In the Inter-VLAN Routing tutorial, we learned that every VLAN needs a default gateway to communicate with other VLANs or the internet. But an important question comes up: what happens if that router (or that one interface) fails? The entire VLAN loses access to everything outside itself — a dangerous single point of failure. HSRP (Hot Standby Router Protocol) is designed exactly to solve this.
How exactly does HSRP work?
HSRP is a Cisco-proprietary protocol that lets two or more routers act as a single virtual gateway. A shared virtual IP address and MAC address are defined across multiple routers; client computers know this virtual address as their default gateway — with no idea that multiple physical routers exist behind the scenes. At any given moment, one router plays the Active role (actually responding to traffic) while the other is Standby (on standby). If the Active router fails, the Standby router declares itself Active within seconds — completely transparently, with no need to change any settings on client computers.
This tutorial's scenario
Suppose we have two routers (R1 and R2), both connected to the same switch and the same VLAN, and we want to build a shared virtual gateway with the address 192.168.1.1.
Step 1: Configure HSRP on R1 (the primary router)
enable
configure terminal
interface fastEthernet 0/0
ip address 192.168.1.2 255.255.255.0
standby 1 ip 192.168.1.1
standby 1 priority 110
standby 1 preempt
exit
standby 1 ip specifies the shared virtual gateway address. standby 1 priority 110 specifies that this router should be Active (the default is 100; a higher number means higher priority to become Active). standby 1 preempt means if this router comes back healthy after a failure, it reclaims the Active role.
Step 2: Configure HSRP on R2 (the backup router)
enable
configure terminal
interface fastEthernet 0/0
ip address 192.168.1.3 255.255.255.0
standby 1 ip 192.168.1.1
standby 1 priority 90
exit
Here, a lower priority (90) is set so R2 stays in the Standby role by default, unless R1 becomes unavailable.
Step 3: Set the client default gateway
On all computers in this VLAN, the default gateway should be the shared HSRP virtual address, not the physical address of either router:
192.168.1.1
Step 4: Check HSRP status
show standby brief
On either router, this command shows which one is currently Active and which is Standby — and also displays the shared virtual IP and MAC address.
Step 5: Practical failover test
From a client computer, run a continuous ping to the internet or an external address (ping -t on Windows). Then, on R1 (the Active router), run the shutdown command on the interface to bring it down. You should see the ping drop only a few packets (a couple of seconds) before automatically continuing — because R2 has taken over the Active role.
Why is HSRP a critical CCNP skill?
In real enterprise networks, no critical network point (including the default gateway) should depend on a single physical device. HSRP (and similar protocols like VRRP and GLBP) provide exactly this kind of redundancy at Layer 3 — one of the core skills in designing a failure-resilient enterprise network, covered in my advanced Cisco courses.
Blog