← Interview Prep

VRRP & FHRP — Gateway Redundancy

First-hop redundancy: how a shared virtual IP/MAC keeps hosts online when a gateway fails. VRRP master election, priority & the address owner, advertisements, preemption, object tracking, VRRPv3; and a VRRP vs HSRP vs GLBP comparison plus the EVPN anycast-gateway alternative.

A host knows exactly one default gateway. If that router dies, every host on the subnet is stranded — even if a second router sits right there. First-Hop Redundancy Protocols (FHRP) fix this: two or more routers share a virtual IP (the gateway hosts point at) and a virtual MAC, and one of them answers for it at any moment. VRRP is the standards-based one.

The trick: the gateway the hosts use is virtual. Routers elect a master that owns the virtual IP/MAC and forwards; if it fails, a backup takes over the same IP and MAC — hosts never notice, no ARP change needed.

VRRP (RFC 5798)

• Virtual IP + virtual MAC 0000.5E00.01xx (xx = VRID). Backups answer ARP for the VIP with this MAC, so failover needs no gratuitous re-learn on hosts.
• Master election by priority (1–254, default 100; higher wins). Priority 255 = the router that owns the VIP as a real interface address (the "address owner").
• Advertisements: the master multicasts to 224.0.0.18, IP protocol 112, every ~1s (v3 supports sub-second). Miss 3× → a backup promotes itself.
• Preemption (on by default): a higher-priority router coming back reclaims master. Turn it off to avoid needless flaps.
• Object/interface tracking: decrement priority when an uplink/route is lost, so mastership follows a working path — otherwise the "master" is a black hole with a dead uplink.
• VRRPv3 adds IPv6 support.

FHRP comparison

Load sharing: VRRP/HSRP balance by running two groups on the same VLAN and making each router master for one (half the hosts point at each VIP). GLBP does it natively: one virtual IP, the AVG hands out different virtual MACs to ARP requests so traffic spreads across all forwarders.

Design notes

• Align with STP: the FHRP master should be the L2 forwarding root for that VLAN, or traffic hairpins across the inter-switch link. (This is one reason MC-LAG / anycast gateways are cleaner — see MC-LAG.)
• Tracking is mandatory in practice: without uplink tracking, the master can stay master with a failed core-facing link and black-hole traffic.
• The modern alternative: an EVPN distributed anycast gateway puts the same gateway IP+MAC on every leaf, so the first hop is always local and both switches forward — no master/backup, no hairpin. See VLAN & VXLAN.