HSRP vs VRRP vs GLBP is not just a question about protocol names. The useful interview question is: which router forwards for the default gateway, what makes that responsibility move, and what happens when only the upstream path fails?
Short answer: HSRP uses an active/standby model for a group; VRRP elects an Active Router with Backup Routers for a virtual router; GLBP separates the active virtual gateway (AVG) from active virtual forwarders (AVFs), allowing multiple routers to forward for the same virtual IP through different virtual MAC addresses.[2][1][3]
HSRP vs VRRP vs GLBP: comparison table
The scope here is a conventional IPv4 LAN with redundant default gateways, not an EVPN distributed anycast gateway.
| Question | HSRP | VRRP | GLBP |
|---|---|---|---|
| Forwarding model | One active router for a group; standby takes over.[2] | One Active Router per virtual router, with backups.[1] | One AVG coordinates multiple AVFs.[3] |
| Higher-priority router takes back control automatically? | Not unless preemption is enabled.[2] | Preempt mode defaults to enabled; the address owner is a special case.[1] | AVG preemption defaults to disabled; forwarder preemption is separate and defaults to enabled.[3] |
| What tracking changes | Effective HSRP priority in the example below.[2] | Check the implementation's tracking features rather than assuming HSRP syntax. | Forwarder weighting, with lower/upper thresholds.[3] |
| Load sharing | Use multiple groups to assign different active gateways.[3] | Use multiple virtual routers to distribute gateway responsibilities.[1] | AVG supplies different virtual MACs in ARP replies for one virtual IP.[3] |
| Standards reference | Cisco HSRP documentation.[2] | IETF RFC 9568, which supersedes RFC 5798.[1] | Cisco GLBP documentation.[3] |
A practical selection rule: investigate VRRP first for a standards-based requirement, HSRP for an existing HSRP estate, and GLBP where one-VIP host distribution is actually useful. Check the exact hardware, software release and feature support before choosing.
Packet flow: what the host sees
Consider a fictional LAN: client 192.0.2.50/24, gateway VIP 192.0.2.1, router R1 at 192.0.2.2 and R2 at 192.0.2.3. These are documentation addresses; the walkthrough is illustrative, not an executed lab.
- The client needs a next-hop MAC address for its configured gateway and sends an ARP request.
- With HSRP, the active router owns the group's active virtual MAC; with VRRP, the Active Router answers ARP for the protected IPv4 address.[2][1]
- The client sends frames to that gateway MAC, while the gateway routes packets toward their IP destinations.
- If the active router fails, the standby/backup can take over the forwarding responsibility without requiring the host to be reconfigured with another default-gateway IP.[2][1]
GLBP changes the ARP step: the AVG answers requests for the same VIP using different virtual MAC addresses, and the corresponding AVFs forward traffic addressed to their assigned MACs.[3]
Do not describe GLBP as per-packet striping. Its documented host-distribution mechanism uses ARP replies; available methods include round-robin, weighted and host-dependent load balancing.[3]
Preemption is not the same as failure detection
HSRP preemption permits a higher-priority router to displace a still-operating lower-priority active router; tracking can reduce the active router's priority when a monitored object fails.[2]
Without preemption on the router that should take over, merely lowering the current active router's priority can leave it active.[2]
That is different from a complete active-router failure: the remaining router does not need preemption just to take over after the active router is declared down.[2]
For VRRP, preempt mode is enabled by default, and the address owner always preempts regardless of that flag.[1]
The VRRP address owner uses priority 255; ordinary backup routers use priorities below that owner value.[1]
For GLBP, distinguish two questions: who is AVG? and who forwards for this virtual MAC? Gateway election uses priority, whereas forwarding eligibility uses weighting; AVG preemption is disabled by default, while forwarder preemption is enabled with a default delay of 30 seconds.[3]
HSRP tracking example: the LAN is up, but the uplink is down
Here is an illustrative Cisco IOS/IOS XE-style configuration. Adapt interface names and verify command support on your image. Both routers need working upstream routes; this snippet only demonstrates first-hop behavior.
R1 is the preferred gateway with priority 110. R2 uses priority 100. The intended R1 tracking decrement is 20, producing effective priority 90 when its monitored uplink fails. These values are chosen for this example, not protocol defaults.
! R1: LAN on Gi0/0, monitored uplink on Gi0/1
track 10 interface GigabitEthernet0/1 line-protocol
!
interface GigabitEthernet0/0
ip address 192.0.2.2 255.255.255.0
standby 10 ip 192.0.2.1
standby 10 priority 110
standby 10 preempt
standby 10 track 10 decrement 20
!
