HSRP High Availability: Configure Cisco HSRP Step-by-Step

Your hosts have exactly one default gateway address, and if the router holding it dies, every host on the segment is offline until someone notices. HSRP (Hot Standby Router Protocol) fixes this by letting two routers share one virtual gateway: a virtual IP and a virtual MAC that follow whichever router is currently active. This guide builds a complete HSRP deployment with interface tracking on IOS XE, breaks it on purpose, and shows the failover happening in real captured output.

HSRP is one of three first-hop redundancy protocols; the family comparison (HSRP vs VRRP vs GLBP) lives in the FHRP complete guide. For the minimal config reference, see HSRP configuration; this article goes deeper into the design and the failure behavior.

The lab

Two routers on a user LAN, each with its own uplink toward the core. The virtual gateway is 10.50.100.1; the routers' real addresses are .2 and .3. A host (10.50.100.50) uses the virtual IP as its default gateway and never learns the real ones.

The configuration

R1, the router you want winning the election:

track 1 interface Ethernet0/0 line-protocol
!
interface Ethernet0/1
 ip address 10.50.100.2 255.255.255.0
 standby version 2
 standby 1 ip 10.50.100.1
 standby 1 priority 110
 standby 1 preempt
 standby 1 track 1 decrement 20

R2 needs only the group, the VIP, and preempt (priority stays at the default 100):

interface Ethernet0/1
 ip address 10.50.100.3 255.255.255.0
 standby version 2
 standby 1 ip 10.50.100.1
 standby 1 priority 100
 standby 1 preempt

Every line here earns its place:

• standby version 2 before anything else. HSRPv2 supports more groups, faster timers, and IPv6, and its virtual MAC range (0000.0C9F.Fxxx) differs from v1, so the two versions do not interoperate. Set v2 on both routers or they will not see each other.
• priority 110 vs 100: higher priority wins the active role. Leave the standby at the default and give the intended active router a deliberate bump.
• preempt on both. Without preempt, a recovered router with better priority sits in standby forever; HSRP does not preempt by default. Put it on both routers so role assignment always follows priority, not boot order.
• track 1 decrement 20: the modern object-tracking form. Track object 1 watches the uplink's line protocol; if it goes down, R1's priority drops by 20 (110 to 90), below R2's 100, and R2 preempts. The legacy standby 1 track Ethernet0/0 30 direct-interface syntax still parses on some platforms, but object tracking is the current method and can also track routes, SLA probes, and boolean combinations of them.

Why decrement 20? Because it has to be bigger than the priority gap (10). A decrement smaller than the gap changes the number but not the outcome, and the failure it was supposed to catch takes the LAN down anyway. Size the decrement to the gap, always.

Verifying the steady state

R1# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Et0/1       1    110 P Active  local           10.50.100.3     10.50.100.1

R1# show standby Ethernet0/1
Ethernet0/1 - Group 1 (version 2)
  State is Active
    2 state changes, last state change 00:01:04
  Virtual IP address is 10.50.100.1
  Active virtual MAC address is 0000.0c9f.f001 (MAC In Use)
    Local virtual MAC address is 0000.0c9f.f001 (v2 default)
  Hello time 3 sec, hold time 10 sec
  Preemption enabled
  Active router is local
  Standby router is 10.50.100.3, priority 100 (expires in 10.368 sec)
  Priority 110 (configured 110)
    Track object 1 state Up decrement 20

R1# show track 1
Track 1
  Interface Ethernet0/0 line-protocol
  Line protocol is Up
    1 change, last change 00:01:44
  Tracked by:
    HSRP Ethernet0/1 1

From the host's perspective, the gateway is just an IP with a MAC behind it. Watch what the host actually resolves:

H1$ ip neigh show 10.50.100.1
10.50.100.1 dev eth0 lladdr 00:00:0c:9f:f0:01 REACHABLE

The host's ARP entry points at the virtual MAC, not at either router's real MAC. That is the entire trick: during a failover the MAC the host knows stays valid, it just starts being answered by different hardware. No ARP timeout, no host-side change, no waiting.

A packet capture on the host makes the asymmetry visible. Traffic toward the gateway targets the virtual MAC; the replies come back from the active router's real MAC:

H1$ tshark -i eth0 -f icmp -T fields -e eth.src -e eth.dst -e ip.src -e ip.dst
52:54:00:33:43:ad  00:00:0c:9f:f0:01  10.50.100.50  10.255.3.3     <- toward the vMAC
aa:bb:cc:00:14:10  52:54:00:33:43:ad  10.255.3.3    10.50.100.50   <- reply from R1's real MAC

Breaking it: the failover

Now the part that justifies the whole design. R1's uplink goes down (simulated with a shutdown in the lab). Watch the chain fire in R1's log:

*Aug 24 00:48:13.227: %TRACK-6-STATE: 1 interface Et0/0 line-protocol Up -> Down
*Aug 24 00:48:14.412: %HSRP-5-STATECHANGE: Ethernet0/1 Grp 1 state Active -> Speak
*Aug 24 00:48:26.275: %HSRP-5-STATECHANGE: Ethernet0/1 Grp 1 state Speak -> Standby

One second after the track object fell, R1 surrendered the active role. Its view now:

R1# show standby brief
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Et0/1       1    90  P Standby 10.50.100.3     local           10.50.100.1

R1# show standby Ethernet0/1 | include State|Priority|Track
  State is Standby
  Priority 90 (configured 110)
    Track object 1 state Down decrement 20

Priority 110 minus decrement 20 is 90; R2's 100 wins and R2 preempts into the active role:

R2# show standby brief
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Et0/1       1    100 P Active  local           10.50.100.2     10.50.100.1

R2# show logging | include HSRP
*Aug 24 00:48:14.410: %HSRP-5-STATECHANGE: Ethernet0/1 Grp 1 state Standby -> Active

And the host, which changed nothing, keeps working through R2 (the ttl 254 says the reply now takes one extra router hop):

H1$ ping -c 4 10.255.3.3
64 bytes from 10.255.3.3: icmp_seq=1 ttl=254 time=7.61 ms
64 bytes from 10.255.3.3: icmp_seq=2 ttl=254 time=3.97 ms
4 packets transmitted, 4 received, 0% packet loss

When the uplink recovers, preempt returns the active role to R1 automatically:

*Aug 24 00:49:01.059: %TRACK-6-STATE: 1 interface Et0/0 line-protocol Down -> Up
*Aug 24 00:49:02.813: %HSRP-5-STATECHANGE: Ethernet0/1 Grp 1 state Standby -> Active

Why track the uplink at all

Because the failure HSRP handles by itself (the active router dying) is not the common one. The common failure is the active router staying perfectly healthy on the LAN while its path to the rest of the network breaks. Without tracking, R1 keeps answering the virtual MAC and forwards every host's traffic into a dead uplink: a black hole with a green status LED. We reproduced exactly that in the lab before adding the track: the uplink was cut, HSRP stayed Active, and host pings died at 100% loss while both routers reported healthy HSRP states.

Line-protocol tracking catches the link-down case. For failures further upstream (the link stays up but the path beyond it is gone), track reachability instead: track 2 ip route 10.255.3.3 255.255.255.255 reachability tied to the IGP, or an IP SLA probe. If your uplink is Ethernet to a switch, prefer route or SLA tracking; an Ethernet port happily stays up while everything behind it burns.

Design notes that save tickets

• Timers: HSRPv2 defaults are 3s hello / 10s hold, so a silent active-router death takes up to 10 seconds to detect (tracked failures are much faster, as the captures show). Timers can go sub-second, but tune them only with a reason; aggressive timers plus a busy CPU cause false failovers.
• Authentication: HSRP will accept a rogue high-priority speaker into the group. MD5 authentication (standby 1 authentication md5 key-string ...) belongs on any segment where you do not control every attached device.
• Make the HSRP active router the STP root on switched segments, so traffic does not cross the inter-switch link twice on its way to the gateway.
• One group is one gateway. Multiple VLANs mean multiple groups; alternate the priorities per VLAN across the router pair and both boxes carry traffic instead of one idling.

Key takeaways

HSRP puts a virtual IP and virtual MAC in front of two routers so hosts never notice a gateway failure. Version 2, deliberate priorities, preempt on both routers, and object tracking with a decrement larger than the priority gap: that is the whole recipe. Tracking is not optional; without it, an uplink failure turns your redundant gateway into a reachable black hole. And every claim above is reproducible: the captures came from a two-router CML lab you can rebuild in ten minutes.

For the protocol family context and VRRP/GLBP alternatives, head back to the FHRP complete guide.