show standby<\/code> output here was captured on Cisco IOS 15.2 in June 2026 on a two-router HSRP version 2 lab.<\/p>\n\n\n\nOne default gateway is a single point of failure<\/h2>\n\n\n\n
A host learns exactly one default gateway, either statically or from DHCP. To reach anything off its own subnet it ARPs for that gateway, caches the MAC, and forwards every off-net frame to it. The design is simple and it works, right up until that gateway disappears. If you want a refresher on how a router picks the next hop<\/a>, that mechanism is what the gateway performs on the host’s behalf.<\/p>\n\n\n\nWhen the gateway router fails, the host keeps sending frames to a MAC address that no longer answers. It has no second gateway to try and no way to discover one. The host is stranded even when a perfectly good backup router sits on the same subnet. Editing the gateway on every host, or waiting for the dead router to come back, is not redundancy. It is an outage with a manual fix.<\/p>\n\n\n\n
That is the gap a first hop redundancy protocol closes. Two routers share responsibility for the gateway address so the host never has to care which physical box is forwarding its traffic.<\/p>\n\n\n\n
How a first hop redundancy protocol fixes it<\/h2>\n\n\n\n
The fix is a virtual gateway. Instead of pointing hosts at a router’s real interface address, you give the group a virtual IP and a virtual MAC that the routers share. Hosts use the virtual IP as their default gateway and never learn the real addresses of the routers behind it.<\/p>\n\n\n\n
At any moment one router owns the virtual addresses and forwards traffic for them. The others wait and watch for it to fail. Because the gateway the hosts know is virtual, ownership can move between routers without a single host updating its configuration or even its ARP cache. The diagram below shows the shape: two routers on the same subnet as the hosts, sharing the virtual gateway 192.168.10.254.<\/p>\n\n\n\n![\"HSRP](\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2026\/06\/hsrp-virtual-gateway-topology.png\" "\\"\\"")
<\/figure>\n\n\n\nR1 and R2 keep their real addresses (192.168.10.1 and .2), but the hosts never use them. Every frame leaving the subnet is sent to 192.168.10.254, and whichever router currently owns that address forwards it.<\/p>\n\n\n\n
Active, standby, priority, and preemption<\/h2>\n\n\n\n
The routers in a group hold an election to decide who forwards. The winner becomes the active router and answers ARP for the virtual IP with the virtual MAC. The loser becomes the standby, ready to take over. Priority decides the election: the highest priority wins, and a higher real IP breaks a tie. The default priority is 100, so you raise one router’s priority to make it the predictable active. On R1 we set priority 110 and turned on preemption, then read the state with show standby<\/code>.<\/p>\n\n\n\n![\"Cisco](\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2026\/06\/wm-cisco-hsrp-show-standby-active-router.png\" "\\"\\"")
<\/figure>\n\n\n\nThe important lines are easy to pick out. R1 is Active, the virtual IP is 192.168.10.254, and the active virtual MAC is 0000.0c9f.f001 (the HSRP version 2 format). Hellos go out every 3 seconds and a neighbor is declared dead after the 10 second hold time. The standby is 192.168.10.2 at priority 100. The condensed show standby brief<\/code> view from R2 confirms both routers agree on who is active:<\/p>\n\n\n\nR2# show standby brief\n P indicates configured to preempt.\n |\nInterface Grp Pri P State Active Standby Virtual IP\nGi0\/0 1 100 P Standby 192.168.10.1 local 192.168.10.254<\/code><\/pre>\n\n\n\nPreemption is the other half of predictable behavior. Without it, a router that recovers after a failure stays standby even when it holds the higher priority. With preemption configured, the higher-priority router reclaims the active role the moment it returns. The P<\/code> flag in the brief output is preemption being enabled on the group.<\/p>\n\n\n\nWhat a failover actually looks like<\/h2>\n\n\n\n
The payoff shows up when the active router dies. Shut R1’s interface and R2 promotes itself to active for the same virtual IP and virtual MAC:<\/p>\n\n\n\n
R2# show standby brief\nInterface Grp Pri P State Active Standby Virtual IP\nGi0\/0 1 100 P Active local unknown 192.168.10.254<\/code><\/pre>\n\n\n\nThe hosts notice nothing. Their gateway is still 192.168.10.254 and the MAC behind it has not changed, so their ARP caches stay valid and frames keep flowing, now through R2. When R1 comes back, preemption hands the active role back to it:<\/p>\n\n\n\n
R1# show standby brief\nInterface Grp Pri P State Active Standby Virtual IP\nGi0\/0 1 110 P Active local 192.168.10.2 192.168.10.254<\/code><\/pre>\n\n\n\nThe virtual MAC staying put across the failover is the whole point. Because the MAC never changes, hosts never need to re-ARP, and the handover is invisible from the host side. Detection is not instant though: with the default 3 second hello and 10 second hold time, the standby waits out the hold timer before promoting itself, so a hard failure costs up to ten seconds. You can tune those timers down, or to sub-second with millisecond hellos, when faster convergence is worth the extra control-plane traffic.<\/p>\n\n\n\n
In production you usually pair HSRP with interface tracking. A router watches its uplink toward the core and lowers its own priority when that link fails, so the standby (whose path is still good) preempts and takes over. Without tracking, a router can stay active while its own route off the network is down, which turns the active role into a black hole: hosts hand their traffic to a gateway that has nowhere to send it.<\/p>\n\n\n\n
If the active role never forms in the first place, start at the interface the virtual IP lives on with the checks in the interface troubleshooting guide<\/a>. For the command-by-command setup that produces this behavior, the HSRP configuration lab<\/a> walks through every line on both routers.<\/p>\n\n\n\nPractice first hop redundancy<\/h2>\n\n\n\n
Flip the cards to lock in the terms (the virtual IP and MAC, priority, preemption, and the three protocols’ role names), then take the quiz to check yourself.<\/p>\n\n\n
Loading flashcards...<\/div><\/div>\n\nLoading quiz...<\/div><\/div>\n\n\nHSRP vs VRRP vs GLBP<\/h2>\n\n\n\n
HSRP is one of three first hop redundancy protocols you will meet. They solve the same problem in similar ways, with differences worth knowing before you commit to one. HSRP and VRRP each elect a single active forwarder while the rest stand by. You can still balance load with plain HSRP by running two groups on one subnet, making R1 active for group 1 and R2 active for group 2, then sending half your hosts to each virtual IP, but that split is manual. GLBP automates exactly that: it elects one active virtual gateway that answers every ARP request, yet it replies with a different router’s virtual MAC each time, so hosts on the same subnet spread across the routers without you assigning them.<\/p>\n\n\n\n