What is HSRP?

Understanding HSRP

HSRP (Hot Standby Router Protocol) is a Cisco-proprietary first-hop redundancy protocol that provides default-gateway failover. Two or more routers form a group that shares a single virtual IP and virtual MAC address. One router is elected active and forwards traffic; the others stand by ready to assume the virtual addresses within seconds if the active router fails.

HSRP works by having group members exchange hello messages, by default every 3 seconds with a 10-second holdtime, over multicast (224.0.0.2 for version 1, 224.0.0.102 for version 2) on UDP port 1985. The router with the highest priority becomes active; preemption can force a higher-priority router to reclaim the role. Because hosts point to the virtual IP as their gateway, failover is transparent to end devices, which never need to change their ARP cache since the virtual MAC moves with the active role.

For security and availability, HSRP eliminates the single point of failure that a lone default gateway represents, preserving connectivity for VoIP, transactions, and critical sessions during a router or uplink outage. It also has a security dimension: early HSRP used plaintext or weak authentication, allowing an attacker on the LAN to send spoofed HSRP packets with a higher priority, win the election, and become a man-in-the-middle. Best practice is HSRPv2 with MD5 authentication and interface tracking.

For example, a branch office runs two routers in HSRP group 1 with virtual IP 10.1.1.1. Router A has priority 110 with preempt enabled and is active; Router B has the default priority 100. All workstations use 10.1.1.1 as their gateway. When Router A's WAN uplink drops and interface tracking decrements its priority below Router B's, Router B takes over the virtual IP and MAC, and users keep working without reconfiguring anything. Comparable standards-based alternatives include VRRP (RFC 5798) and Cisco's GLBP.