Offset ZeroCCNA 200-301 study captureGet the app
Menu
Get the app

Study hubs

Practice testMock examStudy guideFlashcardsStudy plan

Study areas

L1Network components, cabling and TCP/UDPIPv4IPv4 addressing and subnettingIPv6IPv6 addressingL2Switching, VLANs and trunkingSTPRapid PVST+ and EtherChannelWLANWireless LANsL3Routing table and static routesOSPFSingle-area OSPF and first-hop redundancySVCNAT, DHCP and DNSMGMTDevice management, NTP, SNMP, syslog and QoSSECSecurity concepts, passwords and VPNsACLACLs and Layer 2 securityAPIAutomation, APIs and AI

OSPFConcept · Area 3B OSPF & FHRP

HSRP vs VRRP vs GLBP: three ways to keep the default gateway up

HSRP, VRRP and GLBP solve one problem: a host knows a single default gateway address, so two or more routers share a virtual IP and a virtual MAC, and one of them answers for it. The protocols part ways on four points: who defines the standard, what the roles are called, whether a recovered router takes its role back, and whether more than one router forwards at a time. On the map, first hop redundancy protocols (FHRPs) sit beside OSPF in single-area OSPF and first-hop redundancy: OSPF picks paths between routers, an FHRP guards the one hop between a host and its gateway.

Reviewed October 29, 2026

Frames · 6 sections

HSRP and VRRP, field by field

Defaults as the RFCs define them; IOS follows them unless noted
Point of comparisonHSRPVRRP
Who defines it (differs)Cisco; RFC 2281 documents version 1 (informational)IETF standard; VRRPv3 is RFC 9568, which obsoletes RFC 5798
Router that forwards (differs)ActiveMaster in RFC 5798 and in IOS output; RFC 9568 renames it Active Router
Router waiting to take over (differs)Standby; any others sit in ListenBackup
Default priority (differs)100100; 255 is reserved for the router that owns the virtual address
Preemption (differs)Off until you configure itOn by default
Virtual IP (differs)A spare address in the subnet, not on any router interfaceMay be a real interface address of one router, the address owner
Timers (differs)Hello 3 s, hold 10 sAdvertisement every 1 s; a backup waits three intervals plus a skew
On the wire (IPv4) (differs)UDP 1985 to 224.0.0.2 (version 1)IP protocol 112 to 224.0.0.18
Virtual MAC (IPv4) (differs)0000.0c07.acXX in version 1, XX = group in hex0000.5e00.01XX, XX = virtual router ID in hex
Exam topic IDsv1.1 3.5 · v2.0 3.4v1.1 3.5 · v2.0 3.4

≠ marks rows where the two differ.

Sources: RFC 2281 for HSRP timers, port and MAC; RFC 9568 for VRRP priority, preemption, interval and MAC.

What the virtual router hides from the host

A host has one gateway field, filled by hand or by DHCP. When it sends off-subnet traffic it ARPs for that address and caches the answer. With an FHRP the answer is the group’s virtual MAC, owned by whichever router currently forwards. When that router fails, the standby or backup router claims the same virtual IP and MAC and sends a gratuitous ARP so the switches relearn which port the MAC lives on. The host’s ARP cache never changes, and the host never notices.

GLBP, the one that shares the load

HSRP and VRRP leave one router forwarding per group while the other waits. Cisco’s Gateway Load Balancing Protocol (GLBP) keeps one virtual IP but hands out several virtual MACs. One router, the active virtual gateway (AVG), answers the hosts’ ARP requests and rotates the MAC it gives out; up to four active virtual forwarders (AVFs) each own one of those MACs, so different hosts send through different routers. It is Cisco-only, like HSRP.

What each exam version asks

The v1.1 topic list (3.5) asks you to describe the purpose and concepts of FHRPs without naming a protocol, so all three are fair game. The v2.0 list (3.4) narrows it to reading the operational status of HSRP and VRRP, the only two it names. Reading show standby brief is the skill that carries over.

Past the gateway, traffic bound for the internet usually meets address translation next; that step is mapped in static NAT, dynamic NAT and PAT.

