Hot Standby Router Protocol or HSRP is a Cisco proprietary first hop redundancy protocol that is used to configure default gateway redundancy. With HSRP (like other gateway redundancy protocols), two or more routers can achieve default gateway failover in the event that the primary gateway fails or becomes inaccessible.
In this article, we will focus on a specific aspect of HSRP: the different states that routers participating in the protocol go through.
We’ll explore how these states support the overall functioning of HSRP. Additionally, we’ll cover some useful commands for troubleshooting and verifying HSRP configurations.
Remember, HSRP can be configured on the interfaces of any Layer 3 device that act as a default gateway, whether they are physical router interfaces, SVIs on a Layer3 switch, a router’s sub-interface, or a routed port on a switch. For the purposes of this article, we will be referring to these Layer 3 devices as router.
Understanding the Cisco HSRP states
HSRP defines several states that routers go through to maintain default gateway redundancy. Each state reflects a specific phase in the protocol’s operation, helping to determine the role and status of each router in the HSRP group.
For an article about configuring HSRP on Cisco routers have a look at my article here.
Below are the six HSRP states with a brief explanation of each:
Initial State
This is the starting state for an HSRP router when it first joins the network or when HSRP is enabled on an interface. In this state, the router has not yet determined the state of the HSRP group. The router is simply initializing and awaiting further configuration or information to participate in HSRP.
Learn State
The router does not yet know the virtual IP address of the HSRP group. It is listening for Hello messages from active routers to learn the virtual IP address and other HSRP parameters.
This state allows the router to gather the necessary information from the active router, such as the virtual IP and MAC addresses, before it can participate fully in the redundancy process.
Listen State
In this state, the router has learned the virtual IP address but is not currently the active or standby router.
It listens for Hello messages from the active and standby routers to stay informed about their status. Routers in the listen state are ready to take over if the active or standby routers fail, but they are not in a position to do so unless a failure occurs.
Speak State
In this state, the router sends Hello messages and participates in the election process to determine which router will become the active or standby router.
During this time, it is actively trying to establish its role within the group. This state is part of the decision-making process where routers “speak” by sending Hello packets and prepare to take on a more critical role (either active or standby).
Standby State
The router is prepared to take over as the active router if the current active router fails. It is second in priority and constantly monitors the health of the active router.
This state ensures that there is a backup router (standby router) ready to become the active router if necessary. The standby router sends and receives Hello messages but does not forward traffic unless the active router fails.
Active State
The router currently forwards traffic for the HSRP group. It is the designated active router and holds the virtual IP address and virtual MAC address for the group.
This router is responsible for handling traffic destined for the virtual gateway. The active router sends periodic Hello messages to the standby and other routers to indicate that it is still functioning.
HSRP State Transitions
HSRP routers will transition from state to state to participate and fulfil their roles within the HSRP deployment. The following summarizes these transitions:
- Initial → Learn: The router starts by learning the HSRP configuration from other HSRP-configured devices, including the virtual IP address.
- Learn → Listen: After learning the virtual IP address, the router listens for active and standby routers.
- Listen → Speak: The router sends Hello messages and begins the election process to potentially become the active or standby router.
- Speak → Standby/Active: Based on the election, the router becomes either the active or standby router. If the active router fails, the standby router transitions to the active state.
Failover Process:
If the active router fails to send Hello messages (based on the configured timers), the standby router transitions to the active state, adopts the virtual IP and MAC addresses, and begins forwarding traffic.
A new standby router is then elected from the routers in the Listen or Speak states. This process ensures minimal disruption to traffic flow during router failures.
Please have in mind here that in order for the HSRP to work properly, we need to have a layer 2 connection between the two routers in the HSRP group.
Troubleshooting HSRP with Cisco Commands
Knowing and understanding the HSRP states is a vital part of being able to implement as well as troubleshoot an HSRP deployment.
Learning the commands used to display this information is also an important part of troubleshooting and verifying an HSRP deployment.
