Introduction to First Hop Redundancy Protocol (FHRP)

FHRPs (First Hop Redundancy Protocols) exist to eliminate the single point of failure at the default gateway.
They are a family of protocols designed to reduce the risk of gateway failure and keep the network available.

Let’s see how this works with a simple example.

Example – The Role of the Default Gateway

Imagine that you are a device in a local network (LAN), let's call it PC1 with an IP address of 192.168.10.101.

To communicate with devices outside your network, such as accessing websites or using online services, you need a default gateway.

Figure 1 – Default Gateway in a Local Network

This default gateway is typically a router that connects your network to the outside world.
In this example, R1 is the router acting as your default gateway.

You can verify this configuration using the ipconfig command on your PC:

PC1> ipconfig

Ethernet adapter Ethernet:

   IPv4 Address. . . . . . . . . . . : 192.168.10.101
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.10.1

The default gateway (192.168.10.1) allows your PC to communicate beyond your local network.
Your device relies entirely on this default gateway to access external networks.

Figure 2 – Internet Access Through the Default Gateway

You successfully access the internet via the default gateway (192.168.10.1).
Life is good, you can browse the web and access external networks without problem.

What Happens If the Default Gateway Fails?

Now, imagine that R1 fails due to a hardware issue.
Without a backup mechanism, your PC immediately loses connectivity to the internet and other external networks.

Figure 3 – Default Gateway Fails

At this point, you would need to manually configure your PC to use another router (if available) as the default gateway. This process is not only inconvenient but also impractical for large networks with many devices.

This is where First Hop Redundancy Protocols (FHRP) come into play.
They ensure that even if one router fails, your network remains operational without requiring any manual intervention.

Now that you’ve seen the problem caused by having only one default gateway, let’s see how networks solve it.

FHRP is a family of protocols designed to provide redundancy for the default gateway.
Instead of relying on a single router, multiple routers work together as a group to appear as one virtual gateway for all the devices in your network.

Figure 4 – How FHRP Works with Active and Standby Routers

This means that if one router fails, another automatically takes over, so your network continues to run without interruption.
You don’t have to change anything on your computer. Everything happens in the background.

Roles in an FHRP Group

To understand it better, look at the diagram above showing R1 and R2.
They both share the same virtual gateway IP address (for example, 192.168.10.3), but each one plays a specific role.

Active Router (R1)

• Handles all traffic sent to the default gateway (192.168.10.3).

• It also replies to ARP requests for the Virtual IP (VIP) so your PC knows where to send packets.

Standby Router (R2)

• Monitors the active router’s status.

• If R1 stops responding, R2 automatically takes over to keep your network online.

How It Works

Now let’s see how this process works in your network.

1. Your PC is configured to use the Virtual IP (VIP), such as 192.168.10.3, as its default gateway.

2. The active router (R1) is the one actually forwarding your traffic to other networks.

3. If R1 fails, the standby router (R2) immediately takes over the job.

From your point of view, nothing changes.

At this point, you might be thinking:

“Okay, I understand the idea but how does FHRP actually work behind the scenes?”

That’s a great question.

FHRP works by using virtual addresses that represent a shared gateway between multiple routers.
There are two key elements that make this possible:

• Virtual IP (VIP): The shared IP address (for example, 192.168.10.3) that all devices use as their default gateway.

• Virtual MAC: A MAC address associated with the VIP, allowing the active router to handle traffic for that virtual gateway.

Together, they allow your routers to appear as one single gateway that your PC always uses to reach external networks. Let’s look at how this works in practice.