Layer 3 redundancy: HSRP, VRRP and GLBP

The gateway problem

Every host is configured with one default gateway address. If the router behind that address fails, hosts can't leave their subnet, even if a second router is sitting right next to it. First hop redundancy protocols (FHRPs) fix this by letting several routers answer for one virtual IP address and virtual MAC address.

HSRP: Hot Standby Router Protocol (Cisco)

• Roles: one active router forwards traffic; one standby router is ready to take over; others listen.
• Election: highest priority (0 to 255, default 100) wins; a tie goes to the highest interface IP address.
• Preemption is off by default: turn it on so a recovered, higher-priority router takes back the active role.
• States: init, learn, listen, speak, standby and active. Hellos are sent in speak, standby and active.

VRRP: Virtual Router Redundancy Protocol (open standard)

• An IETF standard (current version VRRPv3), so it works between different vendors.
• Roles: one master forwards traffic; backup routers wait.
• Election: highest priority (1 to 254, default 100) wins; a tie goes to the highest IP. A router that actually owns the virtual IP address gets priority 255 and always becomes master.
• Preemption is on by default.

GLBP: Gateway Load Balancing Protocol (Cisco)

HSRP and VRRP leave the backup routers idle. GLBP uses them too: one virtual IP, but several virtual MAC addresses.

• The active virtual gateway (AVG) answers ARP requests for the virtual IP, handing out a different virtual MAC to different hosts. A standby AVG waits to replace it.
• Each active virtual forwarder (AVF) forwards traffic sent to its virtual MAC, so the load is shared (up to four forwarders).
• Load-balancing methods: round-robin (default), weighted and host-dependent.

Comparison and configuration

! R1 (R2 is the same with its own IP, priority 100)
interface gigabitEthernet 0/1
 ip address 192.168.1.2 255.255.255.0
 standby 10 ip 192.168.1.1
 standby 10 priority 120
 standby 10 preempt
! VRRP equivalent:   vrrp 10 ip 192.168.1.1 / vrrp 10 priority 120
! GLBP equivalent:   glbp 10 ip 192.168.1.1 / glbp 10 load-balancing weighted

Real-world example: upgrading a hospital core without an outage

A hospital's ward networks use a pair of core switches as their default gateway. The two switches run HSRP for each VLAN, sharing a virtual IP address that every PC, workstation on wheels and printer uses as its gateway. Core switch A is active for half of the VLANs and switch B for the other half, so both carry traffic during normal operation.

When the network team needed to upgrade switch A's software, they lowered its HSRP priority during a quiet period so switch B became active for every VLAN, then rebooted switch A. Devices kept the same gateway address and noticed nothing beyond a sub-second pause. After the upgrade, preemption returned the original roles, and the team repeated the process for switch B the following night.