A gateway that never dies: HSRP, VRRP and DHCP relay
Lesson 2 of 4
2A gateway that never dies: HSRP, VRRP and DHCP relay
The big pictureA PC knows just one gateway, the one DHCP gave it. If that gateway is a single real router, its failure cuts the whole floor off from the world, however many spare routers you own. The fix is clever: a virtual address no one device owns, held by the active router and moved to the standby in seconds without the PC ever knowing.
What the picture shows: The two routers swap hellos. When the active one's hellos stop, the standby adopts the virtual IP and the virtual MAC with it, so the devices' ARP tables stay right.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Think of a customer-service number: one fixed number, but whoever answers may sit in Riyadh or in Jeddah. If Riyadh is away, the call goes to Jeddah and the number you dialled never changes. HSRP and VRRP do that for the gateway: one fixed address, two routers behind it. DHCP relay is like a receptionist: a guest shouts in the hall "I need an address!" and the receptionist carries the request to the office next door.
HSRP (Cisco): hello every 3 s and hold after 10, default priority 100 and the highest becomes Active, with preemption off by default. The version 1 virtual MAC is 0000.0c07.acXX. VRRP (a standard, RFC 5798): an advert every second, preemption on by default, MAC 0000.5e00.01XX. Tie the design together: the active router for VLAN 10 is also the STP root for VLAN 10, so traffic takes the shortest road. A DHCP request is a four-step broadcast (Discover, Offer, Request, Ack over UDP 67/68) that does not cross a router, so a relay agent set with ip helper-address picks it up, sends it unicast to the server and writes its interface address into giaddr so the server picks the right pool.
Before You Start
🔁STP and EtherChannel
The previous lesson: the root and port roles.
🗺️Routing
You know the default gateway and a router's job.
The Core Idea
1A virtual address held by two routers
Each VLAN gets three addresses: one per real router and a third virtual one, the gateway DHCP hands to devices. The router with the higher priority becomes Active and answers ARP for the virtual address with a virtual MAC. The other, Standby, listens. If hellos are missing for the hold time, the standby takes over and sends a gratuitous ARP to update the switches.
interface vlan 10 ip address 10.10.10.2 255.255.255.0 standby version 2 standby 10 ip 10.10.10.1 standby 10 priority 110 standby 10 preempt ! R2: the same lines with 10.10.10.3 and priority 100
2Priority and preemption: who comes back after the repair?
When R1 comes back after a repair, does it take its role back? Only if preemption is on. In HSRP it is off by default, so R2 stays active until you step in. You can also tie the priority to the internet link (tracking): if R1's uplink drops, its priority falls by 20 and R2 takes over even though R1 is still running.
Compare the two runs: without preemption R2 stays active even after R1 is fixed, and tracking does nothing.
def active(routers, preempt, current=None):
alive = {name: prio for name, (prio, up) in routers.items() if up}
if not alive:
return None
best = max(alive, key=alive.get)
if current in alive and not preempt:
return current # no preemption: whoever holds it keeps it
return best
events = [
("start", {"R1": (110, True), "R2": (100, True)}),
("R1 crashes", {"R1": (110, False), "R2": (100, True)}),
("R1 repaired", {"R1": (110, True), "R2": (100, True)}),
("R1 uplink down -20", {"R1": (90, True), "R2": (100, True)}),
]
for preempt in (False, True):
holder = None
print("preempt" if preempt else "no preempt")
for what, routers in events:
holder = active(routers, preempt, holder)
print(f" {what:<20} active = {holder}")3DHCP crosses the router: relay and giaddr
In a company one DHCP server in the data centre serves every branch. But a DHCP request is a broadcast, and routers do not pass broadcasts. The fix is one command on the VLAN interface: ip helper-address turns the broadcast into a message aimed at the server and writes the interface address into giaddr, so the server knows the client sits in 10.10.10.0/24 and hands out an address from it.
4DHCP snooping: refuse a rogue server
Any device can claim to be a DHCP server and hand people a fake gateway their traffic flows through. DHCP snooping on the switch splits ports into trusted towards the router and server and untrusted towards devices, and any Offer arriving on an untrusted port is dropped. It also builds a table (MAC, IP, port) that other guards such as Dynamic ARP Inspection rely on.
ip dhcp snooping ip dhcp snooping vlan 10,20 interface te1/1/1 ! uplink towards the routers ip dhcp snooping trust
Worked example
The task: a branch with VLAN 10 for staff, VLAN 20 for voice, and two routers. Design the gateways so both routers work and service survives if one fails.
The answer: VLAN 10: virtual gateway 10.10.10.1, R1 priority 110 with preempt and STP root for VLAN 10, R2 priority 100. VLAN 20: the reverse, R2 active and root. On both routers ip helper-address towards the DHCP server, and uplink tracking lowers priority by 20. On the switches DHCP snooping with the router-facing ports trusted. The test: pull R1 and time how long a live call breaks (expect under 10 seconds with default timers, under a second with tuned ones).
Myth vs Reality
| Myth | Reality |
|---|---|
| Two routers in the network means automatic backup. | Without an FHRP every device is stuck on the gateway DHCP gave it, even with a healthy router next to it. |
| HSRP hands the role back to the original router after a repair. | Only with preempt on; it is off by default in HSRP and on in VRRP. |
| DHCP only works if the server is on the same network. | Relay with helper-address lets one server serve hundreds of networks. |
Where you meet it at work
🏦Bank branches
Two routers per branch with HSRP, and a central DHCP server through relay.
📞Voice network
Preemption and short timers let a call survive a router failure.
🛡️Layer 2 security
DHCP snooping is the first barrier against a rogue server in a meeting room.
Test your understanding
Which address do devices get as their gateway with HSRP?
Devices only know the virtual one, so it moves between routers without them knowing.
R1 (priority 110) is back after a fault, R2 (100) is active, preemption off. Who is active?
Without preemption the higher priority does not take the role back.
Why does DHCP need a relay between networks?
The PC has no address yet, so it broadcasts, and broadcasts stop at the router.
What is the giaddr field for?
The server picks the pool matching the interface address in giaddr.
Which guard drops a DHCP offer arriving on a staff port?
Device ports are untrusted, so offers from them are dropped.
Quick review cards
Check Your Understanding
Why make the active router the STP root for the same VLAN?
So traffic goes from the switch to the gateway on the shortest road, with no extra hop over the inter-switch link.
Why do devices not need to refresh ARP when the gateway moves?
Because the MAC is virtual too and moves with the IP, and the standby sends a gratuitous ARP so the switch learns the new port.
After R1 failed no new device gets an address. What is the likely cause?
helper-address sits on R1 only; put it on R2 as well.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.