HSRP (Hot Standby Router Protocol) is Cisco’s proprietary First Hop Redundancy Protocol, designed for transparent failover of the first-hop device hosts use as their default gateway. It lets two or more routers share one virtual IP and virtual MAC address, as covered mechanically in the router redundancy article, with exactly one router actively forwarding traffic at any given moment while the rest wait in standby.
This guide walks through the actual configuration, using a consistent two-router topology throughout.
The Topology
Two routers, Router2 and Router3, both connect to the 192.168.10.0/24 network and both have a route toward 172.16.10.0/24, representing an ISP or upstream network. Only one of the two routers will actively forward traffic for the local network at any given time, using a shared virtual IP address of 192.168.10.1.
Every host on the 192.168.10.0/24 segment gets configured with 192.168.10.1 as its default gateway — never either router’s individual physical interface address.
A detail worth being explicit about: HSRP does not replicate routes between group members. Router2 and Router3 each need their own independent route toward 172.16.10.0/24 — typically a default route pointing to the ISP or upstream device — configured separately on both routers. HSRP only handles which router hosts on the local segment actually send traffic to; it has no effect on how that router then routes the traffic onward.
Basic HSRP Configuration
Configuration on Router2:
Router2> enable
Router2# configure terminal
Router2(config)# interface gigabitEthernet 0/1
Router2(config-if)# no shutdown
Router2(config-if)# ip address 192.168.10.2 255.255.255.0
Router2(config-if)# standby 1 ip 192.168.10.1
Router2(config-if)# exit
Router2(config)# do wrConfiguration on Router3:
Router3> enable
Router3# configure terminal
Router3(config)# interface gigabitEthernet 0/1
Router3(config-if)# no shutdown
Router3(config-if)# ip address 192.168.10.3 255.255.255.0
Router3(config-if)# standby 1 ip 192.168.10.1
Router3(config-if)# exit
Router3(config)# do wrThe 1 in standby 1 ip is the HSRP group number. In HSRP version 1, this can be any number from 0 to 255; the only requirement is that every router in the same group uses the same number. HSRP version 2 extends this range to 0-4095 and also supports IPv6.
Verifying the Configuration
Router2# show standby
Router3# show standbyBoth commands display the group’s virtual IP address, virtual MAC address, and each router’s current state (Active or Standby). With no priority configured, both routers default to priority 100, so the tiebreaker falls to the highest configured IP address on the interface — in this topology, that’s Router3 (192.168.10.3 beats Router2’s 192.168.10.2), which is why Router3 comes up Active.
Every host on 192.168.10.0/24 sees the same thing regardless of which physical router is active: default gateway 192.168.10.1, resolving via ARP to HSRP’s virtual MAC address.
Controlling Which Router Becomes Active: Priority
Leaving the election to the default-priority IP tiebreak works, but it’s rarely what you actually want in production — you typically want a specific, deliberately-chosen router to be active. The priority command controls this directly:
Router2(config)# interface gigabitEthernet 0/1
Router2(config-if)# standby 1 priority 110
Router2(config-if)# exit
Router2(config)# do wrHigher priority wins. Router2 now has priority 110 versus Router3’s default of 100 — but Router2 stays in standby after this change. Configuring a higher priority on its own does not force an immediate role change on a router that’s already active elsewhere; it only affects future elections. This is exactly the scenario preemption is designed to address.
HSRP Preempt
Without preemption, once a router is active, it stays active — even after a higher-priority router comes online or recovers from a failure. If Router3 fails and Router2 takes over, then Router3 recovers, Router3 does not automatically reclaim the active role by default. Router2 simply keeps forwarding.
To make a specific router always reclaim the active role whenever it’s available and has the highest priority, enable preemption on it:
Router2(config-if)# standby 1 preemptSince Router2 already has the higher priority (110) configured from the previous step, enabling preemption here triggers an immediate role change, because Router3’s priority (100) is now lower:
%HSRP-6-STATECHANGE: GigabitEthernet0/1 Grp 1 state Standby -> ActiveRouter2 becomes active immediately, without needing Router3 to fail first — preemption evaluates priority the moment it’s enabled, not just after a future failure event.
Load Balancing with Multiple HSRP Groups
A single HSRP group always leaves one router completely idle — it only ever forwards if the active router fails. Running multiple HSRP groups on the same pair of routers lets both routers actively forward traffic simultaneously, each for a different group of hosts.
