Protocol Atlas

L3 · fhrp · reviewed

HSRP

Hot Standby Router Protocol

Cisco’s first-hop group: one Active, one Standby, virtual MAC 0000.0c07.acXX, and a Hello on UDP/1985 so the Standby knows when to take over.

Presenter modeEmbed this figure

Packet formatsRFC 2281 · INFORMATIONAL · March 1998StatesRFC 2281 · INFORMATIONAL · March 1998GeneralRFC 2281 · INFORMATIONAL · March 1998

Why it exists

Hosts need a default gateway that survives a router failure. HSRP gives a LAN one virtual IP and one well-known virtual MAC that an Active router owns and a Standby is ready to take. IntroductionRFC 2281 · INFORMATIONAL · March 1998

HSRP is Cisco’s protocol. VRRP (RFC 5798) solves the same problem with different multicast addresses, virtual MAC range, and defaults — notably preempt on by default. They do not interoperate. PriorityRFC 5798 · PROPOSED STANDARD · March 2010

Active and Standby for one virtual gateway

Two routers join group 1 for 192.0.2.1. Highest priority becomes Active; the next becomes Standby. The Standby forwards nothing until Holdtime expires.

Host · gw 192.0.2.1Gateway: 192.0.2.1R1 · pri 120Group: 1R2 · pri 100Group: 1Upstream
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
Host · gw 192.0.2.1hostGateway: 192.0.2.1
R1 · pri 120routerGroup: 1
R2 · pri 100routerGroup: 1
Upstreamcloud—
Host · gw 192.0.2.1 — R1 · pri 120linkup
Host · gw 192.0.2.1 — R2 · pri 100linkup
R1 · pri 120 — Upstreamlinkup
R2 · pri 100 — Upstreamlinkup
1 / 4

Both routers join HSRP group 1 with virtual address 192.0.2.1. Hellos go to 224.0.0.2 UDP/1985. The host’s gateway is the virtual address.

What changed

  • R1 · pri 120: Group → 1
  • R2 · pri 100: Group → 1
  • Host · gw 192.0.2.1: Gateway → 192.0.2.1
  • Emphasis on Host · gw 192.0.2.1

How it works

HSRP runs over UDP port 1985 to 224.0.0.2 with TTL 1. Messages carry version, opcode (Hello, Coup, Resign), state, Hellotime, Holdtime, priority, group, clear-text authentication, and the virtual IP. Packet formatsRFC 2281 · INFORMATIONAL · March 1998

Highest priority becomes Active; next becomes Standby. Equal priority breaks ties on higher IP address. Default Hellotime 3 s and Holdtime 10 s; the Standby takes over when the Active’s Holdtime expires without a Hello. Packet formatsRFC 2281 · INFORMATIONAL · March 1998

On Ethernet the virtual MAC is 00-00-0C-07-AC-XX where XX is the group. Only the Active accepts that MAC and sources Hellos from it so bridges learn the failover. GeneralRFC 2281 · INFORMATIONAL · March 1998

Preempt is off by default on Cisco platforms. Enable it with a delay so a returning primary does not take traffic before its routing protocols converge. Coup is the message that claims Active. Packet formatsRFC 2281 · INFORMATIONAL · March 1998

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Version 0 Hello from Active: Hellotime 3, Holdtime 10, priority 120, group 1, default authentication "cisco", virtual IP 192.0.2.1.

UDP
Destination port 1985, multicast 224.0.0.2, TTL 1. Routers source from their real interface address, not the virtual IP, so peers can tell each other apart. RFC 2281
HSRP message
Version through Virtual IP Address as defined for HSRP version 0. RFC 2281

Configure it

Active for group 1 at priority 120 with preempt delay and uplink tracking.

Cisco IOS-XE 17.12 · Catalyst 9300, ISR 4451draft

  1. interface Vlan10
 standby 1 ip 192.0.2.1
 standby 1 priority 120
 standby 1 preempt delay minimum 60

    Group 1 owns 192.0.2.1 (HSRPv1 / RFC 2281 layout). Priority 120 prefers this router. Preempt with a 60-second delay so IGP/BGP can converge before Coup takes Active.

    Common mistake: Enabling `standby version 2` on only one peer. HSRPv2 uses a different multicast group and will not interoperate with v1 — both sides go Active.

    RFC 2281 §5.1

  2. interface Vlan10
 standby 1 timers 3 10

    Hellotime 3 s, Holdtime 10 s — the RFC 2281 recommended defaults. Holdtime must stay greater than Hellotime.

    RFC 2281 §5.1

  3. track 1 interface GigabitEthernet0/0/1 line-protocol
interface Vlan10
 standby 1 track 1 decrement 30

    Uplink failure drops priority by 30 so the Standby can win when preempt is enabled on the peer path.

    Common mistake: Tracking without preempt on the higher-priority peer after recovery — the role may not return when the uplink heals.

  4. interface Vlan10
 standby 1 authentication md5 key-string <configured out of band>

    Clear-text authentication in RFC 2281 is weak; modern platforms prefer MD5 (or better) key strings. Mismatched auth produces dual-Active just like a blocked Hello path.

    RFC 2281 §5.1

Verify

show standby brief
Group, priority, state (Active/Standby), and virtual IP.
show standby
Timers, virtual MAC, preempt, and tracked objects.

Caveats

  • Marked draft: syntax has not been checked against Cisco documentation or a device.
  • RFC 2281 documents the version-0/v1 packet shown in this atlas; Cisco HSRPv2 is a separate extension — keep versions matched across peers.
  • No Junos or FRR snippet: those platforms run VRRP for this problem.

When it breaks

Symptom first, because that is what you have when it happens.

