A host has exactly one default gateway. If that router dies, the host is cut off from every other network even when a second router sits right beside it, because the host does not know about it. HSRP fixes this by presenting several routers as one logical gateway. This guide explains how HSRP works, what each router state means, how the election and preempt behave, the exact IOS commands, and how HSRP compares with VRRP and GLBP. It is written for the Cisco CCNA 200-301 but is just as useful on the job. If default gateways and routing are new to you, read our OSPF guide for the router side; HSRP covers the host side.
What problem does HSRP solve?
End devices (PCs, servers, phones) are normally configured with a static or DHCP-provided default gateway. That gateway is a single IP address. Two simple fixes do not work: changing the address on a second router at failure time is manual and slow, and asking the host to try another address needs host support that most operating systems do not provide for gateways. A first hop redundancy protocol (FHRP) solves this in the network rather than on the host: it gives the hosts a virtual gateway address that always exists as long as at least one member router is alive.
The three FHRPs a CCNA candidate should be able to compare are HSRP, VRRP and GLBP. HSRP is the one most often shown in Cisco labs and on the exam, and the concepts (virtual IP, virtual MAC, election, preempt, tracking) transfer directly to the other two.
How does HSRP work?
The mechanism has four ingredients:
- A standby group. Routers on the same VLAN or subnet join the same group number on their interface (for example group 1).
- A virtual IP address. Configured with
standby 1 ip. It must be in the same subnet as the real interface addresses. Hosts use it as the default gateway. - A virtual MAC address. Derived from the group number. The Active router answers ARP requests for the virtual IP with this MAC, so the host's ARP cache stays valid after a failover.
- Hello messages. Routers in the group send hellos to a multicast address over UDP 1985 so each knows who is Active, who is Standby and whether they are still alive.
When the Active router stops sending hellos for the hold time, the Standby router becomes Active, starts answering for the virtual IP and virtual MAC, and sends a gratuitous frame so switches update their MAC address tables. The hosts see a pause of a few seconds and then carry on, with no change to their ARP cache or gateway setting.
| Item | HSRP version 1 | HSRP version 2 |
|---|---|---|
| Group numbers | 0 to 255 | 0 to 4095 |
| Hello multicast | 224.0.0.2 | 224.0.0.102 |
| Virtual MAC | 0000.0C07.ACxx (xx = group in hex) | 0000.0C9F.Fxxx (xxx = group in hex) |
| IPv6 support | No | Yes |
| Millisecond timers | No | Yes |
Example: group 1 on version 1 gives the virtual MAC 0000.0C07.AC01; group 10 gives 0000.0C07.AC0A. Cisco's HSRP configuration guide documents both MAC formats. Both routers in a group must run the same version, otherwise they will not form a group correctly.
What are the HSRP states?
HSRP is a small state machine. The six states, in the order a router usually moves through them, are:
| State | Meaning |
|---|---|
| Initial | The starting state: HSRP is not running yet, or the interface has just come up or been reconfigured. |
| Learn | The router has not yet learned the virtual IP address and is waiting to hear a hello from the Active router. |
| Listen | The router knows the virtual IP and is hearing hellos, but it is neither Active nor Standby. It stays here as a backup of the backup. |
| Speak | The router sends periodic hellos and takes part in the Active and Standby election. |
| Standby | The router is the candidate to become Active. It also sends periodic hellos. |
| Active | The router forwards packets sent to the virtual MAC and answers ARP for the virtual IP. It sends periodic hellos. |
Only the Active and Standby routers send hellos once the group is stable. In a two-router design you will almost always see only Active and Standby in the output, which is why exam questions that ask for the HSRP router states expect you to recognize all six names and to know that Learn and Listen are the passive ones. A memory aid: Initial, Learn, Listen, Speak, Standby, Active. A router in Listen with a third member in the group is a legitimate steady state, not a fault.
How is the HSRP Active router elected?
The HSRP router with the highest priority in the group becomes Active, and the highest IP address on the HSRP interface breaks a tie. The election uses two values, compared in this order:
- Highest HSRP priority wins. The range is 0 to 255 and the default is 100.
- Highest IP address on the HSRP interface breaks a tie.
