Learn Computer Networking PNETLab - First Hop Redundancy Protocols (FHRP - HSRP & VRRP)

#Introduction

In episode 6 you made a single router or SVI the default gateway. What happens if that device dies? Every PC loses its way out of the network. Episode 14 discusses the solution: First Hop Redundancy Protocol (FHRP) — a group of routers sharing a single virtual IP that makes the failure of one device imperceptible to users.

We discuss two FHRP implementations: Cisco's HSRP and the open standard VRRP. You will configure HSRP with priority, preempt, and interface tracking, then test failover directly in PNETLab.

#The Need for Default Gateway Redundancy

#Preventing a Single Point of Failure

Every subnet needs a gateway. If that gateway is a single device, all traffic leaving the network depends on that one device. FHRP removes this dependency: two or more routers join a single group that uses one virtual IP. PCs keep using the virtual IP as their gateway, while the router that is actually active can change at any time.

#HSRP vs VRRP

#Virtual IP and Virtual MAC Address

HSRP (Hot Standby Router Protocol) is Cisco's FHRP: one router becomes Active, another becomes Standby, and both share a virtual IP. Traffic is forwarded to the virtual MAC 0000.0c07.acXX of the group.

VRRP (Virtual Router Redundancy Protocol) is an open standard with a similar concept: one Master and several Backups, sharing a virtual MAC based on the group number. The practical difference is that VRRP uses the real address of one of its members as the virtual IP, while HSRP uses a truly virtual IP. For a PNETLab lab, choose HSRP when all devices are Cisco, and VRRP when you want an open standard.

#HSRP Active / Standby Router Configuration

#Applying It in PNETLab

Build two routers or two SVIs representing redundant gateways for VLAN 10. Configure the side that should become Active:

configure terminal
interface vlan 10
 ip address 192.168.10.2 255.255.255.0
 standby 1 ip 192.168.10.1
 standby 1 priority 110
 standby 1 preempt
 standby 1 track g0/0 20
exit

standby 1 ip 192.168.10.1 sets the virtual IP of group 1, standby 1 priority 110 makes this router preferred, preempt makes it become active again when it recovers, and track g0/0 20 lowers the priority by 20 points when the main uplink is down.

Configure the Standby side with the default priority of 100:

configure terminal
interface vlan 10
 ip address 192.168.10.3 255.255.255.0
 standby 1 ip 192.168.10.1
exit

Both routers share the same virtual IP 192.168.10.1. PCs in VLAN 10 use that virtual IP as their gateway, not the real IP of each router.

#Testing HSRP Failover

#Cutting the Main Link and Observing the Handover

Time to prove the redundancy. Open the console of a PC in VLAN 10 and run a continuous ping to an outside subnet. While the ping runs, shut down the main interface of the Active router:

interface g0/0
 shutdown
exit

Because interface tracking lowers the Active router's priority below the Standby's, the Standby router automatically becomes Active. The PC's ping may lose a packet or two, then continue without manual intervention. Verify the group status:

R1# show standby brief
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Vl10        1    90  Standby  192.168.10.2    local           192.168.10.1

show standby brief displays each router's role. After the failover, the backup router shows the Active state. When the interface recovers, preempt automatically returns the Active role to the main router.

#FHRP Best Practices

A few important rules: give clear priorities so the role does not shift randomly, always install preempt so the better router returns to active, and always combine it with interface tracking so the priority drop happens automatically when the uplink has a problem. Combining HSRP with EtherChannel from episode 8 and STP from episode 7 forms the foundation of network availability that will be used in episode 20.

#Closing

Key takeaways:

• FHRP removes the single point of failure on the default gateway.
• HSRP is Cisco's; VRRP is an open standard; both use a virtual IP.
• standby <group> ip <ip> creates the virtual IP that PCs use.
• Priority determines Active; preempt restores the role after recovery.
• Interface tracking lowers priority when the main uplink is down.
• show standby brief verifies the role at any time.

In the next episode, episode 15, we shift to security: Access Control Lists (ACL) — packet filtering with top-down evaluation and an implicit deny, the difference between standard and extended ACLs, configuring an extended named ACL to block web traffic, and applying it on interfaces and VTY lines with access-class.