  1. Both routers are active, and hosts report a duplicate address.

    Narrow it down

    1. Confirm each router hears the other’s hellos.
    2. Compare the group number, the authentication and the version on both.
    3. Check whether an access list or a VLAN mismatch is blocking the hellos.

    Cause

    The two cannot hear each other, so each concludes it is the only candidate and takes the role. Different group numbers or a version mismatch is a partition in effect even when the link is fine.

    Fix

    Align group, version and authentication, and restore the path. Version 1 and version 2 use different multicast addresses and will not interoperate.

    StatesRFC 2281 · INFORMATIONAL · March 1998

  2. The virtual address answers but traffic through it is dropped after an upstream failure.

    Narrow it down

    1. Check whether the active router kept the role after losing its uplink.
    2. Look for interface or object tracking on the upstream.
    3. Confirm the standby has a working path.

    Cause

    HSRP watches its own group and nothing beyond it. A router with a dead uplink is a healthy active router and keeps attracting traffic it cannot forward.

    Fix

    Track the upstream interface or a route and decrement priority on failure, so the role follows the path rather than the device.

  3. The intended router does not take over after it comes back from a reload.

    Narrow it down

    1. Compare the configured priorities.
    2. Check whether preemption is enabled on the higher-priority router.
    3. Look for a preempt delay that has not expired.

    Cause

    Without preemption the higher-priority router waits rather than taking the role back, which is the default and frequently what is wanted — but not when a specific router is meant to be primary.

    Fix

    Enable preemption with a delay long enough for the router to finish converging its routing protocols. Preempting before the routing table is populated moves traffic onto a router that cannot yet forward it.

  4. After a reload the higher-priority router becomes Active immediately and black-holes traffic for tens of seconds.

    Narrow it down

    1. Check whether preempt is enabled without a delay.
    2. Confirm whether the IGP or BGP table was populated when the role moved.
    3. Look at interface uptime versus first Active transition.

    Cause

    Preempt without delay takes Active as soon as the LAN interface is up, which is before routing protocols finish.

    Fix

    Configure a preempt delay that covers worst-case IGP/BGP convergence on that platform.

  5. The Active/Standby pair flaps or the Standby briefly becomes Active under light loss.

    Narrow it down

    1. Compare Hellotime and Holdtime on both routers.
    2. Confirm Holdtime is greater than Hellotime and preferably at least three times Hellotime.
    3. Check for ACL or QoS drops of multicast to 224.0.0.2.

    Cause

    Holdtime expired because Hellos were delayed or the configured Holdtime was too aggressive relative to Hellotime or loss.

    Fix

    Align timers; keep Holdtime ≥ 3× Hellotime; ensure Hellos are not filtered.

    Packet formatsRFC 2281 · INFORMATIONAL · March 1998

Design notes

Track the uplink or a critical object and decrement priority on failure. Without tracking, an Active with a dead upstream is a black hole that looks healthy.

One group has one Active forwarder. Load sharing needs multiple groups with Active roles split and hosts pointed at different virtual addresses — or GLBP.

Version 0/1 (RFC 2281 layout, 224.0.0.2) and Cisco HSRPv2 (different multicast and message format) do not interoperate. A version mismatch looks like a partition: both sides go Active.

Do not run HSRP and VRRP for the same gateway problem on one segment. Two elections, two virtual MACs, no shared state.

Misconceptions

“HSRP and VRRP are the same thing with different names.”
They solve the same problem and differ in detail: HSRP is Cisco’s and uses a different virtual MAC range, different multicast addresses and the terms active and standby rather than master and backup. They do not interoperate, and running both on one segment gives two independent first-hop protocols.
“The standby router shares the traffic load.”
It forwards nothing. Sharing load requires several groups with the active role split between them and hosts pointed at different virtual addresses — or GLBP, which was built to do it in one group.
“Preemption should always be on.”
It should usually be on with a delay. A router that preempts the instant its interface comes up takes the role before its routing protocols have converged, and forwards into a routing table that is still empty.

More walkthroughs

Healthy Active, dead pathfailure

The Active loses its uplink and keeps sending Hellos. Hosts still send to the virtual MAC until interface tracking decrements priority.

Preempt only after routing convergesdesign-choice

Without preempt, a recovered higher-priority router stays Standby. With preempt and no delay, it takes Active before its routing table is ready.

R1 · pri 150Higher priority, still StandbyState: Standby (no preempt)R2 · pri 100State: ActiveIGP domain
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
R1 · pri 150routerState: Standby (no preempt)
R2 · pri 100routerState: Active
IGP domaincloud—
R1 · pri 150 — R2 · pri 100linkup
R1 · pri 150 — IGP domainlinkup
R2 · pri 100 — IGP domainlinkup
1 / 4

R1 reloads. R2 becomes Active. R1 returns with priority 150 but preempt is off — the Cisco default — so R1 stays Standby until R2 fails.

RFC 2281 describes Coup when a router wishes to become Active; Cisco’s default is not to preempt unless configured.

What changed

  • R2 · pri 100: State → Active
  • R1 · pri 150: State → Standby (no preempt)
  • Higher priority, still Standby

Terms

VRRP priority
Master election value. 255 is reserved for the address owner. Preempt is on by default in RFC 5798; Cisco HSRP preempts only when configured.

Check yourself

  • Both routers are active and hosts see a duplicate address. What is the cause?
  • The active router loses its uplink. What does HSRP do by default?
  • Why should preemption usually have a delay?
  • How much traffic does the standby router forward?
  • How does HSRP differ from VRRP in defaults that matter operationally?
  • What is the Ethernet virtual MAC for HSRP group 1?
  • How should Holdtime relate to Hellotime?
  • What is a Coup message for?