The second-best router becomes Standby. The important exam detail is preempt. By default, a router that has a higher priority but joins after another router is already Active does not take over. The existing Active router keeps the role until it fails. To make the best-priority router always reclaim the role, configure standby preempt, optionally with a delay so that routing has time to converge first.
| Scenario | Result |
|---|---|
| R1 priority 100, R2 priority 100, both boot together | Higher interface IP address becomes Active |
| R1 priority 110 boots after R2 priority 100 is already Active, no preempt | R2 stays Active |
| Same, but R1 has standby preempt | R1 takes over and becomes Active |
| Active router interface goes down | Standby becomes Active after the hold time expires |
| Active router priority lowered below the peer's, peer has preempt | Peer becomes Active |
What are the HSRP timers and messages?
HSRP uses a 3-second hello timer and a 10-second hold timer by default, so a failover takes up to about ten seconds. Two timers matter. The hello timer (default 3 seconds) is how often the Active and Standby routers announce themselves. The hold timer (default 10 seconds) is how long a router waits without hearing a hello before it considers the Active router dead. The hold time should be at least three times the hello time. With defaults, a failover takes up to about ten seconds, which is acceptable for many networks and too slow for some. You can tune this with standby 1 timers, including millisecond values on version 2, though very aggressive values risk false failovers during CPU spikes. Millisecond timers can be set as low as 15 ms hello and 50 ms hold, but values that low risk false failovers when the CPU is busy; many designs start around 250 ms hello and 750 ms hold.
Hello messages carry the group number, state, priority, hello and hold times, virtual IP and an optional authentication string. Plain-text and MD5 authentication are available; if you configure authentication, it must match on every router in the group.
How do I configure HSRP on Cisco IOS?
Consider two distribution switches or routers, R1 and R2, serving VLAN 10 (10.1.10.0/24). R1 should normally be Active. Configuration on R1:
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 10.1.10.2 255.255.255.0
R1(config-if)# standby version 2
R1(config-if)# standby 10 ip 10.1.10.1
R1(config-if)# standby 10 priority 110
R1(config-if)# standby 10 preempt
R1(config-if)# no shutdownAnd on R2, which keeps the default priority of 100:
R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip address 10.1.10.3 255.255.255.0
R2(config-if)# standby version 2
R2(config-if)# standby 10 ip 10.1.10.1
R2(config-if)# standby 10 preempt
R2(config-if)# no shutdownHosts in VLAN 10 now use 10.1.10.1 as their default gateway. Notes: the group number (10) must match on both routers; standby version 2 must be configured on both and is entered before the group commands; and each router still has its own real address. Setting the version first matters because changing it later resets the group configuration. Optional extras are authentication and tuned timers:
R1(config-if)# standby 10 authentication md5 key-string S3cretKey
R1(config-if)# standby 10 timers 1 4
R1(config-if)# standby 10 preempt delay minimum 60On a Layer 3 switch the same commands go under the SVI, for example interface vlan 10. Pair this with a good Layer 2 design; the loop prevention that keeps the VLAN stable is covered in our spanning tree protocol guide, and the Active HSRP router should usually be the spanning tree root for the same VLAN so traffic does not cross the inter-switch link needlessly.
Practice this for the CCNA
Try the free Cisco CCNA 200-301 practice exam: 30 questions per session in practice mode, no signup needed. The full 500-question bank with exam mode is on the pricing page.
How do I verify HSRP with show standby?
Use show standby brief for a one-line summary of each group and show standby for full detail. The two verification commands to know are show standby brief and show standby. The brief form is a one-line-per-group summary (illustrative output):
R1# show standby brief
P indicates configured to preempt.
|
Interface Grp Pri P State Active Standby Virtual IP
Gi0/0 10 110 P Active local 10.1.10.3 10.1.10.1Read it left to right: interface and group, local priority, the P flag meaning preempt is configured, the local state, then the address of the Active router (local means this router), the Standby router and the virtual IP. The full command adds timers, the virtual MAC, the hello interval, tracked objects and the number of state changes:
R1# show standby
GigabitEthernet0/0 - Group 10 (version 2)
State is Active
Virtual IP address is 10.1.10.1
Active virtual MAC address is 0000.0c9f.f00a (MAC In Use)
Hello time 3 sec, hold time 10 sec
Preemption enabled
Active router is local
Standby router is 10.1.10.3
Priority 110 (configured 110)
Group name is hsrp-Gi0/0-10 (default)The virtual MAC 0000.0c9f.f00a is the version 2 format for group 10 (0x00A). If you see 0000.0c07.ac0a instead, the group is running version 1. The output above is illustrative, written to match the documented format and trimmed for readability; real output has a few more lines and varies by release.
