Describe the purpose, functions, and concepts of first hop redundancy protocols

Every host on a LAN is configured (usually by DHCP) with a single default gateway: the IP address of the router it sends all off-subnet traffic to. That creates a single point of failure. If the gateway router fails, every host on the subnet loses connectivity to everything outside the subnet, even if a second, perfectly healthy router is sitting on the same LAN. Hosts do not run routing protocols and will not discover the other router on their own; they keep sending frames to the dead gateway’s MAC address until someone changes their configuration.

First Hop Redundancy Protocols (FHRPs) solve this. Two or more routers on the same subnet cooperate to present one virtual router to the hosts. The hosts point at the virtual router’s address; behind the scenes, one physical router does the forwarding and the other stands ready to take over. When the active router fails, the standby takes over within seconds, and the hosts never notice because the gateway address and MAC address they know did not change. “First hop” simply means the first router a packet reaches after leaving the host.

How the virtual router works

All FHRPs share the same core ideas:

• Virtual IP address (VIP): an IP address in the subnet that is not the real address of any router interface. Hosts use it as their default gateway. For example, R1’s real address is 10.1.1.2, R2’s is 10.1.1.3, and the VIP is 10.1.1.1.
• Virtual MAC address (vMAC): a MAC address that belongs to the virtual router, generated from a protocol-specific pattern plus the group number. When a host ARPs for the VIP, the active router replies with the vMAC, not its own burned-in MAC.
• Active (or master) router: the one router that currently answers ARP for the VIP and forwards traffic sent to the vMAC.
• Standby (or backup) router: monitors the active router’s periodic hello messages. If the hellos stop for the hold time, it declares the active router dead and takes over: it begins forwarding frames addressed to the vMAC and sends a gratuitous ARP so switches learn the vMAC’s new port.
• Group: routers are grouped per subnet/VLAN with a group number; the group number is what ends up in the vMAC. A router can be active for one group and standby for another, which allows a crude form of load sharing across VLANs.
• Priority: a configurable number that decides which router becomes active. Higher wins; ties are broken by the highest real interface IP address.
• Preemption: whether a router with a higher priority is allowed to take back the active role from a lower-priority router that is currently active. Without preemption, the first router to come up stays active until it fails.

Because the vMAC stays the same across a failover, the hosts’ ARP caches remain valid. The switches learn the vMAC on a different port thanks to the gratuitous ARP. The failover is invisible to end users apart from a few lost packets.

The three FHRPs

In the vMAC patterns, XX (or XXX) is the group number in hexadecimal. HSRP group 1 version 1 uses 0000.0c07.ac01; group 10 uses 0000.0c07.ac0a. VRRP group 1 uses 0000.5e00.0101. GLBP uses XXYY where XX is the group and YY identifies the forwarder (1 to 4).

HSRP (Hot Standby Router Protocol) is the Cisco protocol and the one the exam expects you to configure. One router is active, one is standby, and any additional routers in the group are in the listen state. Only the active router forwards. HSRP version 1 supports group numbers 0 to 255 and sends hellos to 224.0.0.2; version 2 supports groups 0 to 4095, uses 224.0.0.102, adds millisecond timers and IPv6 support, and uses a different vMAC range. Version 1 and version 2 are not compatible with each other, so all routers in a group must run the same version. Hellos are sent every 3 seconds and the hold time is 10 seconds by default. HSRP passes through the states Initial, Learn, Listen, Speak, Standby, and Active.

VRRP (Virtual Router Redundancy Protocol) is the IETF open-standard equivalent, so it is the choice in multi-vendor networks. The terminology is master and backup. It is functionally similar to HSRP, but note the three differences the exam likes: preemption is on by default, advertisements go to 224.0.0.18 every 1 second (so failover is faster), and the VIP is allowed to be the real IP of one of the routers, in which case that router has priority 255 and is always master when it is up.

GLBP (Gateway Load Balancing Protocol) is Cisco’s answer to the biggest weakness of HSRP and VRRP: the standby router sits idle. In GLBP, one router is elected the Active Virtual Gateway (AVG). The AVG answers all ARP requests for the single VIP, but it hands out different virtual MAC addresses to different hosts, each vMAC belonging to a different Active Virtual Forwarder (AVF). Up to four AVFs (four routers) can forward traffic simultaneously for one group, so all routers carry load instead of just one. The AVG can distribute the vMACs round-robin (the default), weighted (more traffic to bigger routers), or host-dependent (a given host always gets the same vMAC). If an AVF fails, another router takes over its vMAC so hosts using it are not stranded. GLBP uses UDP 3222 and multicast 224.0.0.102, with 3-second hellos and a 10-second hold time.

HSRP configuration example

R1 and R2 both connect to VLAN 10, subnet 10.1.1.0/24. Hosts use 10.1.1.1 as the gateway. R1 should be the active router, and it should take the active role back after recovering from a failure.

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 10.1.1.2 255.255.255.0
R1(config-if)# standby version 2
! Use HSRPv2 (must match on both routers)
R1(config-if)# standby 1 ip 10.1.1.1
! Group 1, virtual IP 10.1.1.1 (the hosts' default gateway)
R1(config-if)# standby 1 priority 110
! Higher than R2's default of 100, so R1 wins the election
R1(config-if)# standby 1 preempt
! Allow R1 to reclaim the active role after it recovers

R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip address 10.1.1.3 255.255.255.0
R2(config-if)# standby version 2
R2(config-if)# standby 1 ip 10.1.1.1
! Same group and same VIP; priority stays at the default 100

Verification:

R1# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Gi0/0       1    110 P Active  local           10.1.1.3        10.1.1.1

R2# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Gi0/0       1    100   Standby 10.1.1.2        local           10.1.1.1

Read the columns: group 1, R1 has priority 110 with P (preempt enabled), R1 is Active, the standby is 10.1.1.3 (R2’s real address), and the VIP is 10.1.1.1. R2 sees the mirror image. The full show standby command adds the timers, the virtual MAC, and the version:

R1# show standby
GigabitEthernet0/0 - Group 1 (version 2)
  State is Active
    2 state changes, last state change 00:03:12
  Virtual IP address is 10.1.1.1
  Active virtual MAC address is 0000.0c9f.f001 (MAC In Use)
    Local virtual MAC address is 0000.0c9f.f001 (v2 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 1.264 secs
  Preemption enabled
  Active router is local
  Standby router is 10.1.1.3, priority 100 (expires in 8.912 sec)
  Priority 110 (configured 110)
  Group name is "hsrp-Gi0/0-1" (default)

The vMAC 0000.0c9f.f001 confirms HSRP version 2, group 1.

A useful optional feature is interface tracking: standby 1 track GigabitEthernet0/1 20 lowers R1’s priority by 20 if its uplink Gi0/1 goes down, so that R2 (priority 100) becomes active because 110 - 20 = 90 is now lower. Tracking only works if R2 has preemption enabled, because R1 does not fail; it just becomes less preferred.