Introduction to First Hop Redundancy Protocol (FHRP)

FHRPs (First Hop Redundancy Protocols) exist to eliminate the single point of failure at the default gateway.
They are a family of protocols designed to reduce the risk of gateway failure and keep the network available.

Let’s see how this works with a simple example.

Example – The Role of the Default Gateway

Imagine that you are a device in a local network (LAN). Let's call it PC1, with an IP address of 192.168.10.101.

To communicate with devices outside your network, such as accessing websites or using online services, you need a default gateway.

Figure 1 – Default Gateway in a Local Network

This default gateway is typically a router that connects your network to the outside world.
In this example, R1 is the router acting as your default gateway.

You can verify this configuration using the ipconfig command on your PC:

PC1> ipconfig

Ethernet adapter Ethernet:

   IPv4 Address. . . . . . . . . . . : 192.168.10.101
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.10.1

The default gateway (192.168.10.1) allows your PC to communicate beyond your local network.
Your device relies entirely on this default gateway to access external networks.

Figure 2 – Internet Access Through the Default Gateway

You successfully access the internet via the default gateway (192.168.10.1).
Life is good: you can browse the web and access external networks without any problem.

What Happens If the Default Gateway Fails?

Now, imagine that R1 fails due to a hardware issue.
Without a backup mechanism, your PC immediately loses connectivity to the internet and other external networks.

Figure 3 – Default Gateway Fails

At this point, you would need to manually configure your PC to use another router (if available) as the default gateway. This process is not only inconvenient but also impractical for large networks with many devices.

This is where First Hop Redundancy Protocols (FHRP) come into play.
They ensure that even if one router fails, your network remains operational without requiring any manual intervention.

Now that you’ve seen the problem caused by having only one default gateway, let’s see how networks solve it.

FHRP is a family of protocols designed to provide redundancy for the default gateway.
Instead of relying on a single router, multiple routers work together as a group to appear as one virtual gateway for all the devices in your network.

Figure 4 – How FHRP Works with Active and Standby Routers

This means that if one router fails, another automatically takes over, so your network continues to run without interruption.
You don’t have to change anything on your computer. Everything happens in the background.

Roles in an FHRP Group

To understand it better, look at the diagram above showing R1 and R2.
They both share the same virtual gateway IP address (for example, 192.168.10.3), but each one plays a specific role.

Active Router (R1)

• Handles all traffic sent to the default gateway (192.168.10.3).

• It also replies to ARP requests for the Virtual IP (VIP) so your PC knows where to send packets.

Standby Router (R2)

• Monitors the active router’s status.

• If R1 stops responding, R2 automatically takes over to keep your network online.

How It Works

Now let’s see how this process works in your network.

1. Your PC is configured to use the Virtual IP (VIP), such as 192.168.10.3, as its default gateway.

2. The active router (R1) is the one actually forwarding your traffic to other networks.

3. If R1 fails, the standby router (R2) immediately takes over the job.

From your point of view, nothing changes.

At this point, you might be thinking:

“Okay, I understand the idea but how does FHRP actually work behind the scenes?”

That’s a great question.

FHRP works by using virtual addresses that represent a shared gateway between multiple routers.
There are two key elements that make this possible:

• Virtual IP (VIP): The shared IP address (for example, 192.168.10.3) that all devices use as their default gateway.

• Virtual MAC: A MAC address associated with the VIP, allowing the active router to handle traffic for that virtual gateway.

Together, they allow your routers to appear as one single gateway that your PC always uses to reach external networks. Let’s look at how this works in practice.

Step 1 - ARP Request

PC1 is configured with the Virtual IP (VIP) 192.168.10.3 as its default gateway.
Before sending traffic outside the network, it first needs to know the MAC address linked to this gateway.

To find it, PC1 sends an ARP request to resolve the VIP (192.168.10.3) to a MAC address.

Figure 5 – ARP Request for the Virtual IP (VIP)

The request asks:
“Who has 192.168.10.3?”

Step 2 - ARP Reply

The Active Router (R1) responds with the Virtual MAC address associated with the VIP.

Figure 6 – ARP Reply from the Active Router

R1 replies:
“I do. Here’s the Virtual MAC address for 192.168.10.3.”

Your PC then updates its ARP cache, mapping the VIP to that virtual MAC address.

Step 3 - Communication

Once the ARP process is complete, PC1 starts sending all its traffic to the virtual MAC address.
That traffic is received by the active router (R1), which forwards it to the destination network.

Figure 7 – Communication via the Active Router

Everything works perfectly while the active router is up and running.
But what happens if R1 suddenly goes down?

Let’s see how FHRP handles this situation.

When the active router (R1) fails, the standby router (R2) must detect the problem and take over the forwarding role.

To make this possible, R1 and R2 continuously monitor each other’s status by exchanging Hello messages through multicast packets.

Figure 8 – Active Router Failure Detection

These periodic messages let both routers know whether the other is still active.

Step 1 – Failure Detection

At some point, R1 stops sending Hello messages.

Figure 9 – Hello Message Failure Detection

R2 immediately notices that these messages are no longer being received and concludes that R1 is no longer active.

Step 2 – Standby Router Takes Over

R2 begins the transition process to become the new active router.

Figure 10 – Standby Router Takes Over

After a brief delay to confirm the failure, it assumes full responsibility for forwarding traffic.

Step 3 – Gratuitous ARP Update

As soon as it takes over, R2 sends a Gratuitous ARP message.

Figure 11 – Gratuitous ARP Update

The virtual MAC address does not change during a failover, so PC1 keeps the same ARP entry and notices nothing.
What needs to change is the switch: it still associates the virtual MAC with the port where R1 was connected.
The Gratuitous ARP makes the switch update its MAC address table, so frames sent to the virtual MAC now leave through the port toward R2.

Step 4 – Network Continuity

With R2 now acting as the Active Router, your PC resumes sending traffic through the new active router.

Figure 12 – Network Continuity After Failover

From your perspective, the failover process is invisible: you continue to access external resources without manual intervention.

Everything you’ve seen so far explains how FHRP keeps your network running even when a router fails.
Now that you understand the concept, let’s look at the different protocols that make it possible.

FHRP is a family of protocols, and each one has its own characteristics.
For the CCNA exam, you’ll focus mainly on HSRP, including its configuration.
You’ll also study VRRP and GLBP, but only to understand how they work conceptually.

Comparison of FHRP Protocols

Table 1 – Comparison of Popular FHRP Protocols

Key Points for Each Protocol

HSRP (Hot Standby Router Protocol)

• Cisco proprietary protocol.

• Provides redundancy with one active and one standby router.

VRRP (Virtual Router Redundancy Protocol)

• Open standard protocol (RFC 5798) used across multi-vendor networks.

• Operates with a master router and one or more backup routers.

GLBP (Gateway Load Balancing Protocol)

• Cisco proprietary protocol.

• Allows several routers to forward traffic simultaneously, improving resource utilization through load sharing.

FHRP provides several key benefits for network reliability and uptime:

• High Availability: Ensures continuous connectivity even if a router fails.

• Fault Tolerance: Minimizes downtime by enabling automatic and seamless failover.

• Simplified Configuration: End devices only need a single default gateway, regardless of which router is currently active.

In summary, First Hop Redundancy Protocols are essential for maintaining stable and resilient networks.
They prevent disruptions caused by router failures and keep users connected without any manual intervention.