What is HSRP tracking and why use it?
HSRP by itself only notices that the router or the LAN interface is dead. It does not notice that the router's uplink to the rest of the network has failed. In that case the Active router is alive, hosts still send traffic to it, and the traffic goes nowhere. Tracking fixes this: you tie the HSRP priority to an object, and when the object goes down the priority drops by a set amount so the peer can take over (the peer needs preempt enabled for this to work).
R1(config)# track 1 interface GigabitEthernet0/1 line-protocol
R1(config)# interface GigabitEthernet0/0
R1(config-if)# standby 10 track 1 decrement 20With priority 110 and a decrement of 20, the priority falls to 90 when Gi0/1 goes down. R2 at 100 now outranks R1 and, with preempt configured, becomes Active. Make the decrement large enough to push the priority below the peer's value; a decrement of 5 would leave R1 at 105 and nothing would change. You can also track a route with track 2 ip route 0.0.0.0 0.0.0.0 reachability to follow the default route instead of one interface.
Can HSRP load balance with multiple groups?
A single HSRP group has one forwarder, so the standby router sits idle. To use both routers, create two groups on the same VLAN (this is often called load sharing). R1 is Active for group 1 and R2 is Active for group 2. Half of the hosts get virtual IP 1 as their gateway and the other half get virtual IP 2, typically by DHCP scope or VLAN design.
R1(config-if)# standby 1 ip 10.1.10.1
R1(config-if)# standby 1 priority 110
R1(config-if)# standby 1 preempt
R1(config-if)# standby 2 ip 10.1.10.254
R1(config-if)# standby 2 preempt
R2(config-if)# standby 1 ip 10.1.10.1
R2(config-if)# standby 1 preempt
R2(config-if)# standby 2 ip 10.1.10.254
R2(config-if)# standby 2 priority 110
R2(config-if)# standby 2 preemptA related technique, often tested as a distractor, is per-VLAN load sharing: R1 is Active for odd VLANs and R2 for even VLANs. Either way both routers carry traffic and each backs up the other. If you want true per-host balancing inside one group, that is what GLBP is for.
HSRP vs VRRP vs GLBP: what is the difference?
All three FHRPs present a virtual gateway. The differences are who owns the protocol, how many routers forward, and a few defaults that exams love.
| Feature | HSRP | VRRP | GLBP |
|---|---|---|---|
| Standard | Cisco-proprietary (RFC 2281, informational) | Open standard (RFC 5798) | Cisco-proprietary |
| Forwarders per group | One Active | One Master | Up to four active forwarders (AVFs) |
| Role names | Active, Standby | Master, Backup | AVG, AVF |
| Default priority | 100 | 100 (owner of the IP uses 255) | 100 |
| Preempt default | Off | On | Off for the AVG; on for forwarders |
| Transport | UDP 1985 | IP protocol 112 | UDP 3222 |
| Multicast address | 224.0.0.2 (v1), 224.0.0.102 (v2) | 224.0.0.18 | 224.0.0.102 |
| Load balancing | Only by multiple groups | Only by multiple groups | Built in, per host |
| Can the virtual IP be a router’s real IP? | No | Yes (the owner) | No |
Rule of thumb for scenario questions: choose VRRP when the network includes non-Cisco routers, HSRP in an all-Cisco network where simplicity is the goal, and GLBP when you want automatic load sharing across several gateways. Cisco's documentation of VRRP and GLBP for IOS XE lives in the same First Hop Redundancy Protocols configuration guide as HSRP.
How do I troubleshoot HSRP?
Most HSRP problems fall into a handful of causes. Work through them in order:
- Both routers show Active. They are not hearing each other. Check that both interfaces are up in the same VLAN, that the trunk carries the VLAN, that no ACL or switch feature blocks UDP 1985 or the multicast address, and that the versions and group numbers match.
- Authentication mismatch. A different key or authentication type causes hellos to be ignored; the logs show an authentication failure message.
- Wrong router is Active after a reload. Preempt is off or the preempt delay has not expired. Check
show standbyfor "Preemption enabled". - Virtual IP in the wrong subnet. The virtual IP must share the subnet of the interface address; a mismatch prevents the group from working correctly.
