabitEthernet0/1 line-protocol
RouterA(config)# interface vlan 10
RouterA(config-if)# standby 10 track 1 decrement 20

With priority 110 and a decrement of 20, losing the uplink drops Router A to 90 — below Router B's 100 — and Router B preempts. The decrement must be large enough to cross the gap, and preemption must be enabled on the other router, or nothing happens at all. Tracking without preemption is a configuration that looks complete and does nothing.

Tracking an interface catches a dead link. It does not catch a link that is up while the path beyond it is broken — the provider's equipment is fine, their upstream is not. For that, track reachability instead:

RouterA(config)# ip sla 1
RouterA(config-ip-sla)# icmp-echo 8.8.8.8 source-interface GigabitEthernet0/1
RouterA(config-ip-sla)# frequency 5
RouterA(config)# ip sla schedule 1 life forever start-time now
RouterA(config)# track 2 ip sla 1 reachability
RouterA(config)# interface vlan 10
RouterA(config-if)# standby 10 track 2 decrement 30

Now the router gives up the active role when it can no longer reach something on the far side of its uplink, which is a much closer proxy for "can I actually deliver traffic".

Watch out

Choose the tracked target carefully. Tracking a single public address means an outage at that address triggers a pointless failover; tracking your own next-hop router misses failures beyond it. Tracking two targets and requiring both to fail is the usual compromise.

Making it fit the rest of the design

A first hop redundancy protocol does not exist in isolation, and two alignment decisions decide whether it helps or quietly adds a hop to every packet.

Align the active gateway with the spanning tree root. If Switch A is the active HSRP router for VLAN 10 but Switch B is the spanning tree root for VLAN 10, then traffic from a host goes up to B, across the link to A to be routed, and back. The inter-switch link carries traffic it should never see, and a failure of that link is far more disruptive than it should be. Make the same switch root and active gateway for the same VLAN.

Alternate roles per VLAN to use both routers. With one group per VLAN, make Switch A active for the odd VLANs and Switch B active for the even ones, matching the spanning tree roots. Both boxes forward, both links carry traffic, and either can take the whole load. This is the standard campus pattern, and it delivers most of GLBP's benefit with protocols that are standard and widely understood.

! Switch A: root and active gateway for the odd VLANs
SwitchA(config)# spanning-tree vlan 10,30 root primary
SwitchA(config)# spanning-tree vlan 20,40 root secondary
SwitchA(config)# interface vlan 10
SwitchA(config-if)# standby 10 priority 110
SwitchA(config-if)# standby 10 preempt
SwitchA(config)# interface vlan 20
SwitchA(config-if)# standby 20 priority 90
SwitchA(config-if)# standby 20 preempt

In the wild

Switch stacks and virtual chassis — Cisco StackWise and VSS, Juniper's virtual chassis — remove the need for these protocols entirely by making two physical switches behave as one device with one gateway address.
Firewalls and load balancers from most vendors use VRRP or a close derivative for their own high-availability pairs, so the concepts transfer directly.
Cloud platforms hide the problem completely: an AWS or Azure subnet's gateway is a distributed function with no single device to fail, which is one of the genuine simplifications of cloud networking.

Virtual IP address: The shared gateway address hosts are configured with, owned by whichever router currently holds the active role.
Virtual MAC address: The layer 2 address associated with the group, which moves with the role so host ARP caches stay valid.
Preemption: The behaviour where a higher-priority router takes the active role back after it returns. Off by default in HSRP, on by default in VRRP.
Object tracking: Tying a router's priority to the state of an interface or a reachability test, so it steps aside when it can no longer forward.
Address owner: In VRRP, a router whose real interface address is the virtual address; it has priority 255 and is always master when up.

Recap

A host knows one default gateway and has no mechanism for trying another, so the redundancy must be invisible to it.
The cached gateway MAC is as much of a problem as the address, since it can persist for hours.
Every first hop redundancy protocol shares a virtual IP and a virtual MAC between routers.
The virtual MAC moving with the role is what makes failover instant for hosts.
HSRP is Cisco's, with active and standby roles, priority 100 by default and preemption off.
Preemption should almost always be enabled, or roles end up wherever the last reboot left them.
HSRP version 1 and version 2 do not interoperate, and version 2 supports group numbers up to 4095.
VRRP is the standard, preempts by default, and allows the virtual address to be a router's real address with priority 255.
GLBP hands out several virtual MACs so every router forwards, but it is Cisco-only and largely superseded.
Interface tracking lowers priority when an uplink fails, and requires preemption on the peer to have any effect.
IP SLA tracking catches an uplink that is up but not delivering traffic, which interface tracking cannot.
Align the active gateway with the spanning tree root per VLAN, and alternate both across two switches to use each of them.

Questions

Say the answer out loud before opening it.

Why can a host not fail over to a second router on its own?

Because its routing logic names exactly one default gateway and nothing in IP tells it that gateway has failed.

There is no timeout or retry mechanism for a dead gateway.
The host has also cached the gateway's MAC address, often for hours.
Proxy ARP and ICMP redirects are partial workarounds and both depend on something still answering.

This is why the entire category of protocols works by hiding the second router behind the address the host already has, rather than by informing the host.

Why does a virtual MAC address matter as much as a virtual IP?

Because hosts cache the gateway's MAC, so if only the IP moved, every host would keep sending to a MAC that is no longer present until its ARP entry expired.

The virtual MAC moves with the active role.
Switches relearn it on a different port within one frame.
Hosts see nothing at all and need not re-ARP.

Without it, failover time would be set by the longest ARP cache timeout on the network, which on Windows and Linux is measured in hours rather than seconds.

How does HSRP elect the active router?

Highest priority wins, and on a tie the higher interface IP address wins.

