First Hop Redundancy Protocols (FHRPs) provide gateway redundancy by assigning a shared virtual IP address across multiple Layer 3 devices, ensuring uninterrupted network connectivity if one device fails. Key FHRP options include HSRP, HSRP version 2, VRRP, and GLBP, with some protocols being Cisco-proprietary and others based on open standards.
First Hop Redundancy Protocol
First hop redundancy protocol, or FHRP, allows us to create some redundancy with our equipment. What it can do is create a virtual IP address that's shared across multiple devices, so that if one device goes down the other device can pick that up. We use it largely to create redundancy for our default gateways.
This is the three-tier model network here. We have the access layer, which is where devices access the network, and we have layer 2 switches here that are facilitating that. We have the distribution layer, and then we have the core layer. Within the core layer is where we find some layer 3 switches or some routers, and then in the distribution layer it's probably going to be layer 3 switches. So we have these two layer 3 switches here, and this is also where everything is going to point to for the default gateway. Each of these devices will point to this layer for the default gateway.
What we've done up until now is we would have assigned the default gateway something like 10.1.10.1, and that would go on to a switch virtual interface on this layer 3 device right here. But what we're doing with FHRP is we're not assigning the actual IP address to the interface. Instead, we're assigning a different IP address, like two, so 10.1.10.2, and then on this other side we assign a different IP address, 10.1.10.3. Then the default gateway is going to be set up as a virtual IP address. It'd be set up on both these interfaces as a virtual IP address, and we would set it up as 10.1.10.1, and we would do the same thing over here.
Then one of these would become active. It would be hosting this IP address, would be responding to this IP address, where the other one would just be on standby, waiting to take over. There would be constant communication, there would be hello packets going back and forth between these two. What would happen is, if one of them failed to communicate on a regular basis, then the other device would step in and take over for that 10.1.10.1, that virtual IP address. So that's how FHRP works.
Let's take a little closer look at what this looks like. We've already said that we would assign a virtual IP to each one of these. One of them is considered active while the other is considered a standby. Just a side note, that this terminology, active and standby, will vary depending on what protocol we use, but we're going to use the terms active and standby for this.
So this layer 3 switch is the active one right here, and it has an IP address — let's say the virtual IP address is 10.1.10.1, and that's the default gateway for all of these devices that are down here. What would happen is that when there's an ARP request out and it says who belongs to this IP address, this device right here responds and says I belong to it, and this is my MAC address here. Same thing for any device that's over here: responds, this is my MAC address. So these switches now see the MAC address that is associated with a certain port, and that port is pointing towards that layer 3 switch. Same thing over here: this port in the MAC address table, if we look at it, there would be a certain MAC address that's pointing to a certain port.
Now, once again, these two are constantly communicating. If this were to go down, it would stop sending those hello packets over to this other standby device. This standby device would recognize that this device is down, and the next time an ARP request is sent out, this device is going to respond to it and say this is my MAC address. Now the association that was before on these switches is now pointing to a new port, a port that's pointing to this other device. So now, with this update, all of the communication is going to be forwarded to this new switch. It does it through this MAC association.
This is where I say it's a layer 3 failover: the IP address, this layer 3 IP address, is being switched to the other one, but it's utilizing a layer 2 functionality of MAC addresses and how MAC addresses are associated with a port. This other device starts responding to it, and now we have failover. This one then becomes the active participant here and is responding to these requests.
There are quite a few FHRP protocols, so you could choose one of many different FHRP protocols to implement on your network. Some of these are ICMP Router Discovery Protocol, or IRDP. One of them is Hot Standby Router Protocol, which is the name of this module, so this is going to be the one that we focus on: HSRP, HSRP2. You see that there is also Virtual Router Redundancy Protocol, or VRRP. There's the Gateway Load Balancing Protocol.
Really, essentially all of these operate very similarly. Some of them are Cisco proprietary, so the ones that have "yes" here are Cisco proprietary, versus the ones that are "no" are standards that are out there. You can see when they're defined here. Most of this is really not important. Like I said, we're going to focus on HSRP, Hot Standby Router Protocol, and so that's what we focus on. But once again, the commands and everything about these are fairly similar, they're not really drastically different.
There are some little differences between each of these options, obviously, but they're not drastically different.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →