HSRP States: The 6-State Machine with show standby Output

HSRP runs a small state machine on every router in a standby group, and the state a router is in tells you exactly what role it is playing and whether the group is healthy. When a gateway fails over and you are trying to work out why, the HSRP states are the first thing to read. This post walks through all six states, what moves a router between them, and how to read the state out of show standby on Cisco IOS XE.

For the cluster overview, see the FHRP complete guide. For an analogous protocol with its own state machine, see the BGP pillar.

What HSRP is doing in the first place

HSRP (Hot Standby Router Protocol) gives a set of routers a shared virtual IP and virtual MAC. Hosts use the virtual IP as their default gateway. One router actively forwards for that virtual IP; another stands by ready to take over. The state machine is how the routers negotiate who is active, who is standby, and who is just watching.

The six HSRP states

In a healthy two-router group, the steady state is one router in Active and one in Standby. Any third or fourth router in the group sits in Listen. Initial, Learn, and Speak are transitional - you only catch a router in those during startup or a failover.

The normal startup sequence

When you bring up HSRP on two routers, each one walks the states:

Initial - HSRP starts. The router moves on as soon as the interface is up and the config is read.

Listen - the router knows the virtual IP (because it is configured locally). It listens to Hellos to learn who else is in the group. If the virtual IP were not configured locally, it would pass through Learn first to discover the IP from a Hello.

Speak - after the active timer expires without hearing a higher-priority active router, the router starts sending Hellos and contests the election. Both routers in a new group reach Speak and exchange Hellos.

Standby / Active - the election resolves. The router with the higher priority (or higher IP, on a priority tie) becomes Active. The other becomes Standby.

What decides the election: priority and preemption

Two knobs control which router ends up Active.

This is the single most important HSRP behavior to internalize: without preempt, priority only matters at election time. If your intended-primary router reboots, the backup becomes Active, and when the primary comes back it sees an active router already and settles into Standby - even though it has the higher priority. It will not reclaim the Active role until you configure preempt.

Minimum config and the resulting states

! R1 - intended primary
interface GigabitEthernet0/0
 ip address 10.20.0.2 255.255.255.0
 standby version 2
 standby 10 ip 10.20.0.1
 standby 10 priority 110
 standby 10 preempt
!
! R2 - intended backup
interface GigabitEthernet0/0
 ip address 10.20.0.3 255.255.255.0
 standby version 2
 standby 10 ip 10.20.0.1
 standby 10 priority 100

After convergence: R1 reaches Active (priority 110), R2 reaches Standby (priority 100). Because R1 has preempt, if R1 ever reboots and comes back, it reclaims Active. R2 does not need preempt - it is never trying to take a role away from a higher-priority router.

Reading the state on IOS XE

The quick view across all groups:

R1# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State    Active          Standby         Virtual IP
Gi0/0       10   110 P Active   local           10.20.0.3       10.20.0.1

The detailed view, when you need timers and the why:

R1# show standby GigabitEthernet0/0 10
GigabitEthernet0/0 - Group 10 (version 2)
  State is Active
    8 state changes, last state change 02:14:51
  Virtual IP address is 10.20.0.1
  Active virtual MAC address is 0000.0c9f.f00a
  Hello time 3 sec, hold time 10 sec
  Preemption enabled
  Active router is local
  Standby router is 10.20.0.3, priority 100 (expires in 9.872 sec)
  Priority 110 (configured 110)

Three things to read:

• State is Active. The role this router is playing. Cross-check the partner shows Standby.
• state changes count. A high number that keeps climbing means the group is flapping - usually a tracked interface bouncing or a Hello/hold-timer mismatch.
• Standby router ... expires in N sec. A countdown that resets means Hellos are arriving. If it hits zero, the standby is declared dead and the group reconverges.

Interface tracking: states that change on purpose

HSRP would be nearly useless if it only failed over when a router died. The real value is failing over when a router loses its upstream path. Object tracking does this:

track 1 interface GigabitEthernet0/1 line-protocol
!
interface GigabitEthernet0/0
 standby 10 track 1 decrement 20

If R1's upstream interface Gi0/1 goes down, track object 1 fails, and R1's HSRP priority drops by 20 (from 110 to 90). Now R2 at priority 100 is higher. With preempt configured, R2 takes Active. R1 transitions Active to Speak to Standby. The state change you see in the logs is the visible symptom of a tracked uplink failing.

Common state problems

Key takeaways

HSRP has six states: Initial, Learn, Listen, Speak, Standby, Active. The healthy steady state is one Active, one Standby, and any extras in Listen. The election is decided by priority, and a higher-priority router only reclaims the Active role if preempt is configured - this is the single most common HSRP surprise. Interface tracking deliberately drops priority so a router that loses its uplink hands off gracefully. Read the live state with show standby brief, and watch the state-change counter for flapping.

For the FHRP cluster, see the FHRP pillar.