3.5First-hop redundancy with FHRP (HSRP)

PCs and servers generally do not speak routing protocols and can rely on only one configured default gateway IP as their exit. If that gateway is a single router and it fails, every device on the segment loses its path out. FHRP (a First-Hop Redundancy Protocol) removes this single point of failure by having multiple routers share a virtual IP so that if one fails, another takes over serving that same virtual IP. This section covers the operation of Cisco's HSRP, its representative example, and the preempt design decision that is most commonly gotten wrong in practice.

3.5.1The problem FHRP solves

• FHRP is the umbrella term for the family of protocols that make a default gateway redundant. Hosts are configured with a single virtual IP as their default gateway, and multiple real routers share that virtual IP. Hosts change nothing on their side while the routers are made redundant behind the scenes. Representatives include Cisco's HSRP and GLBP and the standard VRRP.
• The key to redundancy also lies in the virtual MAC. A host ARPs for the virtual IP and caches the returned virtual MAC as the gateway's MAC. When the Active router fails and the Standby takes over, the virtual IP and virtual MAC stay the same, so only the forwarding target is swapped without updating the host's ARP cache (the switchover is invisible to the host).

3.5.2HSRP operation: Active/Standby, priority, and preempt

• In HSRP (Cisco-proprietary), one router in the group becomes Active and actually forwards traffic to the virtual IP/MAC, one waits as Standby, and the rest listen. Active and Standby monitor each other with Hellos, and when the Active stops responding, the Standby is immediately promoted to Active.
• Which router becomes Active is decided by priority (default 100, range 0-255): the higher-priority router becomes Active (on a tie, the higher interface IP). The virtual MAC takes the fixed form 0000.0c07.acXX in HSRPv1 (XX is the group number).
• Preempt (standby <group> preempt) is disabled by default. Left disabled, once an Active is chosen, even if a higher-priority router later appears (e.g., after recovery), the current Active sits tight and does not fail back. To automatically return to the intended primary after recovery, you must explicitly enable preempt on that router.

Suppose you make a floor's default gateway redundant with HSRP across a primary R1 (priority 110) and a backup R2 (priority 100), setting the virtual IP 10.0.0.1 as the hosts' default gateway. The design intent is "R1 forwards normally; if R1 fails, R2 takes over; when R1 recovers, return to R1." When you first take R1 down for maintenance, the Standby R2 is immediately promoted to Active, and since the virtual IP 10.0.0.1 and virtual MAC do not change, hosts keep communicating without updating their ARP cache—so far as intended. But after R1's maintenance ends and it recovers, you observe that traffic keeps flowing through R2 and does not return to R1. R1's priority 110 is higher than R2's 100, so why does it not return? The cause is that HSRP's preempt is disabled by default. With preempt disabled, once R2 has become Active, R1 recovering with a higher priority does not make R2 yield its current Active role. To "automatically return to the recovered R1" as intended, you must have explicitly enabled standby 1 preempt on R1. This looks like the same pitfall as OSPF's non-preemptive DR election, but HSRP differs in that configuring preempt makes it preemptive. Further, a common practical design links R1's interface priority to the upstream link's state with standby 1 track, automatically lowering the priority to yield to R2 if the upstream fails. "Merely raising the priority does not auto-fail-back; preempt is required"—this is the most common oversight in HSRP design.

3.5.3Section summary

• FHRP shares a virtual IP / virtual MAC across routers to remove the default-gateway single point of failure (hosts unchanged)
• HSRP decides Active/Standby by priority (default 100, higher becomes Active), and the Standby is promoted immediately on Active failure
• Preempt is disabled by default—without enabling it, no auto-fail-back to a recovered higher-priority router (unlike OSPF's DR election, this is configurable)