HSRP and VRRP configuration, tracking and troubleshooting on Cisco IOS

Before you start

The concepts of first hop redundancy, with active and standby routers sharing a virtual IP and virtual MAC address, are covered in Layer 3 redundancy: HSRP, VRRP and GLBP. This note is about configuring and fixing them. The examples use VLAN 10 (192.168.10.0/24): R1 is 192.168.10.2, R2 is 192.168.10.3, and hosts use the virtual gateway 192.168.10.1.

HSRP configuration

track 1 interface GigabitEthernet0/0 line-protocol
!
interface Vlan10
 ip address 192.168.10.2 255.255.255.0
 standby version 2
 standby 10 ip 192.168.10.1
 standby 10 priority 110
 standby 10 preempt
 standby 10 track 1 decrement 20
 standby 10 authentication md5 key-string Gw-Key-2026

R2 gets the same commands with its own address and the default priority of 100 (pre-emption is still useful there, so it can take back control after its own reboot if it is meant to). Points to remember:

• Both routers must use the same version, group, virtual IP and authentication.
• Pre-emption is off by default in HSRP. Without it, a higher-priority router that recovers stays standby.
• Tracking lowers the priority when something fails. The decrement must take the active router below the standby's priority (110 - 20 = 90, below 100), otherwise nothing changes.
• For load sharing, use two groups: R1 active for VLAN 10, R2 active for VLAN 20.

VRRP configuration

Current IOS XE uses VRRPv3, enabled globally, with address-family sections. VRRP pre-empts by default and tracking works the same way.

fhrp version vrrp v3
!
interface Vlan10
 ip address 192.168.10.2 255.255.255.0
 vrrp 10 address-family ipv4
  address 192.168.10.1 primary
  priority 110
  track 1 decrement 20

If a router's real interface address is the virtual IP, it is the address owner, takes priority 255 and is always master while it is up.

Troubleshooting checklist

1. show standby brief or show vrrp brief: which router is active or master, priorities, pre-emption and virtual IP.
2. Both routers active (or both master): they cannot hear each other's hellos. Check the VLAN exists and is allowed on the trunk between them, that no ACL blocks the multicast address or port, and that group number and version match. Each router's log will usually show the other as missing.
3. Standby never takes over after an uplink failure: check tracking is configured, the tracked object actually goes down (show track), the decrement is large enough, and pre-emption is enabled on the standby.
4. Authentication or virtual IP mismatch: logs report it; correct the configuration on one side.
5. Hosts lose connectivity during failover: check that hosts point to the virtual IP, not a real router address, and that switches learn the virtual MAC on the new port (the new active router sends gratuitous ARPs).

Real-world example: a split-brain gateway at a school

At a secondary school, both core switches suddenly showed HSRP active for the staff VLAN, and some staff PCs lost access every few minutes. A trunk between the two core switches had been re-patched during summer works, and its allowed VLAN list no longer included the staff VLAN. Each switch stopped hearing the other's hellos, so both became active and both answered for the virtual MAC, and the access switches kept moving the MAC between uplinks. Adding the VLAN back to the trunk restored one active and one standby router, and the school added an alert for HSRP state changes to its monitoring.