The following sections describe some of the fundamental commands that can be used, along with a brief description of the observed output.
Verifying an HSRP configuration
The following commands can be used to verify an HSRP configuration.
show standby
The show standby command on a Cisco device provides detailed information about the current HSRP configuration and the status of the routers in an HSRP group.
Depending on the number of HSRP groups, this command may generate a lot of output. The following is an example output of this command issued on a Layer 3 switch, where two SVIs have been configured as part of two different HSRP groups.
Switch# show standby
Vlan10 – Group 1
State is Active
3 state changes, last state change 00:00:19
Virtual IP address is 192.168.1.1
Active virtual MAC address is 0000.0C07.AC01
Local virtual MAC address is 0000.0C07.AC01 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 2.928 secs
Preemption enabled
Active router is local
Standby router is 192.168.1.2, priority 100 (expires in 8.896 sec)
Priority 110 (configured 110)
Group name is “hsrp-Vl10-1” (default)
Vlan20 – Group 2
State is Standby
2 state changes, last state change 00:02:45
Virtual IP address is 192.168.2.1
Active virtual MAC address is 0000.0C07.AC02
Hello time 3 sec, hold time 10 sec
Next hello sent in 1.940 secs
Preemption enabled
Active router is 192.168.2.3, priority 120 (expires in 8.896 sec)
Standby router is local
Priority 100 (default 100)
Group name is “hsrp-Vl20-2” (default)
You can see the details of how HSRP has been configured for each SVI, as well as the current state, the virtual IP and MAC addresses, as well as various other HSRP parameters.
show standby brief
The show standby brief command provides a more concise overview of the HSRP configuration and status on a Layer 3 device.
It displays key information about each HSRP group in a summarized format. The following is an example of the output of such a command on a Layer 3 switch where four SVIs have been configured as members of HSRP groups:
Switch# show standby brief
Interface Grp Pri P State Active Standby Virtual IP
Vlan10 1 110 P Active Local 192.168.1.2 192.168.1.1
Vlan20 2 100 Standby 192.168.2.3 Local 192.168.2.1
Vlan30 3 120 P Active Local 192.168.3.2 192.168.3.1
Vlan40 4 90 Listen 192.168.4.2 192.168.4.3 192.168.4.1
From the above output, you can see which SVI is currently in active status, which is in standby, and what the virtual IP addresses are. You can also see the IP address of the current active and standby routers for each HSRP group.
Note that the brief keyword can be appended to any of the verification commands indicated here resulting output similar to the tabular format above.
show standby [interface] command
The show standby [interface] command provides detailed information about the HSRP configuration and status on a per interface basis. Here’s an example of the output from the command for interface GigabitEthernet0/1 on a router:
Router# show standby GigabitEthernet0/1
GigabitEthernet0/1 – Group 1
State is Active
4 state changes, last state change 00:02:10
Virtual IP address is 192.168.1.1
Active virtual MAC address is 0000.0C07.AC01
Local virtual MAC address is 0000.0C07.AC01 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 1.124 secs
Preemption enabled, delay min 0 sec
Active router is local
Standby router is 192.168.1.2, priority 100 (expires in 7.896 sec)
Priority 110 (configured 110)
IP redundancy name is “hsrp-Gi0/1-1” (default)
The above output shows the HSRP parameters and operational state of that particular interface.
show standby [group] command
The show standby [group] command provides detailed information about the HSRP configuration and status on a per group basis. Here’s an example of the output from the command for group 1 on a switch:
Router# show standby group 1
Vlan10 – Group 1
State is Active
3 state changes, last state change 00:00:25
Virtual IP address is 192.168.1.1
Active virtual MAC address is 0000.0C07.AC01
Local virtual MAC address is 0000.0C07.AC01 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 0.876 secs
Preemption enabled, delay min 0 sec
Active router is local
Standby router is 192.168.1.2, priority 100 (expires in 9.324 sec)
Priority 110 (configured 110)
IP redundancy name is “hsrp-Vl10-1” (default)
Much the same information is displayed, but based on group number this time.
