CCNP ENCOR 350-401: Configuring HSRP and VRRP for Default Gateway Redundancy

1. Introduction

In a VLAN-based campus, the default gateway is usually the first hop a host hits when it needs to talk to something outside its own subnet.

If that gateway disappears, users can often still reach devices in the same VLAN, but anything that has to cross into another subnet is basically dead in the water.

That’s exactly why first hop redundancy protocols, or FHRPs, are such a big deal in CCNP ENCOR and, honestly, why they’re absolutely essential in real networks.

Two multilayer switches do not automatically create gateway redundancy. If hosts point to one physical SVI address, that SVI is still a single point of failure. HSRP and VRRP fix that by giving hosts one shared virtual gateway identity while the switches quietly sort out which one’s actually forwarding traffic.

This article’s about how HSRP and VRRP actually work, how to configure them on Cisco IOS XE, how to verify failover the right way, and where these designs usually fall apart in production.

2. Why the Default Gateway Needs Redundancy

Hosts do not make routing decisions beyond their local subnet. When a destination is remote, the host sends the frame to its configured default gateway. If that gateway disappears, routed connectivity fails even if the rest of the network is healthy. That makes the gateway a hard dependency for user traffic, voice, wireless clients, printers, badge readers, and application sessions.

FHRPs give hosts a single virtual IP address and virtual MAC address for the gateway. One device forwards traffic at a time, and another is ready to take over. The host keeps using the same gateway IP, while the active forwarding device changes behind the scenes.

FHRP protects the default gateway identity, not every possible failure. If the access path to the gateway is lost, STP is broken, the VLAN is missing, or upstream routing is down, FHRP alone will not save the flow.

3. How First Hop Redundancy Works

At a protocol level, multiple routers or multilayer switches agree to share a virtual gateway. For IPv4, hosts ARP for the virtual IP and learn a virtual MAC. For IPv6, hosts use Neighbor Discovery and resolve the gateway through ND rather than ARP. During failover, the new active device may send gratuitous ARP for IPv4 or unsolicited Neighbor Advertisements for IPv6 so hosts and adjacent devices refresh their tables more quickly.

Adjacent Layer 2 devices learn the virtual MAC on the currently forwarding device’s interface or port-path. During failover, the virtual MAC value usually stays the same from the host perspective; what changes is where the switching infrastructure learns that MAC in the CAM table.

Honestly, those control packets are incredibly handy when you’re troubleshooting and trying to figure out what’s actually happening.

HSRP uses UDP port 1985. HSRP version 1 sends to multicast 224.0.0.2, while HSRP version 2 uses 224.0.0.102. VRRP uses IP protocol 112, not UDP or TCP, and uses multicast 224.0.0.18 for IPv4.

If you SPAN a VLAN and never see those control packets, you’re usually dealing with a Layer 2 problem, a filter issue, a version mismatch, or some broken adjacency somewhere along the path.

4. HSRP Deep Dive

HSRP is Cisco-proprietary, and in Cisco campus networks you’ll see it constantly.

In one HSRP group, there is one Active router, one Standby router, and any additional members remain in the Listen state.

HSRP steps through a pretty specific set of states: Initial, Learn, Listen, Speak, Standby, and then Active.

The important precision is this: routers in Listen know the virtual IP but do not send periodic hello messages and are not actively competing for Active or Standby until a state transition occurs. Routers in Speak do participate in hello exchange and election behavior.

Election logic is straightforward. Highest priority wins; if priorities tie, the highest IP address wins. Default priority is 100. HSRP preemption is not enabled by default, which is one of the most tested and most missed facts. Without preempt, a recovered higher-priority device does not automatically reclaim the Active role.

Default HSRP timers are typically 3 seconds hello and 10 seconds hold. If you tune the timers, keep both peers matched so the behavior stays predictable. Faster timers can make failure detection quicker, sure, but they also make the control plane more sensitive and can cause instability across a bunch of VLANs or on a noisy Layer 2 segment.

HSRP version behavior depends on the platform and IOS XE release, so don’t assume version 2 is the default everywhere. If you need version 2 behavior, set it explicitly.

HSRPv2 shows up a lot in modern networks because it gives you a larger group range and uses multicast a bit differently.

For IPv4 HSRP, the commonly recognized virtual MAC pattern is 0000.0c07.acXX, where XX is the group number in hexadecimal.

Just remember that’s the common IPv4 pattern, not some universal rule that applies to every HSRP deployment.

Authentication can matter operationally. Many Cisco platforms support HSRP authentication options such as plain text or MD5, but support varies by platform and release. Authentication mismatch can prevent proper adjacency or create split-brain behavior.

5. VRRP Deep Dive

VRRP is standards-based and is the usual choice when interoperability matters. VRRP uses one Master and one or more Backup routers.

