First-Hop Redundancy (HSRP & VRRP)

By Alec Gauldin, Principal Network Engineer · Updated July 2026

New to this? Start with the explainer: HSRP vs VRRP: What's the Difference?

Every host on a LAN is configured with one default gateway address, which makes that gateway a single point of failure: if the router that owns it goes down, the whole subnet loses off-net reachability even when a second router sits right beside it. First-hop redundancy solves this by letting a group of routers share a virtual IP address (and a virtual MAC address) that the hosts point at. One router actively forwards traffic for that virtual address while another stands by, ready to take over in seconds. Because resilient default-gateway design is fundamental to real campus networks, FHRP concepts sit squarely in the current CCNA (200-301) blueprint; treat the exact topic weighting as something to confirm against Cisco's published exam topics, since Cisco revises those periodically.

The landscape has two protocols you must know. HSRP (Hot Standby Router Protocol) is Cisco-proprietary and uses Active/Standby roles; its version 1 virtual MAC is 0000.0C07.ACxx, where xx is the group number in hex (version 2 uses 0000.0C9F.Fxxx). VRRP (Virtual Router Redundancy Protocol) is an open standard (RFC 5798) that uses Master/Backup roles, with a virtual MAC of 0000.5E00.01xx, where xx is the VRID. Both present hosts with a single virtual IP and virtual MAC so failover is invisible to the clients. The 'How to Configure HSRP on Cisco' and 'How to Configure VRRP on Cisco' guides walk through each one command by command.

Election is where the two protocols share the same logic but differ in defaults, and this is a classic exam trap. In both, the router with the highest priority (default 100) becomes active/master, and ties break to the highest interface IP address. The crucial difference is preemption: HSRP has preempt OFF by default, so a recovered higher-priority router will NOT reclaim the active role until you explicitly enable it, whereas VRRP has preemption ON by default and the higher-priority master takes back over automatically. Knowing which protocol reclaims control on its own is exactly the kind of detail the exam and real troubleshooting hinge on.

The last core piece is interface (object) tracking. On its own, a router keeps the active role even if its own upstream link fails, which would black-hole traffic. Tracking ties the gateway's priority to the state of a tracked interface or object: when that uplink goes down, the router decrements its priority, and combined with preemption on the peer, the standby/backup takes over the virtual IP. Understanding the interplay of priority, preemption, and tracking is what separates memorizing commands from actually engineering a failover that works.

To master this topic, work it in three passes. First, understand the model on this page: virtual IP and MAC, active/standby versus master/backup, election by priority with an IP tie-break, the preemption default difference, and tracking. Second, keep the command cheat sheet open while you read the HSRP and VRRP configuration guides so the syntax and 'show standby' / 'show vrrp' verification become muscle memory. Third, build and grade the hands-on labs, or the bundle, so you prove failover actually happens: force the active router down, confirm the standby assumes the virtual IP and MAC with no host reconfiguration, and watch preemption behave differently between the two protocols.