HSRP runs a small state machine on every router in a standby group, and the state a router is in tells you exactly what role it is playing and whether the group is healthy. When a gateway fails over and you are trying to work out why, the HSRP states are the first thing to read. This post walks through all six states, what moves a router between them, and how to read the state out of show standby on Cisco IOS XE.
For the cluster overview, see the FHRP complete guide. For an analogous protocol with its own state machine, see the BGP pillar.
What HSRP is doing in the first place
HSRP (Hot Standby Router Protocol) gives a set of routers a shared virtual IP and virtual MAC. Hosts use the virtual IP as their default gateway. One router actively forwards for that virtual IP; another stands by ready to take over. The state machine is how the routers negotiate who is active, who is standby, and who is just watching.
The six HSRP states
| # | State | What it means |
|---|---|---|
| 1 | Initial | HSRP is not running yet on this interface - just configured, or the interface just came up. The starting point. |
| 2 | Learn | The router does not know the virtual IP and has not heard from the active router. Only happens when the virtual IP is not configured locally and must be learned from a Hello. |
| 3 | Listen | The router knows the virtual IP and is listening to Hellos. It is neither active nor standby - it knows both of those roles are taken and is watching in case one opens up. |
| 4 | Speak | The router is sending Hellos and actively participating in the election for active and standby. |
| 5 | Standby | The router is the designated backup. It is next in line and will take over if the active router fails. |
| 6 | Active | The router is forwarding traffic for the virtual IP and answering ARP for the virtual MAC. This is the working role. |
In a healthy two-router group, the steady state is one router in Active and one in Standby. Any third or fourth router in the group sits in Listen. Initial, Learn, and Speak are transitional - you only catch a router in those during startup or a failover.
The normal startup sequence
When you bring up HSRP on two routers, each one walks the states:
Initial - HSRP starts. The router moves on as soon as the interface is up and the config is read.
Listen - the router knows the virtual IP (because it is configured locally). It listens to Hellos to learn who else is in the group. If the virtual IP were not configured locally, it would pass through Learn first to discover the IP from a Hello.
Speak - after the active timer expires without hearing a higher-priority active router, the router starts sending Hellos and contests the election. Both routers in a new group reach Speak and exchange Hellos.
Standby / Active - the election resolves. The router with the higher priority (or higher IP, on a priority tie) becomes Active. The other becomes Standby.
What decides the election: priority and preemption
Two knobs control which router ends up Active.
| Setting | Effect |
|---|---|
standby 10 priority 110 | Higher priority wins the election. Default is 100. |
standby 10 preempt | Lets a higher-priority router take over from a lower-priority active router when it comes online. Without preempt, whoever got Active first keeps it. |
This is the single most important HSRP behavior to internalize: without preempt, priority only matters at election time. If your intended-primary router reboots, the backup becomes Active, and when the primary comes back it sees an active router already and settles into Standby - even though it has the higher priority. It will not reclaim the Active role until you configure preempt.
Minimum config and the resulting states
! R1 - intended primary
interface GigabitEthernet0/0
ip address 10.20.0.2 255.255.255.0
standby version 2
standby 10 ip 10.20.0.1
standby 10 priority 110
standby 10 preempt
!
! R2 - intended backup
interface GigabitEthernet0/0
ip address 10.20.0.3 255.255.255.0
standby version 2
standby 10 ip 10.20.0.1
standby 10 priority 100After convergence: R1 reaches Active (priority 110), R2 reaches Standby (priority 100). Because R1 has preempt, if R1 ever reboots and comes back, it reclaims Active. R2 does not need preempt - it is never trying to take a role away from a higher-priority router.
Reading the state on IOS XE
The quick view across all groups:
R1# show standby brief
P indicates configured to preempt.
|
Interface Grp Pri P State Active Standby Virtual IP
Gi0/0 10 110 P Active local 10.20.0.3 10.20.0.1The detailed view, when you need timers and the why:
R1# show standby GigabitEthernet0/0 10
GigabitEthernet0/0 - Group 10 (version 2)
State is Active
8 state changes, last state change 02:14:51
Virtual IP address is 10.20.0.1
Active virtual MAC address is 0000.0c9f.f00a
Hello time 3 sec, hold time 10 sec
Preemption enabled
Active router is local
Standby router is 10.20.0.3, priority 100 (expires in 9.872 sec)
Priority 110 (configured 110)Three things to read:
- State is Active. The role this router is playing. Cross-check the partner shows Standby.
- state changes count. A high number that keeps climbing means the group is flapping - usually a tracked interface bouncing or a Hello/hold-timer mismatch.
- Standby router ... expires in N sec. A countdown that resets means Hellos are arriving. If it hits zero, the standby is declared dead and the group reconverges.
Interface tracking: states that change on purpose
HSRP would be nearly useless if it only failed over when a router died. The real value is failing over when a router loses its upstream path. Object tracking does this:
track 1 interface GigabitEthernet0/1 line-protocol
!
interface GigabitEthernet0/0
standby 10 track 1 decrement 20If R1's upstream interface Gi0/1 goes down, track object 1 fails, and R1's HSRP priority drops by 20 (from 110 to 90). Now R2 at priority 100 is higher. With preempt configured, R2 takes Active. R1 transitions Active to Speak to Standby. The state change you see in the logs is the visible symptom of a tracked uplink failing.
Common state problems
| Symptom | Cause |
|---|---|
| Both routers show Active (split brain) | The two routers cannot hear each other's Hellos - VLAN/trunk problem, ACL blocking HSRP, or a group-number mismatch. Each thinks it is alone. |
| Primary router stays Standby after a reboot | No preempt on the primary. Priority alone does not reclaim the role. |
| Router stuck in Speak, never reaches Standby/Active | Hellos not being exchanged - one-way connectivity, or an authentication mismatch between group members. |
| State changes climbing constantly | A flapping tracked interface, or Hello/hold timers that differ between the two routers. |
| Router sits in Listen and never contests | Normal if it is a third router in the group. A problem only if it is one of the two you expected to be Active/Standby. |
Key takeaways
HSRP has six states: Initial, Learn, Listen, Speak, Standby, Active. The healthy steady state is one Active, one Standby, and any extras in Listen. The election is decided by priority, and a higher-priority router only reclaims the Active role if preempt is configured - this is the single most common HSRP surprise. Interface tracking deliberately drops priority so a router that loses its uplink hands off gracefully. Read the live state with show standby brief, and watch the state-change counter for flapping.
For the FHRP cluster, see the FHRP pillar.
