16 hands-on First-Hop Redundancy scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. First-Hop Redundancy configuration and troubleshooting practice for CCNA and CCNP.
Included with a subscription
Build gateway resiliency on a campus user LAN using VRRP between two edge routers. You will configure a VRRP group with a shared virtual IP, set a higher priority on the intended master, and prove failover from the end hosts without changing the default gateway. Includes full SSH management on routers, a clean L2 access switch, and two clients using the VRRP VIP.
Daily CCNA campus-redundancy lab focusing on HSRP preemption and interface tracking. You will refine an already-working HSRP default gateway so it follows real network health: fail to the standby when the preferred router loses its upstream, and preempt back when it recovers. The topology is an enterprise-clean small site with two distribution routers sharing a user VLAN through a Layer-2 access switch, each with its own point-to-point uplink to a core router. The starter works in steady state but suffers a blackhole during uplink failures and never reclaims Active without preemption. Your job is to add preempt and tracking on the correct router/interface and verify end-to-end forwarding under failover and failback.
Stand up HSRP on two routers sharing a single user VLAN so campus hosts point to a resilient virtual default gateway. You will configure HSRP on both routers, make one router the active forwarder, and verify failover from the end hosts.
Advanced CCNP VRRP lab: standardize the VRRP advertisement interval to 3 seconds on a shared user VLAN. Two IOS routers (R1, R2) and two hosts connect to a single access switch on VLAN 10 (10.0.10.0/24). Both routers share VRRP group 1 and the same virtual IP 10.0.10.254 so hosts keep one default gateway. R1 is the master via priority 110; both routers explicitly set 'vrrp 1 timers advertise 3' to enforce a consistent master advertisement rate and backup master-down detection window. Verify with 'show vrrp' (Advertisement interval 3.000 sec) and host pings to the VIP.
Configure VRRP with interface object tracking so the virtual gateway fails over when the active router loses its upstream link, avoiding black-holing. The site LAN (VLAN 10) uses a single virtual default gateway (10.0.10.254) shared by two IOS routers (R1, R2). A separate access switch (SW) bridges the LAN. Both routers uplink via Ethernet0/1 to a second switch (CORE) on VLAN 99 to represent the upstream path. R1 is the intended VRRP master (priority 110). You will create a track object that monitors R1's uplink (Ethernet0/1) and decrements its VRRP priority by 20 if the link fails, allowing R2 to preemptively take over as master. The lab grades the deterministic VRRP configuration: common group and virtual IP on both routers, R1 priority 110, the global track object, and the 'vrrp 1 track 1 decrement 20' tie-in on R1.
Advanced VRRP on a single VLAN: configure two VRRP groups on R1/R2 so each router is Master for one group and Backup for the other, distributing host egress while preserving gateway redundancy.
Intermediate CCNA lab focused on HSRP preempt behavior. Two routers share a virtual default gateway on a single user VLAN. The baseline already has HSRP group 1 with R1 at higher priority, but HSRP doesn't preempt by default — if R1 reboots, R2 stays active even after R1 returns. The learner enables preempt on R1 so it deterministically reclaims the active role whenever it's up, keeping the intended primary in control. Verification uses show standby on routers and basic host pings to the virtual gateway.
Set HSRP priority to deterministically choose the active default gateway on a shared LAN. Two IOS routers (R1, R2) and one access switch serve a small user LAN with a single virtual gateway IP. By default R2 becomes active due to its higher interface IP; raise R1’s HSRP priority so it becomes the designated active router for group 1 while hosts keep a single virtual gateway.
Harden an HSRP virtual default gateway with MD5 authentication so only trusted routers can participate. You’ll secure an existing HSRP group on two IOS routers that share a user VLAN via a single L2 switch. Validate the authentication state on both routers and confirm the endpoint still reaches the virtual IP.
Troubleshoot and repair a pre-broken HSRP gateway on a single shared LAN. Two routers (R1, R2) and two clients (PC1, PC2) connect to a single L2 switch (SW1) in VLAN 10. The hosts intermittently lose gateway reachability because both routers act active due to seeded faults. Use show commands to diagnose, then correct HSRP so both routers share one virtual IP and R1 deterministically wins active.
Build a fault-tolerant default gateway on a single LAN using HSRP. Two routers share one virtual IP so a host keeps the same default route even if one router fails. You will configure basic HSRP group 1 with a shared VIP, verify active/standby roles, and confirm the host can ping the virtual gateway.
Free with an account
Replace HSRP with open-standard VRRP to provide a shared virtual gateway on a single access VLAN. Configure VRRP group 1 with a common virtual IP and deterministic master/backup roles via priority and preempt. Validate using show vrrp commands and end-host pings.
Configure HSRP on two routers with a shared virtual gateway and speed up failover by tightening hello/hold timers to 1/3 seconds. Validate deterministic active/standby selection and confirm timer settings via show commands.
Migrate a single-subnet LAN from HSRP version 1 assumptions to HSRP version 2, enabling group numbers above 255. Configure HSRPv2 on two routers that share one virtual default gateway IP so hosts retain gateway resilience without reconfiguration.
Implement HSRP with interface tracking so the virtual gateway fails over when the active router loses its upstream link. Two routers (R1, R2) share a user LAN via SW with a single virtual default gateway for the PC, and both uplink to a separate CORE switch. The learner adds HSRP group 1 with a virtual IP, priority/preempt on R1, and tracks R1's uplink to drive deterministic failover.
Implement two HSRP groups on a single VLAN so each router is Active for one group and Standby for the other. Two hosts split default gateways across the two virtual IPs for deterministic load-sharing with redundancy.
A host has exactly one default gateway. That single address is the most fragile point in an otherwise redundant design: you can have two of everything — two uplinks, two distribution switches, two routers — and still lose the entire subnet because the one router the hosts point at went away. First-hop redundancy protocols exist to make that address survive the loss of the device behind it, by sharing a virtual IP and MAC between routers so hosts never notice the change.
These labs build that on real Cisco IOS. You'll configure HSRP and VRRP groups, assign the virtual IP hosts will use as their gateway, set priorities so the router you intend actually becomes active, enable preemption so the primary reclaims the role after recovering, and use interface tracking so a router that has lost its own uplink steps down instead of becoming a black hole. Then you fail the active router and watch what the hosts experience. Verification runs through show standby and show vrrp; grading checks the failover behaves as designed, because a group that comes up is not the same as a group that fails over correctly — and the difference only shows when something breaks.
HSRP is Cisco-proprietary and uses an active/standby pair with its own virtual MAC range; VRRP is the open standard with a master/backup model. The concepts map almost one-for-one, which is why the labs cover both — the exam expects you to recognise either.
Without it, a router keeps the active role even after losing the uplink it needed to be useful, so hosts happily forward traffic to a gateway that cannot reach anything. Tracking lowers its priority on failure so the other router takes over.
It lets the higher-priority router reclaim the active role once it recovers, instead of leaving the backup in charge indefinitely. Whether you want that is a design decision, and the labs have you configure it deliberately rather than by accident.
Study the theory behind these labs — the concept explainer and step-by-step guides.
Looking for something else? Browse the full lab archive, narrow it to self-standing labs, or see today's daily lab.