Exam Objective 3.4: Interpret the operational status of First Hop Redundancy Protocols (HSRP and VRRP).
Every host on a subnet is configured with a single default gateway, and if that gateway router fails, every host relying on it loses connectivity beyond the local subnet until someone manually reconfigures every affected device — clearly not acceptable in a production network. First Hop Redundancy Protocols solve this by allowing two or more routers to share a single virtual IP address (and virtual MAC address) as a common default gateway, with one router actively forwarding traffic while the other stands by ready to take over instantly if the active router fails. This objective focuses specifically on interpreting operational status — reading show command output and correctly identifying roles, states, and failover behavior — rather than deep configuration.
A host's default gateway is configured as a single static IP address. If that gateway router goes down and nothing else is done, every host on that subnet loses all connectivity to anything beyond its local subnet, since the host has no built-in mechanism to automatically discover and switch to a different router. FHRPs solve this by presenting a shared virtual IP address (and corresponding virtual MAC address) to hosts as their default gateway, with two or more physical routers cooperating behind the scenes to ensure that virtual address is always being actively serviced by exactly one of them at any given time.
The core concept common to every FHRP: Hosts are configured with the virtual IP as their default gateway — never a physical router's own individual interface address — so that failover between physical routers is completely transparent to every host on the subnet; no host reconfiguration is ever needed when a failover occurs.
HSRP is Cisco-proprietary and was Cisco's original FHRP solution, still very widely deployed and heavily tested on the CCNA.
HSRP roles:
Active router — the router currently forwarding traffic sent to the virtual IP/virtual MAC address; only one router holds this role at a time within a given HSRP group
Standby router — the router that has been elected to take over as active if the current active router fails; only one router holds this specific standby role, even if more than two routers participate in the same HSRP group
Listen — any additional routers beyond the active and standby (if three or more routers participate in the same group) remain in the listen state, monitoring Hello messages but not actively participating in forwarding or standing by as the immediate backup
HSRP states (the full progression):
Initial — HSRP has not yet started running on this interface (e.g., the interface itself is down, or HSRP configuration was just applied)
Learn — the router has not yet determined the virtual IP address and is waiting to learn it from Hello messages (relevant mainly in specific configuration scenarios where the virtual IP isn't directly configured)
Listen — the router knows the virtual IP address but is neither the active nor standby router; it continues listening to Hellos from the active and standby routers
Speak — the router actively sends and receives Hello messages and is a candidate participating in the active/standby election
Standby — this router is the elected backup, ready to immediately assume the active role if needed
Active — this router is currently forwarding traffic for the virtual IP/MAC address
HSRP election — priority and tiebreaker:
Default priority: 100, configurable range 0–255
The router with the highest priority becomes active
If priorities are tied, the router with the highest physical interface IP address becomes active
HSRP versions:
HSRPv1 — uses multicast address 224.0.0.2, supports group numbers 0–255, uses a virtual MAC address in the format 0000.0C07.ACxx (where xx is the HSRP group number in hex)
HSRPv2 — uses multicast address 224.0.0.102, supports a much larger group number range (0–4095), uses a virtual MAC address in the format 0000.0C9F.Fxxx, and adds native IPv6 support (HSRPv1 is IPv4-only)
HSRP timers: Default Hello timer is 3 seconds, default Hold timer (equivalent in concept to a dead timer) is 10 seconds — meaning it can take up to roughly 10 seconds by default for a standby router to detect the active router has failed and take over, unless faster/millisecond timers are specifically configured for quicker failover.
Exam Alert: Know that in any given HSRP group, there is always exactly one active and exactly one standby router, regardless of how many total routers participate in that group — any additional routers beyond those two simply sit in the listen state. Also know the default priority (100) and that higher priority wins the active role.
VRRP (RFC 3768 / RFC 5798 for VRRPv3) is the open, vendor-neutral IETF standard equivalent to HSRP, functioning almost identically in concept but with some distinct terminology and a few functional differences.