Default priority is 100 and the range is 0 to 255.
Preemption is off by default, so a higher-priority router that boots later does not take over.
Hellos are every 3 seconds with a 10-second hold time by default.

The lack of preemption by default is the source of most surprises, because roles end up determined by boot order rather than by configuration.

Why should preemption be enabled?

So that the router you designed to be active actually is active after any maintenance or reboot.

Without it, whichever router came up first keeps the role regardless of priority.
The design intent then silently diverges from reality, often for months.
It is also required for interface tracking to have any effect, since tracking only lowers a priority.

The one argument against it is that a flapping router will repeatedly take and lose the role, which is addressed with a preempt delay rather than by leaving preemption off.

What are the main differences between HSRP and VRRP?

VRRP is the IETF standard and works between vendors, preempts by default, uses one-second advertisements, and allows the virtual address to be a router's real interface address.

Roles are called master and backup rather than active and standby.
The virtual MAC range is 0000.5e00.01XX rather than 0000.0c07.acXX.
A router that owns the virtual address automatically has priority 255.

Functionally they are close enough that the choice usually comes down to whether every device in the pair is Cisco.

What does GLBP do differently, and why is it less common now?

It keeps one virtual IP but hands out several virtual MACs so all routers forward simultaneously; it is less common because it is Cisco-only and other designs achieve the same thing.

The active virtual gateway answers all ARP requests and distributes different MACs to different hosts.
Each active virtual forwarder handles traffic sent to its own MAC.
Alternating HSRP roles per VLAN gives comparable utilisation with a standard protocol.

Switch stacking removes the need entirely, since two physical switches present one gateway with no redundancy protocol running at all.

Router A is active, its uplink fails, and traffic stops. Why does HSRP not help?

Because Router A itself is healthy and keeps sending hellos, so it retains the active role even though it cannot forward anywhere.

HSRP only detects the peer going silent, not the peer becoming useless.
Object tracking ties the priority to the uplink's state so the router steps aside.
Preemption must be enabled on the peer or the lowered priority changes nothing.

This is the single most important configuration step beyond the basics, and it is the one most often left out.

How do you configure interface tracking, and what decrement should you choose?

Define a track object for the interface, then reference it from the group with a decrement large enough to drop this router below its peer's priority.

track 1 interface GigabitEthernet0/1 line-protocol then standby 10 track 1 decrement 20.
With priorities of 110 and 100, a decrement of 20 takes the active router to 90 and triggers failover.
A decrement of 5 in the same scenario does nothing, which looks like tracking not working.

Several tracked objects can decrement the same group, so a router losing two of three uplinks can be made to step aside while losing one is tolerated.

When is interface tracking not enough?

When the uplink stays up but the path beyond it is broken — the provider's equipment answers, their upstream does not.

The interface line protocol is up, so the track object never triggers.
IP SLA sends periodic pings to a target beyond the uplink and tracks reachability instead.
Tracking reachability is a much closer proxy for whether traffic can actually be delivered.

The target choice matters: a single public address makes you dependent on somebody else's uptime, so tracking two independent targets and requiring both to fail is the usual approach.

Why should the HSRP active router and the spanning tree root be the same switch?

Because otherwise traffic goes up to the spanning tree root, across the inter-switch link to the active gateway, and back — using the link between them for every routed packet.

The inter-switch link becomes a bottleneck and a critical dependency.
Failure of that link is far more disruptive than the design intended.
Aligning both roles per VLAN keeps the path direct.

Once aligned, alternating roles across the two switches per VLAN also lets both boxes carry traffic while each remains able to take the full load.

What happens if HSRP version 1 and version 2 are mixed in one group?

The two routers do not see each other, so both become active and the network has a duplicate IP address.

The versions use different multicast addresses and packet formats.
Each router logs itself as active with no standby.
Traffic behaviour becomes dependent on which router's ARP reply a host happened to receive.

Version 2 is worth standardising on because it supports group numbers up to 4095, which matters as soon as you use one group per VLAN.

How fast can failover be, and what limits how aggressive you should be?

Sub-second with millisecond timers, but aggressive timers risk false failovers when the control plane is busy.

Default HSRP timers give up to ten seconds of outage.
standby 10 timers msec 200 msec 750 reduces that to well under a second.
A router under high CPU load may fail to send hellos in time and trigger an unnecessary failover.

The usual approach is to tune timers only where an application genuinely notices — voice and real-time systems — and leave defaults elsewhere.

What is a VRRP address owner?

A router whose real interface address is the same as the group's virtual address; it automatically has priority 255 and is always master when it is up.

HSRP does not permit this — the virtual address must be distinct from both routers' addresses.
It saves an address on the subnet.
Priority 255 cannot be beaten, so the owner always wins the election.

It also means the virtual address responds to pings and management traffic as a normal interface would, which can be convenient or confusing depending on the monitoring setup.

How would you verify a first hop redundancy configuration is behaving?

show standby brief for the role and virtual address, then test by failing the tracked object and confirming the roles swap.

The output shows priority, whether preemption is configured, and which router is active.
Shutting the tracked uplink should move the active role within the hold time.
Checking a host's ARP cache confirms the virtual MAC is unchanged after failover.

Testing failover is the part most often skipped, and it is where misconfigured decrements and missing preemption are actually discovered.

Why do switch stacks make these protocols unnecessary?

Because two or more physical switches present themselves as one logical device with one control plane, so there is only one gateway and no role to hand over.

Cisco StackWise and VSS, and equivalents from other vendors, work this way.
Hosts and downstream switches connect to both members with a single EtherChannel.
Failure of a member is handled inside the stack rather than by a protocol between peers.

The trade is a shared control plane: a software fault or an upgrade affects the whole stack, which is why some designs deliberately keep two independent routers running a redundancy protocol instead.