Why do we need HSRP/VRRP if I can just give hosts two gateways?

Question

In the lab I built two routers on a subnet and pointed my PCs at R1 as the default gateway. When I shut R1's interface the whole VLAN loses connectivity even though R2 is right there with a route to everything.

I know hosts usually only take ONE default gateway, so I get why R2 doesn't magically take over. But how does FHRP actually fix this? People keep saying "virtual IP and virtual MAC" and I don't really get what those are or why the hosts don't notice the failover. What problem are HSRP/VRRP actually solving here?

ben31833 · Accepted Answer

You nailed the core problem: a host has exactly one default gateway, so if that router dies, the host is stuck even when a perfectly good backup sits on the same subnet. FHRP (HSRP, VRRP, GLBP) fixes this by hiding the two routers behind ONE virtual IP and ONE virtual MAC that the group owns, not any physical router.

How it works:

The routers elect an active/master. Hosts set their default gateway to the virtual IP, never R1's or R2's real IP.
When a host ARPs for the gateway, the active router replies with the virtual MAC, so the host's ARP cache maps gateway-IP to virtual-MAC.
If the active fails, the standby takes over the same virtual IP and virtual MAC and starts answering for it. The host's ARP entry is still valid, so it keeps forwarding, no gateway change and no re-ARP needed. That's the whole trick.

Virtual MAC formats worth memorizing:

HSRP v1:  0000.0c07.ac<group-hex>
VRRP:     0000.5e00.01<group-hex>

Key differences: HSRP is Cisco-proprietary (Active/Standby, hellos to 224.0.0.2, default priority 100, preempt OFF by default). VRRP is the open standard RFC 5798 (Master/Backup, 224.0.0.18, preempt ON by default, and the virtual IP can be the real IP of the address owner). Higher priority wins in both; tie goes to highest IP.

In the lab: give both routers an SVI on the VLAN, configure the same group + virtual IP, point the PCs at that virtual IP, then shut the active's uplink and watch pings keep flowing after the standby preempts.

Shira Sivroni · Answer

Adding the practical/troubleshooting angle since this bites people: FHRP only protects the **first hop**. It does NOT track whether the active router's *upstream* path is still alive.

Classic lab trap: you shut the active router's LAN interface and failover works great. But shut its *WAN/uplink* interface instead and the active happily keeps the virtual IP while blackholing traffic, because from the group's view it's still up. The fix is **interface/object tracking**: decrement the priority when the tracked uplink goes down so the standby preempts and takes over.

Quick verify checklist in the lab:

- `show standby brief` (HSRP) or `show vrrp brief` to confirm one Active/Master, one Standby/Backup, and the virtual IP.
- From a PC, check the ARP entry for the gateway resolves to the virtual MAC (`0000.0c07.acXX` or `0000.5e00.01XX`), not a physical one.
- Ping the virtual IP continuously, shut the active's interface, and count how many echoes drop, usually just 1 or 2 during the hold-time.

If failover "works" but traffic still dies, it's almost always a missing tracking statement or preempt being off.

Why do we need HSRP/VRRP if I can just give hosts two gateways?

2 Answers

Your answer