VRRP roles:
Master router — the VRRP equivalent of HSRP's active router; the router currently forwarding traffic for the virtual IP address
Backup router — the VRRP equivalent of HSRP's standby router; unlike HSRP (which designates exactly one specific standby among potentially many participating routers), every non-master router in a VRRP group is simply referred to as a backup router, and any one of them can take over if the master fails, based on priority
VRRP states:
Initialize — the starting state before VRRP becomes operational on the interface
Backup — the router is monitoring the master's advertisements and ready to take over if needed
Master — the router is currently forwarding traffic for the virtual IP address
VRRP election — priority and tiebreaker:
Default priority: 100, configurable range 1–254 (0 and 255 are reserved for specific special purposes, covered below)
The router with the highest priority becomes master
If priorities are tied, the router with the highest physical interface IP address becomes master
A key distinguishing feature of VRRP — the virtual IP can be a real interface address: Unlike HSRP (where the virtual IP is always a separate, distinct address from any router's own physical interface address), VRRP allows the virtual IP address to be configured as identical to one of the participating router's own actual physical interface IP address. When this is done, that specific router automatically becomes master regardless of priority settings, and is referred to as the IP address owner. This is a distinctive, frequently tested VRRP-specific concept with no direct HSRP equivalent.
VRRP priority value 255: Automatically assigned to (and reserved for) the IP address owner router described above, guaranteeing it will always win the master election.
VRRP priority value 0: Sent by the current master specifically to indicate it is gracefully giving up the master role (such as during a controlled shutdown), triggering backup routers to immediately begin a new master election rather than waiting for the normal timeout period.
VRRP multicast and virtual MAC: Uses multicast address 224.0.0.18, with a virtual MAC address in the format 0000.5E00.01xx (where xx is the VRRP group number in hex).
VRRP timers: Default Advertisement interval is 1 second (VRRP's equivalent of HSRP's Hello timer), with a Master Down interval (equivalent to HSRP's Hold timer) calculated based on that advertisement interval — generally providing faster default failover detection than HSRP's default timers.
Exam Alert: The single most distinctive VRRP-specific fact is the IP address owner concept — a VRRP router whose own physical interface address matches the configured virtual IP address automatically becomes master (with priority 255) regardless of any other configured priority values. This has no equivalent in HSRP, where the virtual IP is always separate from every router's own address.
HSRP:
Cisco-proprietary
Active / Standby / Listen roles
Virtual IP is always separate from any router's physical address
Default priority 100, range 0–255
Multicast 224.0.0.2 (v1) or 224.0.0.102 (v2)
Virtual MAC: 0000.0C07.ACxx (v1) or 0000.0C9F.Fxxx (v2)
Default Hello/Hold timers: 3 sec / 10 sec
VRRP:
Open IETF standard (RFC 3768/5798), vendor-neutral
Master / Backup roles
Virtual IP can match a participating router's own physical address (IP address owner concept), automatically making that router master
Default priority 100, range 1–254 (0 and 255 reserved for special use)
Multicast 224.0.0.18
Virtual MAC: 0000.5E00.01xx
Default Advertisement interval: 1 second
Exam Alert: In a mixed-vendor environment, VRRP is the only one of the two that will work with non-Cisco equipment, exactly parallel to the CDP-versus-LLDP distinction from objective 2.3 — VRRP is the vendor-neutral option, HSRP is Cisco-only.
Preemption is a configurable behavior controlling whether a router with a higher priority is allowed to reclaim the active/master role after that role has already been assumed by a lower-priority router (for example, after the original active/master router failed and has since recovered).
HSRP default behavior: Preemption is disabled by default — meaning that once a standby router takes over as active following a failure, it remains active even after the original (higher-priority) router comes back online, unless preemption has been explicitly enabled.
