VRRP and HSRP: High-Availability Gateways
VRRP (RFC 5798, an open standard) and HSRP (Cisco proprietary) are gateway redundancy protocols (FHRPs — First Hop Redundancy Protocols). Two routers share a virtual IP that clients use as their gateway. Failover occurs in <1s if the active router fails. This comprehensive guide covers HSRP vs. VRRP, modern anycast gateways, and configuration. 2026.
Why Use an FHRP?
Without an FHRP, clients are configured with a single gateway. If that gateway fails, they cannot reach destinations outside the subnet. An FHRP solves this issue by providing a virtual IP that can move between two routers.
HSRP (Cisco)
- HSRP v1: up to 255 groups, IPv4 only
- HSRP v2: 4095 groups, IPv4+IPv6
- Default timers: hello 3s, dead 10s
- Optimized timers: hello 250ms, dead 750ms (sub-second)
- Preempt: automatically reclaims the active role after a reboot
- Priority: 1-255 (default 100)
VRRP (IETF Standard)
- VRRP v2: IPv4
- VRRP v3: IPv4 + IPv6
- VRID: 1-255
- Timers: 1s advertisement interval by default, adjustable
- Priority: 1-255 (backup) or 255 (owner)
- Multi-vendor: Cisco, Juniper, Arista, HPE, FortiGate
HSRP vs. VRRP
- HSRP: Cisco-only, with more features (MHSRP and GLBP as its successor)
- VRRP: multi-vendor, IETF standard
- Both offer similar behavior and timers
- Recommendation: use VRRP in multi-vendor environments and HSRP in 100% Cisco environments
Cisco HSRP Configuration
- interface Vlan 10
- ip address 192.168.10.2 255.255.255.0
- standby version 2
- standby 10 ip 192.168.10.1
- standby 10 priority 110
- standby 10 preempt
- standby 10 authentication md5 key-string MyHSRPKey
- standby 10 timers msec 250 msec 750
Junos VRRP Configuration
- set interfaces ge-0/0/0 unit 0 family inet address 192.168.10.2/24 vrrp-group 10 virtual-address 192.168.10.1
- set interfaces ge-0/0/0 unit 0 family inet address 192.168.10.2/24 vrrp-group 10 priority 110
- set interfaces ge-0/0/0 unit 0 family inet address 192.168.10.2/24 vrrp-group 10 preempt
- set interfaces ge-0/0/0 unit 0 family inet address 192.168.10.2/24 vrrp-group 10 authentication-type md5
GLBP (Cisco): Load Balancing
- Gateway Load Balancing Protocol
- Up to 4 active gateways simultaneously (round-robin per client)
- The AVG (Active Virtual Gateway) assigns a different virtual MAC address to each client
- Cisco-only; replaces HSRP in new designs
- Drawback: all clients on the same subnet are located at the same site (risk of fragmented traffic)
Object Tracking (Enhanced HSRP)
Triggers HSRP failover based on the status of another link:
- track 1 interface GigabitEthernet0/1 line-protocol
- standby 10 track 1 decrement 50: decreases the priority by 50 if Gi0/1 fails
- Example: if the WAN connection on router A fails, its priority decreases and router B takes over
Modern Evolution: Anycast Gateway
In EVPN-VXLAN, HSRP/VRRP are replaced by an anycast gateway:
- Each leaf acts as the gateway for its attached VNIs
- The same IP + MAC is configured on every leaf
- No master/backup negotiation
- Failover in <50 ms (BGP EVPN convergence)
- Scales without a fixed limit (N leaves instead of 2 routers)
Juniper Anycast Gateway Configuration
- set routing-instances VRF-TENANT interface irb.10
- set interfaces irb unit 10 family inet address 192.168.10.1/24 virtual-gateway-address 192.168.10.1
- The same configuration is applied to every leaf
Best Practices
- Configure the priority explicitly instead of relying on the default value of 100
- Enable preempt to restore the preferred active router after a reboot
- Require MD5 authentication
- Use sub-second timers for rapid convergence
- Track uplink interfaces for intelligent failover
- Migrate to an anycast gateway for greenfield EVPN-VXLAN deployments
Order from OPTINOC
Turnkey HSRP/VRRP configuration or migration to an EVPN-VXLAN anycast gateway. Cisco Catalyst, Juniper EX, and FortiGate. Quote within 48 hours.