! R2: same LAN, independent working upstream path assumed
interface GigabitEthernet0/0
ip address 192.0.2.3 255.255.255.0
standby 10 ip 192.0.2.1
standby 10 priority 100
standby 10 preempt
The configuration pattern follows Cisco's tracked-object and preemption mechanism.[2]
Expected process, assuming R1 is initially active:
| Event | Expected result in this example |
|---|---|
| Both paths healthy | R1 priority 110 is preferred over R2 priority 100. |
| R1 uplink line protocol fails | Track 10 goes down; R1 effective priority becomes 90. |
| R2 sees the lower-priority active router | R2 can preempt because its priority is higher and preemption is enabled. |
| R1 uplink recovers | R1 restores priority 110 and can preempt R2. |
These transitions use the same priority-decrement and preemption logic described in Cisco's example.[2]
Design recommendation: do not equate a live physical uplink with a working remote service. Where remote-path detection is required, evaluate a supported reachability-tracking mechanism such as IP SLA and carefully choose the probe source, target and route. Test that the probe cannot succeed through the backup path and incorrectly declare the preferred path healthy.
For recovery, evaluate supported preemption delays and tracking dampening so routing can settle before gateway responsibility moves back. Do not assume a generic delay setting delays every possible failure or recovery event identically.
Troubleshooting checklist
Use read-only checks first. These are Cisco-style verification commands, not claimed output from a running router:
show standby brief
show standby
show track 10
show ip route
show ip arp
show interfaces GigabitEthernet0/1
! For the alternative protocols, where supported:
show vrrp
show glbp
Cisco's HSRP example verifies the active/standby state, effective priority, preemption and tracked-object state; GLBP's guide uses its show output to distinguish gateway and forwarder details.[2][3]
| Symptom | What to check next |
|---|---|
| Both HSRP routers report active | Compare VLAN reachability, group, VIP, version, authentication settings and delivery of control packets. |
| Uplink failed but HSRP stayed on R1 | Confirm the track is down, attached to the right group, and lowers priority below R2; check preemption on R2.[2] |
| Recovery does not move traffic back | Compare restored priorities, preemption and configured delays.[2] |
| VIP responds but the application fails | Inspect upstream routes, return path, ACLs, NAT and application health separately. |
| GLBP AVG looks correct but some clients fail | Inspect each AVF, its MAC, weighting, tracking and forwarding path, not only the AVG.[3] |
| Frequent role changes | Correlate interface/track events and control-packet delivery before reducing timers further. |
Common interview traps
- “Tracking replaces preemption.” HSRP tracking changes priority; a healthy peer may still need preemption to displace the lower-priority active router.[2]
- “VRRP preemption is always optional.” The address owner is the exception and always preempts.[1]
- “GLBP priority and weighting mean the same thing.” Priority selects the AVG; weighting governs forwarder eligibility and can influence host distribution.[3]
- “Failover is exactly one hello interval.” VRRP's Active Down Interval includes multiple advertisement intervals and a priority-dependent skew, illustrating why a hello interval alone is not an outage guarantee.[1]
- “First-hop redundancy proves application resilience.” Treat gateway failover, routing convergence and stateful-service continuity as separate acceptance tests.
A concise interview answer
“HSRP and VRRP provide a redundant gateway with one forwarding router per group or virtual router, while GLBP can distribute hosts among multiple forwarders for one VIP.[2][1][3]
For HSRP, I explicitly check preemption and tracking: a failed uplink must reduce priority enough, and the peer must be allowed to take over.[2]
VRRP defaults to preemption, with special handling for the address owner.[1]
For GLBP, I separate AVG priority from AVF weighting.[3]
Then I test both complete-router failure and upstream-only failure, followed by recovery and actual application traffic.”
Related reading
- Access Port vs Trunk Port vs Native VLAN Explained
- STP Root Bridge Election Explained
- LACP EtherChannel: Active vs Passive, Link Limits and Load Balancing
Summary and practice
Remember the distinction: gateway ownership, preemption policy and upstream-health detection are separate decisions. For interview practice, draw a two-router LAN, predict the forwarding router after an uplink failure, and explain why the prediction changes when preemption is disabled. In an isolated lab, record the state, track status and real client traffic before failure, during failure and after recovery.
Preparing for a network engineering interview? Practice that explanation aloud, then prove it in your own lab rather than memorizing only the comparison table.
Post a Comment