GLBP

Why it exists

HSRP and VRRP leave the standby forwarding no host traffic for a group. GLBP keeps one gateway address while distributing hosts across several active forwarders. Cisco IOS XE 17.x — Configuring GLBP §Information About GLBP

GLBP is Cisco-proprietary. VRRP and HSRP do not speak it; an EVPN anycast gateway is a different active-active design with one shared MAC.

One VIP, two forwarding MACs

R1 wins AVG and assigns a virtual MAC to each AVF. Hosts ARP for the same gateway IP and receive different virtual MACs, so both routers forward.

How it works

Priority elects the active virtual gateway. The AVG assigns virtual MAC addresses to active virtual forwarders and answers ARP for the virtual IP with one of those MACs according to the load-balancing method. Cisco IOS XE 17.x — Configuring GLBP §GLBP Active Virtual Gateway

Weighting and its lower/upper thresholds — often changed by object tracking — decide whether a member remains eligible as a forwarder. Priority alone does not withdraw an AVF when an uplink dies. Cisco IOS XE 17.x — Configuring GLBP §GLBP Weighting and Tracking

After an AVF fails, another member can forward for the failed virtual MAC while redirect timers steer new ARP replies. Existing clients keep the old MAC until takeover or ARP refresh. Cisco IOS XE 17.x — Configuring GLBP §Information About GLBP

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Configure it

When it breaks

Symptom first, because that is what you have when it happens.

1. Every host uses the same router even though both GLBP members are healthy.

   Narrow it down

   1. Check which router is AVG and list the active virtual forwarders.
   2. Inspect the configured load-balancing method.
   3. Clear or sample several client ARP entries rather than testing with one long-lived host.

   Cause

   GLBP distributes virtual MAC addresses when the AVG answers ARP; it does not spray individual packets. Existing hosts keep the virtual MAC already cached, and a host-dependent policy may deliberately map the same host to the same forwarder.

   Fix

   Verify multiple independent clients after their ARP entries refresh. Choose round-robin, weighted, or host-dependent assignment for the intended persistence and capacity model.

   Cisco IOS XE 17.x — Configuring GLBP §Information About GLBP

2. A router with a failed uplink still receives traffic for its GLBP virtual MAC.

   Narrow it down

   1. Inspect the member’s current and configured weighting.
   2. Confirm the tracked object changed state.
   3. Compare the decrement with the lower threshold.

   Cause

   Priority chooses the AVG, but weighting controls forwarder eligibility. Tracking that changes priority—or a weighting decrement too small to cross the lower threshold—does not withdraw the AVF.

   Fix

   Bind the tracked object to GLBP weighting and choose a decrement that crosses the lower threshold when the path is unusable.

   Cisco IOS XE 17.x — Configuring GLBP §GLBP Weighting and Tracking

3. After an AVF fails, some established clients black-hole while new clients work.

   Narrow it down

   1. Compare failed-forwarder timers with client ARP lifetimes.
   2. Check which member assumed the failed virtual MAC.
   3. Distinguish new ARP replies from traffic using an already-cached MAC.

   Cause

   New ARP requests can be redirected immediately, but existing clients keep sending to the old virtual MAC. Forwarder takeover and the redirect/timeout timers preserve that MAC during migration; a timer or state mismatch exposes only cached clients.

   Fix

   Restore AVF redundancy for the old virtual MAC and align redirect/forwarder timers with the endpoint ARP behavior.

   Cisco IOS XE 17.x — Configuring GLBP §Information About GLBP

4. Hosts ARP for the gateway and receive no reply; no forwarders appear.

   Narrow it down

   1. Confirm group number, virtual IP, and authentication match on all members.
   2. Check whether any member won AVG.
   3. Look for ACL or VLAN issues blocking GLBP hellos.

   Cause

   Members cannot hear each other or disagree on group parameters, so no AVG forms and ARP for the VIP goes unanswered.

   Fix

   Align group, VIP, and authentication; restore hello reachability on the LAN.

   Cisco IOS XE 17.x — Configuring GLBP §GLBP Active Virtual Gateway

5. Forwarder roles flap or clients bounce between virtual MACs under light loss.

   Narrow it down

   1. Compare hello and hold timers across members.
   2. Inspect redirect and timeout timers for the virtual MAC.
   3. Check for intermittent LAN loss affecting hellos.