VRRP default behavior: Preemption is enabled by default — the opposite default from HSRP — meaning a recovering higher-priority router will automatically reclaim the master role as soon as it comes back online, without any additional configuration required.
Enabling HSRP preemption:
interface GigabitEthernet0/1
standby 1 preempt
Configuring VRRP to disable preemption (since it's on by default):
interface GigabitEthernet0/1
vrrp 1 no-preempt
Exam Alert: This default-behavior difference (HSRP preemption off by default, VRRP preemption on by default) is a frequently and directly tested fact, and a common source of confusion — many candidates assume both protocols behave the same way by default, and they don't.
Both HSRP and VRRP support tracking the status of a separate object (most commonly an uplink interface) and automatically adjusting the local router's priority downward if that tracked object goes down — allowing the router to voluntarily give up the active/master role if it detects it has actually lost its own path to the rest of the network, even though its connection to the local subnet itself is still fine.
Why tracking matters: Without tracking, a router could remain the active/master FHRP router for a subnet even after losing its own uplink toward the rest of the network — meaning it would keep attracting traffic from local hosts, only to have nowhere to actually forward that traffic. Tracking allows the router to detect this condition and step aside in favor of the other router, which (presumably) still has a working uplink.
HSRP tracking example:
interface GigabitEthernet0/1
standby 1 ip 192.168.1.1
standby 1 priority 110
standby 1 preempt
standby 1 track GigabitEthernet0/2 decrement 20
If GigabitEthernet0/2 (the tracked uplink) goes down, this router's HSRP priority automatically decreases by 20 (from 110 down to 90), and — assuming the other router's priority is now higher and preemption is enabled — the other router takes over as active.
Exam Alert: Recognize that object tracking is what allows an FHRP deployment to intelligently respond to an uplink failure, not just a failure of the FHRP-participating interface itself — a scenario very commonly described in exam question stems (a router's LAN-facing interface is fine, but its WAN/uplink interface just failed) as a setup for identifying whether tracking would correctly trigger a failover.
HSRP verification:
show standby — displays detailed HSRP status per interface/group, including current state (Active/Standby/Listen), virtual IP, priority, preemption setting, and Hello/Hold timers
show standby brief — a condensed, one-line-per-group summary view, useful for quickly checking multiple HSRP groups across several interfaces at once
VRRP verification:
show vrrp — displays detailed VRRP status per interface/group, including current state (Master/Backup), virtual IP, priority, preemption setting, and advertisement timer
show vrrp brief — a condensed summary view, similar in spirit to show standby brief
Reading operational status — what to look for:
Confirm which router currently holds the active/master role, and whether that matches the intended/expected design (typically the router with the highest configured priority, assuming preemption behavior allows it)
Confirm the virtual IP address matches what's actually configured as the default gateway on end-host devices
Confirm priority values are set as intended on each participating router
Confirm preemption status matches design intent (remembering the differing HSRP/VRRP defaults)
If tracking is configured, confirm the tracked object's current status and whether a priority decrement has actually been applied, explaining why a router might currently show a lower effective priority than its statically configured base value
Exam Alert: Expect to be shown sample show standby or show vrrp output and asked to identify the current active/master router, the current priority (which may be a decremented value due to tracking, not the originally configured base value), or whether the displayed state is consistent with expected behavior given the configuration shown.
Identify which protocol is in use (HSRP or VRRP) based on the command syntax or output format shown.
Identify the current role of each participating router (Active/Standby/Listen for HSRP, or Master/Backup for VRRP) from the relevant show command output.
Confirm the virtual IP address and virtual MAC address align with what end hosts are actually configured to use as their default gateway.
Compare each router's current priority value against the others to determine whether the router holding the active/master role logically should be the one holding it, based on priority.
If a lower-priority router unexpectedly holds the active/master role, consider preemption status (remembering HSRP defaults to off, VRRP defaults to on) as a likely explanation, along with the possibility that the higher-priority router simply has not yet recovered from a prior failure.