Add a second group (Group 2) using virtual IP 192.168.10.250, still on the same 192.168.10.0/24 subnet as Group 1, and make Router3 active for it instead of Router2:
Full configuration on Router2:
Router2> enable
Router2# configure terminal
Router2(config)# interface gigabitEthernet 0/1
Router2(config-if)# ip address 192.168.10.2 255.255.255.0
Router2(config-if)# standby 1 ip 192.168.10.1
Router2(config-if)# standby 1 priority 110
Router2(config-if)# standby 1 preempt
Router2(config-if)# standby 1 name Group1
Router2(config-if)# standby 2 ip 192.168.10.250
Router2(config-if)# standby 2 name Group2
Router2(config-if)# exit
Router2(config)# exit
Router2# write memoryFull configuration on Router3:
Router3> enable
Router3# configure terminal
Router3(config)# interface gigabitEthernet 0/1
Router3(config-if)# ip address 192.168.10.3 255.255.255.0
Router3(config-if)# standby 1 ip 192.168.10.1
Router3(config-if)# standby 1 name Group1
Router3(config-if)# standby 2 ip 192.168.10.250
Router3(config-if)# standby 2 priority 110
Router3(config-if)# standby 2 preempt
Router3(config-if)# standby 2 name Group2
Router3(config-if)# exit
Router3(config)# exit
Router3# write memoryThe Group2 virtual IP, 192.168.10.250, has to sit on the same 192.168.10.0/24 subnet as the hosts using it as their gateway — a virtual IP on a different subnet entirely couldn’t function as a valid default gateway for those hosts at all.
The group names (Group1, Group2) are optional but useful for keeping track of which group is which once a topology has more than one or two HSRP groups running.
Result: Router2 is active for Group1 (priority 110, preempt) and standby for Group2. Router3 is standby for Group1 and active for Group2 (priority 110, preempt). Hosts using 192.168.10.1 as their gateway route through Router2; hosts using 192.168.10.250 route through Router3 — both physical routers are now actively forwarding traffic under normal conditions, rather than one sitting completely idle.
To test this, run a traceroute to 172.16.10.1 from a host in each group. Hosts configured with gateway 192.168.10.1 (Group1) should show Router2 as their first hop; hosts configured with gateway 192.168.10.250 (Group2) should show Router3 — confirming both routers are genuinely carrying traffic, not just configured to.
Common HSRP Configuration Mistakes
- Virtual IP on the wrong subnet. Every HSRP group’s virtual IP must sit on the same subnet as the hosts using it as a gateway. A virtual IP configured on a different subnet than the interface’s actual IP address won’t function as a usable gateway at all, and Cisco IOS will typically reject the configuration outright if the mismatch is severe enough.
- Mismatched group numbers or HSRP versions across routers. Every router intended to participate in the same group needs the same group number and the same HSRP version. A version mismatch (one router on v1, another on v2) means the two routers won’t even see each other’s hello packets, since the multicast addresses differ between versions.
- Forgetting that priority alone doesn’t force a takeover. As covered above, raising priority on a standby router does nothing to an already-active peer unless preemption is also enabled. This is one of the most common points of confusion when first configuring HSRP.
- Assuming HSRP replicates routing information. It doesn’t. Each router needs its own complete, independently functioning route toward the rest of the network — HSRP’s only job is arbitrating which router the local segment’s hosts actually send traffic to.
- Skipping verification after configuration changes.
show standby briefgives a fast, compact view of every group’s state across an interface, and is worth running after any priority or preempt change to confirm the election actually happened the way you expect, rather than assuming based on the configuration alone.
Frequently Asked Questions
What is HSRP and what problem does it solve?
HSRP is Cisco’s proprietary First Hop Redundancy Protocol. It lets two or more routers share a single virtual IP and MAC address, with one router actively forwarding at a time. Hosts configure the virtual IP as their default gateway, so a router failure doesn’t require any host reconfiguration — the underlying mechanism is covered in detail here.
How does HSRP decide which router becomes active?
Priority first — highest wins, default is 100 on every router. If priorities are tied, the router with the highest configured IP address on the HSRP interface becomes active. Priority is set with standby [group] priority [value].
Why doesn’t a router become active immediately after I raise its priority?
Increasing priority alone only affects future elections, not a router that’s already active elsewhere. To force an immediate takeover based on the new priority, or to guarantee automatic takeover after any future recovery, enable preemption with standby [group] preempt.
How does HSRP load balancing actually work?
A single HSRP group only ever has one active router; the rest of the group sits idle until a failure. Running multiple HSRP groups, each with a different virtual IP and a different router configured as active (via priority and preempt), lets both routers forward traffic simultaneously — each router active for a different group of hosts, both idle for the other group’s traffic if needed.
What’s the difference between HSRP version 1 and version 2?
HSRP v1 supports group numbers 0-255 and IPv4 only. HSRP v2 extends the group number range to 0-4095, supports IPv6, and uses a different virtual MAC address format and multicast address than v1. The two versions are not directly interoperable within the same group, so all routers in a group must run the same version.
Do HSRP routers need to individually know how to route outbound traffic?
Yes. HSRP only handles which router hosts on the local segment send traffic to — it doesn’t replicate routing information between group members. Each router in the group needs its own independently configured route (commonly a default route) toward whatever network is beyond the local segment, regardless of which router is currently active for HSRP.
Conclusion
HSRP’s basic configuration is deliberately simple — a shared virtual IP is all it takes to get a working group running. The nuance is entirely in priority and preemption: which router becomes active by default, and whether a recovered or newly-configured higher-priority router actually takes over or just waits. Running multiple HSRP groups on the same router pair turns that simplicity into real load distribution, with both routers doing useful work under normal conditions instead of one sitting idle until the other fails.