- Hosts cannot reach the gateway after failover. Check the switch MAC address table and ARP: the virtual MAC should move to the new Active router's port.
- Frequent flapping. Timers are too aggressive, a link is unstable, or tracking decrements and preempt are fighting each other. Use
debug standbycarefully and only briefly on a production device.
Useful commands: show standby brief, show standby, show running-config interface, show ip interface brief and show mac address-table on the switch. Duplicate IP problems are another classic cause of odd behavior: if the virtual IP is also configured as a real address on a device, ARP will answer unpredictably.
How is HSRP tested on the CCNA?
The CCNA 200-301 exam guide covers the blueprint in detail. For HSRP specifically, Cisco's current published exam topics list first hop redundancy under IP Connectivity at the concept level. Exact bullet wording changes between exam versions, so read it yourself on the official Cisco CCNA exam topics page rather than relying on any third-party summary, including this one. Practically, expect to:
- Explain why a first hop redundancy protocol is needed and what the virtual IP and MAC do.
- Name the roles (Active and Standby) and, in some questions, the states.
- Compare HSRP, VRRP and GLBP: proprietary versus standard, priority and preempt defaults, load balancing.
- Read
show standby briefoutput and tell which router is Active or why a router is not. - Pick the missing command, usually
standby preempt, a priority change or tracking.
Common traps: forgetting that HSRP preempt is off by default while VRRP preempt is on; confusing the Standby router (elected, sends hellos) with a router in Listen (not elected); using the real IP as the host gateway; and expecting HSRP to load balance within one group. For a quick reference sheet, see the CCNA cheat sheet. If you are deciding whether Cisco is the right route at all, compare it with CompTIA in Network+ vs CCNA, and check the CCNA exam cost before booking. IP addressing questions around HSRP groups often depend on subnetting skills.
Check yourself: three quick HSRP questions
Answer in your head first, then open each one.
Check 1. Two routers run HSRP with default settings. R1 has priority 110, R2 has priority 100. R2 boots first. After R1 boots, which router is Active?
R2. Preempt is disabled by default, so R1 does not take over from an already Active R2 even though its priority is higher. Adding standby 1 preempt on R1 would make it take over.
Check 2. What does a host use as its default gateway in an HSRP design?
The HSRP virtual IP address, not either router’s real interface address. The virtual IP stays the same when the Active role moves.
Check 3. Which command shows each HSRP group, its state, the Active and Standby routers and the virtual IP in one table?
show standby brief. It lists interface, group, priority, preempt flag (P), state, Active address, Standby address and virtual IP.
HSRP practice questions with answers
Eight exam-style questions with explanations. For a larger bank, see CCNA practice questions or take the CCNA practice exam.
1. Which problem does HSRP solve?
It removes the default gateway as a single point of failure. Hosts are configured with one gateway address, and HSRP lets a second router take over that address if the first fails. Spanning tree solves Layer 2 loops, and routing protocols such as OSPF exchange routes, so neither is the answer.
2. What are the default HSRP priority and the default preempt behavior?
Priority 100, preempt disabled. A higher-priority router that joins later will not take over unless standby preempt is configured. Priority 255 or "preempt enabled by default" are common wrong answers (the latter is VRRP behavior).
3. Which HSRP state does a router occupy when it knows the virtual IP address but is neither Active nor Standby?
Listen. Learn is the earlier state where the router has not yet learned the virtual IP. Speak is the state where it is sending hellos and taking part in the election. Standby and Active are the two elected roles.
4. Routers R1 (priority 100, 10.1.1.2) and R2 (priority 100, 10.1.1.3) boot at the same time on the same HSRP group. Which becomes Active?
R2. Priorities tie, so the router with the higher IP address on the HSRP interface wins the election.
5. A router is Active with priority 110 and tracks its uplink with "standby 1 track 1 decrement 20". The uplink fails. What happens if the peer has priority 100 and preempt configured?
The Active router drops to priority 90. Because 90 is lower than the peer’s 100 and the peer has preempt enabled, the peer becomes Active. Without preempt on the peer, no switch would happen even though the priority is lower.
