VRRP and VSRP: First-Hop Redundancy Explained

01 /Why first-hop redundancy exists

Every host has one default gateway address. Dynamic routing protects paths between routers, but nothing in a host notices that its gateway has died; it keeps sending frames to a MAC that no longer answers until the ARP entry ages out, and even then has no second address to try. Two routers on the subnet are useless unless hosts reach whichever is alive through the same address. First-hop redundancy protocols make the gateway address virtual.

02 /The VRRP virtual router

A virtual router is identified by a VRID (1 to 255) and owns one or more virtual IP addresses plus a derived virtual MAC, 00-00-5E-00-01-VRID for IPv4. One participating router is master: it answers ARP for the virtual IP with the virtual MAC, forwards packets sent to that MAC, and multicasts an advertisement to 224.0.0.18 (IP protocol 112) at a fixed interval, one second by default. All others are backups and only listen.

If the backups hear nothing for the master down interval (three advertisement intervals plus a small priority-weighted skew), the highest-priority backup declares itself master, sends a gratuitous ARP so switches relearn the virtual MAC on its port, and begins forwarding. Failover takes three to four seconds with default timers; RFC 5798 allows sub-second timers at the cost of more control traffic.

03 /Priority, preemption and the address owner

Priority runs 1 to 254, default 100. The router that actually has the virtual IP configured on its interface is the address owner and uses priority 255, so it always wins when up. Preemption, on by default, means a higher-priority router returning to service takes mastership back immediately, which is right for the owner but causes a second flap after a reboot. Many operators disable preemption on non-owner routers or add a delay so the returning router converges its routing protocols first.

04 /Worked example: VRRP priorities, tracking and the failover clock

Two routers share VRID 1 for 10.10.10.1 under RFC 5798 rules, neither owning the address. R1 runs priority 120 with tracking that subtracts 30 when its uplink to the core drops; R2 runs priority 100 at the default 100 centisecond interval. The skew time on R2 is (256 minus 100) times 100 divided by 256, about 61 centiseconds, so its master down interval is about 3.6 seconds. If R1 loses power, R2 becomes master 3.6 seconds after the last advertisement. If the R1 uplink fails instead, R1 keeps advertising at priority 90; R2 hears a lower priority than its own and, with preemption on, takes over at the next advertisement, well under a second, because no timer has to expire.

router# show vrrp brief
  Interface  Grp  Pri  Time  Own  Pre  State   Master addr  Group addr
  ve10       1    120  3531  -    Y    Master  local        10.10.10.1

05 /Tracking and interface priority

A master with a live LAN interface but a dead uplink is a black hole. Tracking ties the VRRP priority to the state of another interface or route: if the tracked uplink goes down, the priority drops by a configured amount, a backup with a healthier uplink becomes master, and traffic flows again. Track the uplink or the default route toward the core, not the LAN interface VRRP runs on.

! standard VRRP: this router owns the address
router vrrp
interface ve 10
 ip address 10.10.10.1 255.255.255.0
 ip vrrp vrid 1
  owner
  ip-address 10.10.10.1
  track-port ethernet 1/1
  activate
!
! VRRP-E: no owner, every router is a backup with a priority
router vrrp-extended
interface ve 10
 ip address 10.10.10.2 255.255.255.0
 ip vrrp-extended vrid 1
  backup priority 110
  ip-address 10.10.10.1
  activate

show ip vrrp
show ip vrrp-extended

06 /VRRP versus HSRP versus GLBP

HSRP predates VRRP and works the same way with a different packet format and virtual MAC range. GLBP adds active/active forwarding under one virtual IP by handing out different virtual MACs in ARP replies. Standard VRRP achieves load sharing only by running two VRIDs with opposite priorities and pointing half the hosts at each. The same election protects a load balancer pair sharing a VIP.

07 /Foundry heritage: VRRP-E and VSRP

VRRP-E (VRRP Extended) on BigIron and FastIron Layer 3 switches removed the owner concept: the virtual IP is not configured on any real interface, every router is a backup with a priority, and the virtual address is never tied to a physical interface that could take it down. This made priorities symmetric and tracking simpler; later versions added short-path forwarding so a backup could route traffic it received directly instead of bridging it to the master. VRRP-E uses its own packet format and does not interoperate with standard VRRP.

VSRP (Virtual Switch Redundancy Protocol) applied the same election to Layer 2. A pair of aggregation switches ran VSRP on a VLAN; the master forwarded and the backup blocked its ports toward the access switches below, which could run VSRP-aware code to flush MAC tables on failover. Failover was sub-second, without spanning tree timers. The VSRP whitepaper was among the most linked documents on the original site. On Layer 3 models VSRP could also carry the gateway address, combining both roles in one protocol. First-hop redundancy protects only the default gateway; past it, failover is handled by the dual control planes described on the core router design page and, in provider networks, by the RSVP-TE protection paths covered under MPLS VPN services. Both belong to the routing section.

08 /VRRP failure modes and expert tips

• Two masters. Something between the routers drops 224.0.0.18 or IP protocol 112: an access list, a firewall, or IGMP snooping with no querier. Both answer ARP for the address and the switch table flaps. A capture on each router settles it.
• No authentication. RFC 5798 and its 2024 successor RFC 9568 (which renames master to active) carry no authentication. Any host on the VLAN can advertise at priority 255 and become the gateway. Permit 224.0.0.18 only from router-facing switch ports.

For IPv6 the group uses ff02::12 and the virtual MAC 00-00-5E-00-02-VRID, and the same election hands out IPv6 gateway addresses through router advertisements sent from the virtual address. Run the group on the SVI on each distribution switch; the redundancy covers only the gateway hop: the uplinks that spanning tree blocks below it still decide how long the Layer 2 path takes to recover.