VRRP and HSRP: High-Availability Gateways

April 15, 2026·3 min read·554 words

VRRP (RFC 5798, an open standard) and HSRP (Cisco proprietary) are gateway redundancy protocols (FHRPs — First Hop Redundancy Protocols). Two routers share a virtual IP that clients use as their gateway. Failover occurs in <1s if the active router fails. This comprehensive guide covers HSRP vs. VRRP, modern anycast gateways, and configuration. 2026.

Why Use an FHRP?

Without an FHRP, clients are configured with a single gateway. If that gateway fails, they cannot reach destinations outside the subnet. An FHRP solves this issue by providing a virtual IP that can move between two routers.

HSRP (Cisco)

HSRP v1: up to 255 groups, IPv4 only
HSRP v2: 4095 groups, IPv4+IPv6
Default timers: hello 3s, dead 10s
Optimized timers: hello 250ms, dead 750ms (sub-second)
Preempt: automatically reclaims the active role after a reboot
Priority: 1-255 (default 100)

VRRP (IETF Standard)

VRRP v2: IPv4
VRRP v3: IPv4 + IPv6
VRID: 1-255
Timers: 1s advertisement interval by default, adjustable
Priority: 1-255 (backup) or 255 (owner)
Multi-vendor: Cisco, Juniper, Arista, HPE, FortiGate

HSRP vs. VRRP

HSRP: Cisco-only, with more features (MHSRP and GLBP as its successor)
VRRP: multi-vendor, IETF standard
Both offer similar behavior and timers
Recommendation: use VRRP in multi-vendor environments and HSRP in 100% Cisco environments

Cisco HSRP Configuration

interface Vlan 10
ip address 192.168.10.2 255.255.255.0
standby version 2
standby 10 ip 192.168.10.1
standby 10 priority 110
standby 10 preempt
standby 10 authentication md5 key-string MyHSRPKey
standby 10 timers msec 250 msec 750

Junos VRRP Configuration

set interfaces ge-0/0/0 unit 0 family inet address 192.168.10.2/24 vrrp-group 10 virtual-address 192.168.10.1
set interfaces ge-0/0/0 unit 0 family inet address 192.168.10.2/24 vrrp-group 10 priority 110
set interfaces ge-0/0/0 unit 0 family inet address 192.168.10.2/24 vrrp-group 10 preempt
set interfaces ge-0/0/0 unit 0 family inet address 192.168.10.2/24 vrrp-group 10 authentication-type md5

GLBP (Cisco): Load Balancing

Gateway Load Balancing Protocol
Up to 4 active gateways simultaneously (round-robin per client)
The AVG (Active Virtual Gateway) assigns a different virtual MAC address to each client
Cisco-only; replaces HSRP in new designs
Drawback: all clients on the same subnet are located at the same site (risk of fragmented traffic)

Object Tracking (Enhanced HSRP)

Triggers HSRP failover based on the status of another link:

track 1 interface GigabitEthernet0/1 line-protocol
standby 10 track 1 decrement 50: decreases the priority by 50 if Gi0/1 fails
Example: if the WAN connection on router A fails, its priority decreases and router B takes over

Modern Evolution: Anycast Gateway

In EVPN-VXLAN, HSRP/VRRP are replaced by an anycast gateway:

Each leaf acts as the gateway for its attached VNIs
The same IP + MAC is configured on every leaf
No master/backup negotiation
Failover in <50 ms (BGP EVPN convergence)
Scales without a fixed limit (N leaves instead of 2 routers)

Juniper Anycast Gateway Configuration

set routing-instances VRF-TENANT interface irb.10
set interfaces irb unit 10 family inet address 192.168.10.1/24 virtual-gateway-address 192.168.10.1
The same configuration is applied to every leaf

Best Practices

Configure the priority explicitly instead of relying on the default value of 100
Enable preempt to restore the preferred active router after a reboot
Require MD5 authentication
Use sub-second timers for rapid convergence
Track uplink interfaces for intelligent failover
Migrate to an anycast gateway for greenfield EVPN-VXLAN deployments

Order from OPTINOC

Turnkey HSRP/VRRP configuration or migration to an EVPN-VXLAN anycast gateway. Cisco Catalyst, Juniper EX, and FortiGate. Quote within 48 hours.