Why gateway redundancy is needed
A host normally has one configured default-gateway address. Even when two physical routers exist, the host will not automatically switch to a different gateway unless a redundancy protocol or another host-side mechanism is used. HSRP and VRRP solve this by presenting one virtual router to the LAN.
Gateway 10.10.10.1
The active/master device owns the forwarding responsibility and virtual MAC behaviour. Backup members monitor protocol messages and take over when the current forwarder is no longer eligible.
HSRP and VRRP comparison
| Area | HSRP | VRRP |
|---|---|---|
| Standardisation | Cisco-developed first-hop redundancy protocol. | IETF standard; VRRPv3 supports IPv4 and IPv6. |
| Primary roles | Active and standby. | Master and backup. |
| Election input | Configured priority, then tie-break rules. | Priority; the owner of the protected IPvX address has special priority behaviour. |
| Virtual identity | Virtual IP and protocol-defined virtual MAC. | Virtual router identified by VRID with virtual addresses. |
| Preemption | Often explicitly enabled, depending on platform/defaults. | Higher-priority backup normally preempts unless configured otherwise, subject to owner rules. |
Priority, preemption and object tracking
Priority controls which healthy member should forward. Preemption allows a newly available higher-priority member to reclaim the active/master role. A delay is often configured so routing adjacencies and uplinks have time to stabilise before the device takes over.
Interface or object tracking reduces priority when an upstream path fails. Without tracking, a gateway can remain active on the client VLAN even though its WAN, core or routing path is broken—creating a black hole.
- Track the actual service dependency, not merely the local access interface.
- Choose a decrement large enough to make the peer win.
- Use multiple tracking objects carefully to avoid unexpected cumulative reductions.
- Align Layer 2 root placement, gateway role and upstream routing where practical.
Failover sequence
During takeover, gratuitous ARP or neighbour-advertisement behaviour helps switches and hosts associate the virtual address with the new forwarder. Convergence time includes protocol detection, election, Layer 2 relearning and any routing recovery upstream.
Configuration examples
interface Vlan10 ip address 10.10.10.2 255.255.255.0 standby version 2 standby 10 ip 10.10.10.1 standby 10 priority 110 standby 10 preempt delay minimum 30 standby 10 track GigabitEthernet1/0 20
show standby brief show vrrp brief show track show arp show mac address-table show logging
Troubleshooting checklist
- Verify both devices use the same group/VRID, virtual IP, VLAN and protocol version.
- Check priority, preemption and tracked-object state.
- Confirm hello packets are not blocked and the peers share Layer 2 connectivity.
- Look for duplicate physical or virtual addresses.
- Check whether the active gateway has a valid upstream route and return path.
- Inspect MAC and ARP/ND tables after failover.
- Measure actual outage time rather than assuming protocol timer values equal end-to-end recovery.
Interview focus
Use these points to practise concise, operations-focused answers. Explain the concept first, then give a verification or troubleshooting example.
- Why do hosts use a virtual gateway address? It remains stable while different physical gateway devices take responsibility for forwarding.
- What is preemption? It allows a more-preferred device to take back the active/master role when it becomes eligible.
- Why is uplink tracking important? It prevents a gateway with a failed upstream path from continuing to attract client traffic.
- Does an FHRP replace dynamic routing? No. It protects the host's first hop; routing is still needed beyond the gateway.
- What should be checked after failover? Virtual role, tracked objects, ARP/ND, MAC learning, upstream routing and return-path reachability.