A failover in five moves

0000Host ARPs forthe gateway0010Active routerforwards0020Hellos stop0030Standby goesactive0040Host keepssending
Figure 1.What happens between the active router failing and the host’s next packet. Timer per RFC 2281 defaults.
  • 0000 The reply carries the group’s virtual MAC
  • 0010 It owns the virtual MAC and sends hellos every 3 s
  • 0020 The standby’s hold timer runs out (10 s by default in HSRP)
  • 0030 It claims the virtual IP and MAC and sends a gratuitous ARP
  • 0040 Same gateway IP, same MAC, no new ARP needed

Configuring and reading HSRP

One member of HSRP group 30 on VLAN 30, then show standby brief

R2(config)#interface GigabitEthernet0/1R2(config-if)#ip address 10.30.0.2 255.255.255.0R2(config-if)#standby 30 ip 10.30.0.1R2(config-if)#standby 30 priority 120R2(config-if)#standby 30 preemptR2(config-if)#endR2#show standby brief                     P indicates configured to preempt.                     |Interface   Grp  Pri P State   Active          Standby         Virtual IPGi0/1       30   120 P Active  local           10.30.0.3       10.30.0.1

“local” in the Active column means this router is the active one; the Standby column names its peer. The P flag shows that preempt is set. Hosts on VLAN 30 point at 10.30.0.1, never at 10.30.0.2.

Frames on HSRP vs VRRP vs GLBP

Answer from memory first, then scroll back to the table to check; each option note says which role name, default or standard the wrong choices borrowed.

Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.

Frame 001 of 006 · 0 answered · 0 ok

Keys

1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list

  1. Frame 001 of 006

    What is the purpose of First Hop Redundancy Protocols (FHRPs) in a network?

    Pick an option. The verdict shows here; open the note under any option to see why.

    1. Note on A

      Spreading traffic across several ISP links is a WAN or routing design task, not what an FHRP does.

    2. Note on B

      Correct: an FHRP lets several routers share a virtual IP and MAC, so hosts keep the same default gateway if one router fails.

    3. Note on C

      FHRPs do not encrypt anything; encryption at that level is the job of IPsec or MACsec.

    4. Note on D

      Routing protocols such as OSPF share routes between routers; an FHRP only protects the gateway address that hosts use.

    Best answer: B · why

    Hosts are usually configured with one default gateway address. A First Hop Redundancy Protocol (HSRP, VRRP or GLBP) lets two or more routers present a shared virtual IP address and virtual MAC address. If the active router fails, another takes over the virtual address, and hosts keep forwarding with no change to their configuration. GLBP also load-balances across gateways.

  2. Frame 002 of 006

    What is the operational model used by the Virtual Router Redundancy Protocol (VRRP)?

    Pick an option. The verdict shows here; open the note under any option to see why.

    1. Note on A

      Correct: one VRRP router, the master, forwards for the virtual IP while backups wait, which is active/standby even though VRRP calls the roles master and backup.

    2. Note on B

      Weighted load balancing is one of GLBP’s methods, not how VRRP forwards through a single master.

    3. Note on C

      Round-robin is GLBP’s default load-balancing method; a VRRP group has one master forwarding at a time.

    4. Note on D

      Several routers forwarding at once through one group is GLBP’s model; one VRRP group has a single master.

    Best answer: A · why

    VRRP (RFC 5798, now RFC 9568) is an open-standard FHRP. In each group, one master router forwards traffic sent to the virtual IP, and the backups take over if it fails. HSRP uses the same active/standby model under the names active and standby. VRRP preempts by default, and the master can own the virtual IP as a real interface address. GLBP is the one that load-balances, with round-robin, weighted or host-dependent methods.

  3. Frame 003 of 006

    Which First Hop Redundancy Protocol (FHRP) uses the concept of a virtual MAC address and active/standby routers?

    Pick an option. The verdict shows here; open the note under any option to see why.

    1. Note on A

      Proxy ARP lets a router answer ARP for remote hosts, but it uses no virtual MAC and no active/standby roles.

    2. Note on B

      VRRP also uses a virtual MAC, but its roles are called master and backup rather than active and standby.

    3. Note on C

      Correct: HSRP routers share a virtual IP and virtual MAC (0000.0c07.acXX in version 1), with one active router and one standby.

    4. Note on D

      GLBP gives each forwarder its own virtual MAC so several routers forward at once, with an AVG and AVFs instead of active/standby.

    Best answer: C · why

    HSRP is Cisco’s FHRP. Routers in a group share a virtual IP and a virtual MAC (0000.0c07.acXX for version 1, 0000.0c9f.fXXX for version 2). The active router forwards, and the standby router takes over if the active one fails. Preemption is off by default and the default priority is 100. VRRP uses the terms master and backup, and GLBP uses several virtual MACs so that several routers forward at once.

