First-Hop Redundancy

What It Is

First-hop redundancy keeps hosts using a stable default gateway IP when one router, switch, firewall, or uplink fails. Classic designs use HSRP, VRRP, or GLBP to present one virtual gateway on a VLAN. Modern campus and data center designs may also use active-active gateways, MLAG/vPC behavior, or EVPN anycast gateway instead of a single active router model.

The real design question is not just "which protocol." It is where the default gateway lives, how failure is detected, what happens to ARP or ND, and whether return traffic stays symmetric enough for the firewall, NAT, and inspection path.

Protocols

Modern note: VRRPv3 is the current VRRP reference for IPv4 and IPv6. Older VRRPv2 references were IPv4-only.

Addressing And MAC Behavior

Watch out: FHRP protects the first hop. It does not automatically prove the upstream path is healthy. Track the path that actually matters.

Comparison

Design note: In most networks, active-active by VLAN or anycast gateway is easier to operate than GLBP host load sharing.

State Model

Design Choices

Watch out: Fast timers can create faster failover and faster instability. Measure convergence instead of assuming lower timers are better.

Modern Data Center Note

EVPN/VXLAN fabrics commonly use anycast gateway. Each leaf switch has the same gateway IP and virtual MAC for a VLAN or bridge domain, so hosts can forward to the local leaf. This removes classic active/standby first-hop behavior inside the fabric, but it adds control-plane dependencies: EVPN route advertisements, MAC/IP learning, duplicate address detection, and consistent anycast MAC configuration.

Anycast gateway is not a drop-in replacement for HSRP at every edge. Firewalls, service insertion, NAT, and asymmetric traffic still need deliberate design.

Cisco IOS/IOS-XE Examples

HSRP with tracking:

interface GigabitEthernet1/0/10
 description Users VLAN 10 routed gateway
 ip address 10.10.10.2 255.255.255.0
 standby version 2
 standby 10 ip 10.10.10.1
 standby 10 priority 110
 standby 10 preempt delay minimum 30
 standby 10 authentication md5 key-string ExampleKey
 standby 10 track GigabitEthernet1/0/48 decrement 30

VRRPv3 style gateway:

interface GigabitEthernet1/0/20
 description Servers VLAN 20 routed gateway
 ip address 10.10.20.2 255.255.255.0
 vrrp 20 address-family ipv4
  address 10.10.20.1 primary
  priority 110
  preempt delay minimum 30
  track 1 decrement 30

Object tracking:

track 1 ip route 0.0.0.0 0.0.0.0 reachability

Legacy GLBP pattern:

interface GigabitEthernet1/0/30
 description Legacy GLBP VLAN 30
 ip address 10.10.30.2 255.255.255.0
 glbp 30 ip 10.10.30.1
 glbp 30 priority 110
 glbp 30 preempt
 glbp 30 load-balancing host-dependent
 glbp 30 weighting 110 lower 90 upper 105

Notes:

• Syntax varies by platform and release. Verify the exact command form before pasting into production.
• Use documentation addresses only as examples. Replace interface names, VLANs, keys, and tracking objects.
• If the gateway is on an SVI, align the FHRP design with the Layer 2 topology.

Troubleshooting

Commands

show standby brief
show standby
show vrrp brief
show vrrp
show glbp brief
show glbp
show track brief
show ip arp 10.10.10.1
show mac address-table address <virtual-mac>
show logging | include HSRP|VRRP|GLBP|TRACK

Expected clues:

• Exactly one active router exists for each classic FHRP group.
• Priority and preempt behavior match the intended active device.
• Track objects change state when the real upstream path fails.
• Hosts resolve the virtual gateway to the expected virtual MAC.
• Access ports do not accept rogue FHRP advertisements.

Watch Out

• Do not rely on FHRP if both devices share the same failed uplink.
• Do not tune subsecond timers without testing CPU, control-plane policing, and packet loss.
• Do not forget IPv6 router advertisements when dual-stack hosts use the VLAN.
• Do not assume GLBP gives useful load balancing for modern campus designs.
• Do not let untrusted hosts send FHRP advertisements.
• Do not ignore firewall state and NAT when gateway failover changes the path.

References

• RFC 9568: VRRP Version 3 for IPv4 and IPv6
• Cisco IOS XE Configuring HSRP
• Cisco IOS XE Configuring GLBP
• Cisco IOS XE First Hop Redundancy Protocols Configuration Guide
• Cisco IOS XE Software Hardening Guide: Secure First Hop Redundancy Protocols