VRRP is generally preemptive by default, and that’s one of the bigger operational differences compared with HSRP. In practice, a higher-priority router can usually take Master back when it returns, but I’d still verify the exact behavior on the platform you’re actually running. The default priority is typically 100, but VRRP has a special concept the exam likes: if a router owns the virtual IP because that IP matches its real interface address, it uses priority 255. That owner behavior affects election results.

VRRP sends advertisements every 1 second by default. Failover is not based on a hello/hold pair like HSRP. Instead, the Backup calculates a Master_Down_Interval using the advertisement interval and a skew value derived from priority.

For ENCOR, you don’t need to memorize the timer formula, but you do need to understand that VRRP relies on advertisements and that priority directly affects failover behavior.

For IPv4 VRRP, the virtual MAC is typically 0000.5e00.01XX. For IPv6 VRRPv3, the MAC block differs, commonly 00:00:5E:00:02:XX.

That’s an easy detail to miss if you only memorize the IPv4 value.

VRRP authentication support varies depending on the version and platform. Historically, VRRPv2 had authentication options, but they’re not strong by modern standards, and VRRPv3 removed authentication from the protocol itself.

In practice, you protect VRRP with Layer 2 trust boundaries and control-plane protections instead of assuming the protocol is doing the security work for you.

6.

HSRP vs. VRRP at a Quick Glance

GLBP also exists as another Cisco FHRP and provides gateway load balancing, but ENCOR most often emphasizes HSRP and VRRP fundamentals.

7. Complete IOS XE Lab Build

If you’re going to lab this the right way, you really want to include VLAN creation, Layer 2 adjacency, SVIs, routing, and tracking objects in the mix.

Example topology: VLAN 10 uses subnet 10.10.10.0/24, virtual gateway 10.10.10.1, DSW1 SVI 10.10.10.2, DSW2 SVI 10.10.10.3.

Each switch has an uplink to the core, and that’s the link we’ll track for failover.

!

Common prerequisitesip routing vlan 10 name USERS ! Inter-switch trunk example interface GigabitEthernet1/0/47 switchport mode trunk

switchport trunk allowed vlan 10 ! Access port example interface GigabitEthernet1/0/10 switchport mode access switchport access vlan 10 ! Track object on each switch

track 1 interface GigabitEthernet1/0/48 line-protocol

If you want to track real upstream reachability instead of just link state, use IP SLA together with object tracking.

ip sla 10

icmp-echo 192.0.2.1 source-interface Vlan10 frequency 3 ip sla schedule 10 life forever start-time now track 10 ip sla 10 reachability

8. HSRP Lab Configuration

This is a lab-ready HSRP example, not a full production template. It includes explicit versioning, tracking, and preempt delay to avoid premature failback before uplinks and routing are stable.

! DSW1 interface Vlan10

ip address 10.10.10.2 255.255.255.0

standby version 2

standby 10 ip 10.10.10.1 standby 10 priority 110 standby 10 preempt delay minimum 30 standby 10 timers 1 3 standby 10 track 1 decrement 30 no shutdown ! DSW2 interface Vlan10

ip address 10.10.10.3 255.255.255.000 standby version 2

standby 10 ip 10.10.10.1 standby 10 priority 100 standby 10 preempt delay minimum 30 standby 10 timers 1 3 standby 10 track 1 decrement 30 no shutdown

If DSW1 loses the tracked uplink, its effective priority drops from 110 to 80, which lets DSW2 take over as Active. If the decrement value is too small, failover might not happen even though the tracking state changes. That’s a pretty common misconfiguration.

9. VRRP Lab Configuration

! DSW1 interface Vlan10

ip address 10.10.10.2 255.255.255.0

vrrp 10 ip 10.10.10.1

vrrp 10 priority 110 vrrp 10 preempt vrrp 10 timers advertise 1 vrrp 10 track 1 decrement 30 no shutdown ! DSW2 interface Vlan10

ip address 10.10.10.3 255.255.255.000

vrrp 10 ip 10.10.10.1

vrrp 10 priority 100 vrrp 10 preempt vrrp 10 timers advertise 1 vrrp 10 track 1 decrement 30 no shutdown

Just validate the exact VRRP syntax on the IOS XE release you’re actually running. The logic is the same as HSRP: one shared virtual IP, explicit priorities, tracking, and controlled failover.

10. IPv6 FHRP Examples

IPv6 deserves just as much attention, because ENCOR expects you to understand that gateway redundancy still matters in dual-stack networks.

IPv6 hosts use Neighbor Discovery instead of ARP, so the resolution process works a little differently.

!