Verifying Interface Status (show ip interface brief)
One of the things that is often done to help verify configurations is using the show ip interface brief command.
This command will show you the IP addresses of all of the physical interfaces, as well as any SVIs in a L3 switch or router device.
In the context of HSRP, it shows you the assigned IP addresses and not the virtual IP addresses. This will help in identifying the interfaces that are acting as active or passive routers as seen in the above output. An example of the output of this command can be found here:
Switch# show ip interface brief
Interface IP-Address OK? Method Status Protocol
Vlan10 192.168.1.2 YES manual up up
Vlan20 192.168.2.2 YES manual up up
Vlan30 192.168.3.2 YES manual up up
!
!–< Output Omitted >–
!
Loopback0 10.1.1.1 YES manual up up
From the above output, you can see that the 192.168.1.2 address belongs to VLAN 10 SVI. Looking at the output of the standby commands above, you can see where that IP address appears to understand if that SVI is acting as an active router, or a passive router, and which is the virtual IP address that the interface has adopted.
Troubleshooting HSRP issues with debug commands
The following debug commands can aid in dealing with problems resulting from HSRP authentication as well as general HSRP synchronization and communication faults.
debug standby events
This command will print debug information about all HSRP events. These can be helpful in troubleshooting as well as observing the HSRP process. An example of some output that results from this debug command can be seen below:
Switch# debug standby events
HSRP event debugging is on
*Mar 12 12:01:12.567: HSRP: Vlan10 Grp 1 Active -> Speak
*Mar 12 12:01:12.567: HSRP: Vlan10 Grp 1 Hello timer expired, current state Active
*Mar 12 12:01:12.569: HSRP: Vlan10 Grp 1 Sending Hello (active), vIP 192.168.1.1
*Mar 12 12:01:13.571: HSRP: Vlan10 Grp 1 Standby router 192.168.1.2 is now Active
*Mar 12 12:01:15.572: HSRP: Vlan10 Grp 1 Active router is local
*Mar 12 12:02:10.643: HSRP: Vlan20 Grp 2 Standby -> Active
*Mar 12 12:02:10.644: HSRP: Vlan20 Grp 2 Hello timer expired, current state Standby
*Mar 12 12:02:10.645: HSRP: Vlan20 Grp 2 Sending Hello (standby), vIP 192.168.2.1
*Mar 12 12:02:13.647: HSRP: Vlan20 Grp 2 Active router 192.168.2.3 is now down, assuming Active role
*Mar 12 12:02:15.649: HSRP: Vlan20 Grp 2 Active router is local
Some noteworthy events include:
- HSRP: Vlan10 Grp 1 Active -> Speak – This indicates that the HSRP state for group 1 on VLAN 10 transitioned from Active to Speak.
- HSRP: Vlan10 Grp 1 Hello timer expired, current state Active – This log entry shows that the Hello timer expired, meaning the router hasn’t received Hello packets from other HSRP routers, prompting it to continue its operation as the active router.
- HSRP: Vlan20 Grp 2 Standby -> Active – In this event, the HSRP state for group 2 on VLAN 20 transitioned from Standby to Active.
Additional debug parameters
The above command allows you to see all HSRP related debugs. However, you may want to zero in on a particular type of HSRP debug logging. To do so, you can use the following additional keywords:
- debug standby events: Provides information about key HSRP events such as state transitions (Active, Standby, Listen, etc.).
- debug standby packets: Displays information about HSRP packets, including Hello messages sent and received, which is useful for analyzing packet-level issues.
- debug standby errors: Shows error messages related to HSRP, helping you pinpoint specific issues within the HSRP operation.
Final Words
HSRP is an extremely useful and versatile feature that is vital for networks where first hop reliability and availability are crucial.
Knowing the various states used by the protocol as well as the show and debug commands associated with it will aid in deploying and troubleshooting HSRP implementations of all types.