A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
! HSRP configuration — R1 (primary)R1(config)# interface gigabitEthernet0/1R1(config-if)# ip address 10.10.10.2 255.255.255.0R1(config-if)# standby 1 ip 10.10.10.1R1(config-if)# standby 1 priority 110R1(config-if)# standby 1 preemptR1(config-if)# standby 1 timers 1 3R1(config-if)# standby 1 authentication md5 key-string HSRPKey123R1(config-if)# exit! HSRP configuration — R2 (standby)R2(config)# interface gigabitEthernet0/1R2(config-if)# ip address 10.10.10.3 255.255.255.0R2(config-if)# standby 1 ip 10.10.10.1R2(config-if)# standby 1 priority 100R2(config-if)# standby 1 preemptR2(config-if)# standby 1 timers 1 3R2(config-if)# standby 1 authentication md5 key-string HSRPKey123R2(config-if)# exit
Both routers get the same virtual IP (`10.10.10.1`), the same group number (`1`), and matching authentication. The router with priority 110 wins, so R1 becomes active. Preemption enables failover back to R1 after recovery. Timers are tuned to `1 3` — 1 second Hello, 3 second hold — for faster failover than the default 3/10.
Fast timers (1/3) cause failover in ~3 seconds but increase CPU load and protocol traffic. Default timers (3/10) give 10-second failover with less overhead. Choose based on how much downtime you can tolerate. For most networks, 3/10 is fine — 10 seconds of rerouted traffic beats CPU spikes on the routers.
`State is Active` — this router owns the virtual IP. The virtual MAC is shown, the priority, and the standby router's address. Everything visible in one output.
! VRRP on R1 (master)R1(config)# interface gigabitEthernet0/1R1(config-if)# vrrp 1 ip 10.10.10.1R1(config-if)# vrrp 1 priority 110R1(config-if)# vrrp 1 preemptR1(config-if)# vrrp 1 authentication md5 key-string VRRPKey123R1(config-if)# vrrp 1 timers advertise 1R1(config-if)# exit! VRRP on R2 (backup)R2(config)# interface gigabitEthernet0/1R2(config-if)# vrrp 1 ip 10.10.10.1R2(config-if)# vrrp 1 priority 100R2(config-if)# vrrp 1 preemptR2(config-if)# vrrp 1 authentication md5 key-string VRRPKey123R2(config-if)# vrrp 1 timers advertise 1R2(config-if)# exit! VerifyR1# show vrrpR1# show vrrp brief
VRRP syntax is nearly identical to HSRP — same commands with `vrrp` instead of `standby`. Priorities work the same way. Authentication works the same way. The virtual MAC differs (0000.5E00.01xx instead of 0000.0C07.ACxx). VRRP preemption is on by default.
One key difference: VRRP's default master is the router with the highest priority. In HSRP, if two routers have the same priority, the higher IP wins. In VRRP, the higher IP also wins. Both protocols break priority ties with IP address — higher wins.
| Command | Shows |
|---|---|
| `show standby brief` | One-line summary per group |
| `show standby` | Detailed HSRP state |
| `show standby <intf> <group>` | Specific group detail |
| `show vrrp brief` | One-line VRRP summary |
| `show vrrp` | Detailed VRRP state |
| `show glbp brief` | One-line GLBP summary |
Configure HSRP between two routers on a shared subnet. Set R1 to priority 150, R2 to priority 100. Enable preemption on both. Verify with `show standby brief`. Then shut down R1's WAN interface and verify failover.
HSRP and VRRP config is straightforward: virtual IP, priority, preempt, authentication. Verification with `show standby brief` shows everything. Track objects for real failover intelligence. Section 14 wraps up with HA design considerations.
Finish the lesson once you have worked through the material. This awards ★ 15 XP.