  4. Frame 004 of 006

    Which First Hop Redundancy Protocol (FHRP) provides load balancing across multiple routers by using multiple virtual MAC addresses?

    Pick an option. The verdict shows here; open the note under any option to see why.

    1. Note on A

      STP prevents Layer 2 loops and is not a first hop redundancy protocol.

    2. Note on B

      Correct: GLBP’s active virtual gateway answers ARP requests with different virtual MACs, so hosts spread across several forwarding routers.

    3. Note on C

      HSRP has one active router per group, so sharing load needs several groups.

    4. Note on D

      VRRP also forwards through one master per group, using a single virtual MAC.

    Best answer: B · why

    GLBP is Cisco’s load-balancing FHRP. One router is the active virtual gateway (AVG). It answers host ARP requests for the virtual IP with the virtual MACs of up to four active virtual forwarders (AVFs), so different hosts send traffic to different routers. HSRP and VRRP use one forwarding router per group and need several groups to share load.

  5. Frame 005 of 006

    R1 (priority 110) and R2 (default priority) share a virtual default gateway address. R1 is the active router, reloads, and R2 takes over. Apart from R1’s priority, both groups use only default settings. When R1 comes back online, what happens under HSRP and under VRRP?

    Pick an option. The verdict shows here; open the note under any option to see why.

    1. Note on A

      This swaps the two defaults. HSRP needs ‘standby preempt’ to take the role back, while VRRP already preempts unless it is turned off.

    2. Note on B

      VRRP does, but HSRP does not. Without the preempt command an HSRP router with a higher priority does not displace the active router.

    3. Note on C

      Correct. HSRP preemption is off by default, so R1 waits as standby. VRRP preempts by default, so R1’s higher priority wins back the role.

    4. Note on D

      HSRP does, but VRRP does not. VRRP’s preempt mode defaults to true, so a higher-priority backup takes the active role back.

    Best answer: C · why

    Both protocols default to priority 100 and elect the highest priority as the forwarding router, but they differ on preemption. HSRP (RFC 2281) does not preempt unless ‘standby preempt’ is configured, so a recovered router with a higher priority stays in standby until the active router fails. VRRP (RFC 9568, which obsoletes RFC 5798) sets preempt mode to true by default, so a higher-priority backup takes over as soon as it is back. Adding preemption to HSRP, ideally with a delay, is the usual fix when R1 should always be active. Sources: RFC 2281, RFC 9568 and Cisco’s HSRP features document.

  6. Frame 006 of 006

    A network must use a first hop redundancy protocol that is an open IETF standard, so that routers from different vendors can share the gateway role. Which statement about the protocol that meets this need is true?

    Pick an option. The verdict shows here; open the note under any option to see why.

    1. Note on A

      HSRP is Cisco’s protocol, not an IETF standard, and its virtual IP must be an address that no member router has on an interface.

    2. Note on B

      GLBP is a Cisco protocol that load-balances through one virtual gateway and several forwarders. It is not an open standard.

    3. Note on C

      VRRP allows either. A spare address works, but it may also reuse one router’s real interface address, which HSRP does not allow.

    4. Note on D

      Correct. VRRP is the IETF-standard option, and the router that owns the virtual address on a real interface, the address owner, has priority 255.

    Best answer: D · why

    Of the three first hop redundancy protocols, only VRRP is an IETF standards-track protocol; the current version is VRRPv3 in RFC 9568, which obsoletes RFC 5798. HSRP (described in the informational RFC 2281) and GLBP were developed by Cisco. A distinctive VRRP feature is the address owner: the virtual IP can be the real address of one router’s interface, and that router uses priority 255 and is always active while it is up. RFC 9568 calls the roles active and backup, older VRRP texts and IOS output say master. HSRP instead requires a dedicated virtual address. Sources: RFC 9568 and RFC 2281.

Where the defaults come from

  1. [1]RFC 2281: Cisco Hot Standby Router Protocol (HSRP)States, Hello and Hold defaults, UDP 1985, the virtual MAC. Checked October 29, 2026.
  2. [2]RFC 9568: Virtual Router Redundancy Protocol (VRRP) Version 3Priority 100 and 255, preemption on, 1-second interval, Active Router naming. Checked October 29, 2026.
  3. [3]Cisco Learning Network: CCNA v1.1 exam topicsTopic 3.5. Checked October 29, 2026.
  4. [4]Cisco Learning Network: CCNA v2.0 exam topicsTopic 3.4; v2.0 tested from 2027-02-03. Checked October 29, 2026.

Related frames