6. Which statement about GLBP is correct?
GLBP is Cisco-proprietary and provides load balancing within one group using an Active Virtual Gateway (AVG) that hands out different virtual MAC addresses to hosts, with Active Virtual Forwarders (AVFs) doing the forwarding. HSRP and VRRP have one forwarder per group.
7. Which multicast address and transport do HSRP version 1 hellos use?
224.0.0.2 (all routers) and UDP port 1985. HSRP version 2 uses 224.0.0.102. VRRP does not use UDP at all; it is IP protocol 112 to 224.0.0.18.
8. Both routers show Active for the same HSRP group. What is the most likely cause?
The routers cannot hear each other’s hellos, for example because of a VLAN or trunk mismatch, a blocked multicast, an ACL or an HSRP version/authentication mismatch. Each router assumes the other is down and elects itself. This is a split-brain condition and the fix is to restore hello connectivity.
Frequently asked questions
What is HSRP in networking?
HSRP (Hot Standby Router Protocol) is a Cisco-proprietary first hop redundancy protocol, described in informational RFC 2281. Two or more routers share a virtual IP address and virtual MAC address that hosts use as their default gateway. One router is Active and forwards traffic; another is Standby and takes over if the Active router fails, so hosts keep working without any reconfiguration.
What are the HSRP states?
HSRP routers move through six states: Initial (HSRP not running yet or interface just came up), Learn (waiting to learn the virtual IP from the Active router), Listen (knows the virtual IP but is neither Active nor Standby), Speak (sending hellos and taking part in the election), Standby (next in line to become Active) and Active (forwarding packets sent to the virtual MAC). A router with only two members normally ends up in Active or Standby.
How is the HSRP active router elected?
The router with the highest HSRP priority in the group becomes Active. The default priority is 100. If priorities tie, the router with the highest IP address on the HSRP interface wins. By default preempt is disabled, so a router that comes online later with a higher priority does not take over until you configure standby preempt.
What is the difference between HSRP, VRRP and GLBP?
HSRP is Cisco-proprietary with one Active forwarder per group. VRRP (RFC 5798) is an open standard with one Master per group and is the choice in multi-vendor networks. GLBP is Cisco-proprietary and load-balances by letting several routers answer ARP requests with different virtual MAC addresses, so more than one router forwards for the same virtual IP. All three solve the same problem: a redundant default gateway.
What are the HSRP timers?
The default hello timer is 3 seconds and the default hold timer is 10 seconds. Hellos are sent to the group multicast address, and if the Standby router hears nothing from the Active router for the hold time, it takes over. You can tune the timers with standby timers, including millisecond values, but lower values raise CPU load and the risk of false failovers.
What is the HSRP virtual MAC address?
For HSRP version 1 the virtual MAC is 0000.0C07.ACxx, where xx is the group number in hexadecimal. For HSRP version 2 it is 0000.0C9F.Fxxx, which supports group numbers 0 to 4095. Hosts ARP for the virtual IP and receive this virtual MAC, so the gateway MAC never changes when the Active router changes.
Does HSRP load balance?
Not within a single group: only the Active router forwards. You can share load by creating two HSRP groups on the same VLAN, making Router A Active for group 1 and Router B Active for group 2, then pointing half of the hosts at each virtual IP. GLBP does per-host load balancing within one group, which is why it is sometimes preferred when load sharing matters.
How we wrote and checked this
CertSharp is a practice-exam provider, and we sell the CCNA practice questions linked in this guide. We wrote this article from RFC 2281, RFC 5798 and Cisco's HSRP configuration guide, all linked in Sources. The command syntax and defaults were checked against that documentation; the show standby outputs are illustrative, not captured from production equipment. Last reviewed October 2026. Defaults can vary by platform and release, so confirm on your device.
Sources and further reading
- RFC 2281: Cisco Hot Standby Router Protocol (HSRP)
- RFC 5798: Virtual Router Redundancy Protocol (VRRP) Version 3
- Cisco: First Hop Redundancy Protocols Configuration Guide, Configuring HSRP
- Cisco Learning Network: CCNA 200-301 exam topics
Defaults and message formats can differ slightly by platform and software release; confirm on the device with the commands above before changing production gear.
Practice HSRP and the rest of the CCNA
30 free questions per session in practice mode, no signup and no credit card. The full 500-question CCNA bank with exam mode is $11.99 lifetime, or $9.99/month Pro unlocks every CertSharp certification.