If a router's priority appears different from its statically configured value, check for object tracking and whether the tracked object (commonly an uplink interface) is currently down, explaining a decremented effective priority.
Confirm Hello/Advertisement and Hold/Master-Down timers are consistent with expected failover speed requirements for the design.
Q1. In an HSRP group with three participating routers, which roles will actually be assigned among them?
A. All three routers will be active simultaneously
B. One active, one standby, and the remaining router(s) will be in the listen state
C. One active and two standby routers
D. All three routers will be in the listen state
Answer: B. Regardless of how many routers participate in a single HSRP group, there is always exactly one active router and exactly one standby router at any given time. Any additional routers beyond those two specific roles remain in the listen state, monitoring Hello messages without actively forwarding traffic or serving as the designated backup.
Q2. Which statement correctly describes the VRRP "IP address owner" concept?
A. It refers to whichever router has been active the longest
B. It refers to a router whose own physical interface IP address is identical to the configured virtual IP address, which automatically makes that router master with priority 255
C. It refers to the router with the lowest priority in the group
D. HSRP uses the same IP address owner concept as VRRP
Answer: B. A distinctive VRRP-specific feature allows the virtual IP address to be configured as identical to one participating router's own physical interface address. That router is then called the IP address owner and automatically receives priority 255, guaranteeing it wins the master election regardless of any other router's configured priority. HSRP has no equivalent concept, since HSRP's virtual IP is always a separate address from any router's own interface.
Q3. By default, how does preemption behavior differ between HSRP and VRRP?
A. Both protocols have preemption enabled by default
B. Both protocols have preemption disabled by default
C. HSRP has preemption disabled by default, while VRRP has preemption enabled by default
D. HSRP has preemption enabled by default, while VRRP has preemption disabled by default
Answer: C. HSRP preemption is disabled by default, meaning a standby router that becomes active after a failure will remain active even after the original higher-priority router recovers, unless preemption is explicitly enabled. VRRP preemption is enabled by default, meaning a recovering higher-priority router will automatically reclaim the master role without any additional configuration.
Q4. A router is configured with HSRP priority 110 and object tracking on its uplink interface, decrementing priority by 20 if that interface goes down. The uplink interface subsequently fails. What is this router's effective HSRP priority afterward?
A. 110, since tracking only affects VRRP
B. 90
C. 130
D. 0, since the router is immediately removed from the HSRP group entirely
Answer: B. Object tracking automatically decrements the router's configured priority by the specified amount when the tracked object (in this case, the uplink interface) goes down. Starting from a base priority of 110 and decrementing by 20 results in an effective priority of 90, which — assuming the other participating router now has a higher priority and preemption is enabled — would trigger that other router to take over as active.
Q5. Which multicast address does VRRP use for its advertisements?
A. 224.0.0.2
B. 224.0.0.102
C. 224.0.0.18
D. 224.0.0.5
Answer: C. VRRP uses multicast address 224.0.0.18 for its advertisements. 224.0.0.2 and 224.0.0.102 are used by HSRPv1 and HSRPv2 respectively, and 224.0.0.5 is used by OSPF (All OSPF Routers), not VRRP.
Q6. An administrator runs show standby on a router and sees that it is currently in the Standby state, even though it has a higher configured priority than the router currently shown as Active elsewhere in the group. What is the most likely explanation, assuming no misconfiguration of priority values?
A. HSRP does not support priority-based elections
B. Preemption has not been enabled, so the higher-priority router has not reclaimed the active role after the original active router recovered from an earlier failure
C. The virtual IP address must be misconfigured
D. This behavior is impossible and indicates a hardware failure
Answer: B. Since HSRP preemption is disabled by default, a router with a higher priority that comes online or recovers after another (lower-priority) router has already assumed the active role will remain in the standby state rather than automatically reclaiming active status, unless preemption has been explicitly enabled with the standby preempt command. This is expected, non-faulty behavior consistent with HSRP's default configuration.