   Cause

   Aggressive or mismatched timers cause AVF or AVG transitions that move virtual MACs faster than hosts can follow.

   Fix

   Align timers across the group and size redirect/timeout to client ARP behaviour.

   Cisco IOS XE 17.x — Configuring GLBP §Information About GLBP

Design notes

Bind tracking to weighting with a decrement that crosses the lower threshold. Tracking that only changes AVG priority leaves a dead-path forwarder in place.

Test with several independent clients after ARP refresh. One sticky host is not a load-balancing proof.

Host-dependent assignment deliberately sticks a host to one AVF. That is persistence, not a bug — unless you expected round-robin.

Misconceptions

“GLBP load balances every flow or packet.”

The AVG load balances ARP replies. Each host then sends to the virtual MAC it cached, so distribution is per resolved client until that entry changes—not a per-packet forwarding decision.

“The active virtual gateway is the router forwarding all traffic.”

The AVG owns election and virtual-MAC assignment. Traffic is forwarded by one or more AVFs, and the AVG is usually one AVF among them.

“GLBP is the same active-active design as an EVPN anycast gateway.”

GLBP has an elected AVG that returns different virtual MACs to clients. An EVPN anycast gateway configures the same gateway IP and MAC on every participating PE, so the locally attached PE routes without an ARP load-balancer election.

More walkthroughs

Terms

Active Virtual Gateway

The elected GLBP member that owns the virtual IP and assigns virtual MAC addresses. It answers ARP requests; the active virtual forwarders carry the resulting traffic.

Active Virtual Forwarder

A GLBP member responsible for one virtual MAC address. Several AVFs may forward simultaneously even though one member alone is the active virtual gateway.

Check yourself

• What does the GLBP AVG vary to distribute clients?

  • The virtual IP address
  • The virtual MAC address returned in ARP replies
  • The VLAN identifier
  • The IP TTL
• Which value controls whether a GLBP member remains eligible as a forwarder?

  • AVG priority
  • Weighting and its thresholds
  • The group number
  • ARP timeout
• Why can one test host make a healthy GLBP pair look unbalanced?

  • GLBP works only for IPv6
  • The host keeps the virtual MAC in its ARP cache
  • Only the AVG may forward
  • GLBP needs two virtual IP addresses
• What must happen for established clients to survive an AVF failure?

  • The virtual IP must change
  • A healthy member must take responsibility for the failed virtual MAC
  • Every client must renew DHCP
  • The AVG priority must become zero
• What is the AVG responsible for that an ordinary AVF is not?

  • Forwarding all host traffic
  • Electing itself forever without hellos
  • Assigning virtual MACs and answering ARP for the virtual IP
  • Disabling spanning tree
• How does GLBP differ from an EVPN anycast gateway?

  • They are identical on the wire
  • GLBP returns different virtual MACs via an AVG; anycast uses the same gateway IP and MAC on each PE
  • Only EVPN uses ARP
  • Only GLBP works with IPv4
• In a single HSRP group, how much traffic does the Standby forward compared with a GLBP AVF?

  • The same — both share load in one group
  • Standby forwards nothing; a GLBP AVF forwards for its virtual MAC
  • Standby forwards broadcasts only
  • Standby forwards half by default
• After an AVF fails, why might new clients work while old ones do not?

  • New clients use a different virtual IP
  • New ARP replies can avoid the failed forwarder; cached clients still use the old virtual MAC
  • Old clients disable ARP
  • AVG priority resets only for new clients

Related

• HSRP

  Cisco’s first-hop group: one Active, one Standby, virtual MAC 0000.0c07.acXX, and a Hello on UDP/1985 so the Standby knows when to take over.

• VRRP

  Several routers share a virtual IPv4 or IPv6 address; the highest priority owns it and advertises so backups can take over when silence means the master is gone.

• ARP

  Finds the MAC address behind an IPv4 address on the local segment, by asking everyone and trusting whoever answers.

• GLBP versus an EVPN anycast gateway

  Both use several first-hop routers, but GLBP assigns clients to virtual forwarders through ARP while EVPN makes every attached PE the same local gateway.