HSRP for IPv6 Exampleinterface Vlan10

ipv6 address 2001:db8:10:10::2/64 standby 10 ipv6 autoconfig standby 10 priority 110 standby 10 preempt ! VRRPv3 for IPv6 example interface Vlan10

ipv6 address 2001:db8:10:10::3/64

vrrp 10 address-family ipv6

address 2001:db8:10:10::1 primary priority 100 preempt exit-vrrp

IPv6 syntax varies a bit more by platform than IPv4 syntax, so definitely lab it on the software you’re actually using. For verification, add show ipv6 neighbors along with show standby or show vrrp.

11. Verification and Failover Testing

Baseline first, fail later. Useful commands include:

show standby brief show standby vlan 10 show vrrp brief show vrrp all show track show ip arp show ipv6 neighbors show mac address-table show spanning-tree vlan 10 show ip route show ip cef 192.0.2.1 show logging | include HSRP|VRRP|TRACK

Then test these scenarios: shut the active SVI, shut the tracked uplink, break the inter-switch trunk for that VLAN, restore the preferred node, and confirm preemption or delayed preemption. Run continuous pings to the virtual gateway and to a remote destination so you can measure packet loss. In a healthy failover, the host keeps the same gateway IP and usually the same virtual MAC; the network simply relearns where that MAC lives.

If traffic still fails after a role change, do not stop at FHRP output. Check upstream routing, CEF, STP state, and whether the tracked condition actually represents useful reachability.

12. Design Best Practices and Failure Scenarios

In traditional Layer 2 access and distribution designs, it usually makes sense to line up the FHRP active gateway with the STP root for that VLAN.

For example, you might make DSW1 the HSRP Active router and the STP root primary for VLAN 10, while DSW2 is Active and the root primary for VLAN 20.

That gives predictable forwarding and practical load sharing.

Track the right object. If the switch uplinks through a port-channel, track the port-channel, not a single member link. If local link state is not enough, track reachability with IP SLA to a core loopback or upstream next hop.

Understand failure modes. If the active switch powers off, failover is straightforward. If only the uplink fails and no tracking exists, the switch may keep answering as gateway and blackhole traffic. If the peer VLAN trunk fails, both devices may become Active or Master because they stop hearing each other. If STP converges slowly or the Layer 2 path changes during failover, end-to-end recovery may take longer than the FHRP timer alone suggests.

In routed access designs, STP/FHRP alignment may be less central because the gateway placement model changes. In StackWise Virtual, VSS, or similar logical-chassis designs, FHRP may still exist, but dependency on it can be reduced because the distribution pair behaves more like one logical system.

13. Troubleshooting Runbook

For deeper diagnosis, use debug standby, debug vrrp events, syslog review, and SPAN captures. In packet capture analysis, verify destination multicast, timer values, group identity, and whether control packets are missing entirely.

14. Security Hardening for FHRP

FHRP creates a trusted gateway identity, which makes it attractive to attackers. A rogue device that spoofs gateway behavior can influence traffic paths or cause outages.

Don’t rely on FHRP by itself for security.

Use practical first-hop security controls like DHCP snooping and Dynamic ARP Inspection, IP Source Guard, port security, RA Guard for IPv6, and tight access-layer trust boundaries.

Consider control-plane policing where appropriate. HSRP authentication can help prevent accidental or unauthorized participation, but exact support varies. VRRP authentication has important limitations depending on version. In real campus security, Layer 2 containment and host-facing hardening are more important than assuming the FHRP protocol itself is secure.

15. ENCOR Exam Takeaways

Memorize these facts: HSRP uses Active/Standby; VRRP uses Master/Backup. HSRP default priority is 100, default timers are 3/10, and preempt is not default. VRRP default priority is 100, the owner uses 255, and default advertisements are typically 1 second. HSRP uses UDP 1985; VRRP uses IP protocol 112. HSRP IPv4 virtual MAC is commonly 0000.0c07.acXX; VRRP IPv4 virtual MAC is 0000.5e00.01XX.

Common traps: assuming HSRP preempts by default, forgetting VRRP owner behavior, confusing ARP/ND changes with CAM movement, and believing FHRP failover guarantees full end-to-end convergence. For the exam and for real operations, always ask: did the role change, did the tracked object matter, and is the upstream path actually usable?

16. Conclusion

HSRP and VRRP solve one specific problem very well: they make the default gateway resilient. But successful deployments depend on more than a few interface commands. You need correct Layer 2 adjacency, intentional priorities, useful tracking, appropriate preemption behavior, and validation of the full traffic path.

In Cisco-only campuses, HSRP is a natural fit. In mixed-vendor networks, VRRP usually makes more sense. Either way, lab the failure cases. Shut the uplink. Break the peer VLAN. Restore the preferred node. Watch the role change, confirm CAM learning, check ARP or ND behavior, and verify that traffic actually recovers. That is the difference between memorizing FHRP and understanding it.