TechKnowSurge
Cisco CCNA 3.5
VideoNetworkFree

FHRP

First Hop Redundancy Protocols (FHRPs) provide gateway redundancy by assigning a shared virtual IP address across multiple Layer 3 devices, ensuring uninterrupted network connectivity if one device fails. Key FHRP options include HSRP, HSRP version 2, VRRP, and GLBP, with some protocols being Cisco-proprietary and others based on open standards.

Complete this video to capture a CTF flag worth 1 point.

About this video

First Hop Redundancy Protocols, commonly referred to as FHRPs, address one of the most common vulnerabilities in enterprise network design: the single point of failure at the default gateway. In a standard three-tier network architecture, end devices are configured with a single default gateway IP address pointing to a Layer 3 switch or router at the distribution layer. If that device goes offline, all traffic requiring routing beyond the local subnet fails. FHRPs resolve this by configuring two Layer 3 devices to share a single virtual IP address, which serves as the default gateway for downstream hosts. Each physical device retains its own unique IP address, while the virtual IP is the only address end devices need to know about. The failover mechanism operates across both Layer 2 and Layer 3. The active device responds to ARP requests for the virtual IP, advertising its MAC address and establishing entries in the MAC address tables of connected switches. Meanwhile, the standby device maintains a continuous stream of hello packets with the active device to monitor its availability. If the active device fails and hello packets cease, the standby device promotes itself to active, begins responding to ARP requests with its own MAC address, and switch MAC address tables update accordingly. Traffic is then forwarded out the port associated with the new active device, restoring connectivity without requiring any reconfiguration on end hosts. Several FHRP implementations are available, each operating on the same fundamental principles with minor differences in terminology and configuration. Hot Standby Router Protocol, or HSRP, and its updated version HSRP version 2 are Cisco-proprietary solutions. Virtual Router Redundancy Protocol, or VRRP, and Gateway Load Balancing Protocol, or GLBP, represent vendor-neutral, standards-based alternatives. HSRP is the most widely covered option in Cisco-focused networking curricula, but the underlying logic and command structure across all these protocols remain broadly consistent.

What you'll learn

What's covered

First Hop Redundancy Protocol

Aligned to

Cisco CCNA
3.5 Describe the purpose, functions, and concepts of first hop redundancy protocols

Key terms

First Hop Redundancy Protocol
FHRP
A category of protocols that provide default gateway redundancy by allowing multiple routers to share a single virtual IP address. If the active gateway fails, another router in the FHRP group takes over transparently without requiring client reconfiguration; examples include HSRP, VRRP, and GLBP.
Default Gateway
The router that a device uses to send traffic to destinations outside its local network.
Redundancy
The duplication of critical components or systems to increase reliability and availability.
Failover
The automatic switching to a redundant system or component when the primary one fails.
Hot Standby Router Protocol
HSRP
A Cisco proprietary FHRP where a group of routers share a virtual IP address and MAC address, with one active router forwarding traffic while standby routers monitor and take over if the active router fails. HSRP provides transparent default gateway redundancy for end hosts without requiring any client-side configuration.
Virtual Router Redundancy Protocol
VRRP
An open-standard FHRP defined in RFC 5798 that allows multiple routers to share a virtual IP address as a default gateway, with one master router actively forwarding traffic and backup routers ready to take over if the master fails. VRRP is the vendor-neutral alternative to Cisco's proprietary HSRP.
Gateway Load Balancing Protocol
GLBP
A Cisco proprietary FHRP that provides both gateway redundancy and load balancing by allowing multiple routers to actively forward traffic for a single virtual IP address.
Address Resolution Protocol
ARP
A protocol used to map an IP address to a physical MAC address on a local network.

Topics

Networking Fhrp Hsrp Vrrp Glbp Gateway Redundancy Network Failover

Transcript

First hop redundancy protocol, or FHRP, allows us to create some redundancy with our equipment. What it can do is create a virtual IP address that's shared across multiple devices, so that if one device goes down the other device can pick that up. We use it largely to create redundancy for our default gateways.

How FHRP works

This is the three-tier model network here. We have the access layer, which is where devices access the network, and we have layer 2 switches here that are facilitating that. We have the distribution layer, and then we have the core layer. Within the core layer is where we find some layer 3 switches or some routers, and then in the distribution layer it's probably going to be layer 3 switches. So we have these two layer 3 switches here, and this is also where everything is going to point to for the default gateway. Each of these devices will point to this layer for the default gateway.

What we've done up until now is we would have assigned the default gateway something like 10.1.10.1, and that would go on to a switch virtual interface on this layer 3 device right here. But what we're doing with FHRP is we're not assigning the actual IP address to the interface. Instead, we're assigning a different IP address, like two, so 10.1.10.2, and then on this other side we assign a different IP address, 10.1.10.3. Then the default gateway is going to be set up as a virtual IP address. It'd be set up on both these interfaces as a virtual IP address, and we would set it up as 10.1.10.1, and we would do the same thing over here.

Then one of these would become active. It would be hosting this IP address, would be responding to this IP address, where the other one would just be on standby, waiting to take over. There would be constant communication, there would be hello packets going back and forth between these two. What would happen is, if one of them failed to communicate on a regular basis, then the other device would step in and take over for that 10.1.10.1, that virtual IP address. So that's how FHRP works.

The failover process

Let's take a little closer look at what this looks like. We've already said that we would assign a virtual IP to each one of these. One of them is considered active while the other is considered a standby. Just a side note, that this terminology, active and standby, will vary depending on what protocol we use, but we're going to use the terms active and standby for this.

So this layer 3 switch is the active one right here, and it has an IP address — let's say the virtual IP address is 10.1.10.1, and that's the default gateway for all of these devices that are down here. What would happen is that when there's an ARP request out and it says who belongs to this IP address, this device right here responds and says I belong to it, and this is my MAC address here. Same thing for any device that's over here: responds, this is my MAC address. So these switches now see the MAC address that is associated with a certain port, and that port is pointing towards that layer 3 switch. Same thing over here: this port in the MAC address table, if we look at it, there would be a certain MAC address that's pointing to a certain port.

Now, once again, these two are constantly communicating. If this were to go down, it would stop sending those hello packets over to this other standby device. This standby device would recognize that this device is down, and the next time an ARP request is sent out, this device is going to respond to it and say this is my MAC address. Now the association that was before on these switches is now pointing to a new port, a port that's pointing to this other device. So now, with this update, all of the communication is going to be forwarded to this new switch. It does it through this MAC association.

This is where I say it's a layer 3 failover: the IP address, this layer 3 IP address, is being switched to the other one, but it's utilizing a layer 2 functionality of MAC addresses and how MAC addresses are associated with a port. This other device starts responding to it, and now we have failover. This one then becomes the active participant here and is responding to these requests.

FHRP options

There are quite a few FHRP protocols, so you could choose one of many different FHRP protocols to implement on your network. Some of these are ICMP Router Discovery Protocol, or IRDP. One of them is Hot Standby Router Protocol, which is the name of this module, so this is going to be the one that we focus on: HSRP, HSRP2. You see that there is also Virtual Router Redundancy Protocol, or VRRP. There's the Gateway Load Balancing Protocol.

Really, essentially all of these operate very similarly. Some of them are Cisco proprietary, so the ones that have "yes" here are Cisco proprietary, versus the ones that are "no" are standards that are out there. You can see when they're defined here. Most of this is really not important. Like I said, we're going to focus on HSRP, Hot Standby Router Protocol, and so that's what we focus on. But once again, the commands and everything about these are fairly similar, they're not really drastically different.

There are some little differences between each of these options, obviously, but they're not drastically different.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →