UK How VRRP works
VRRP (Virtual Router Redundancy Protocol) removes the default gateway as a single point of failure. Most hosts on an IP network, from laptops to PLCs, are configured with one default gateway address. If the router or Layer 3 switch at that address fails, every host on the subnet loses its route off the subnet, even when a second router is sitting right next to it.
VRRP solves this by grouping two or more routers into a virtual router. The group owns a virtual IP address, which is the address the hosts use as their gateway, and a matching virtual MAC address, 00-00-5E-00-01 followed by the group number (the VRID). One member is elected active (called master in older RFCs) and answers ARP for the virtual address and forwards traffic. The others are backups.
The active router multicasts an advertisement to 224.0.0.18, IP protocol 112, by default once a second. If the backups miss about three advertisements in a row, the highest-priority backup takes over the virtual IP and MAC address and sends a gratuitous ARP so switches update their tables. Because the address does not change, the hosts never notice.
VRRP was first published by the IETF as RFC 2338 in 1998. VRRPv2 (RFC 3768) covers IPv4 only. VRRPv3 (RFC 5798) adds IPv6 and timers in hundredths of a second, and RFC 9568, published in 2024, updates it with the active and backup terminology.
VRRP priority, preemption and timers
Three settings decide which router is active and how quickly a backup reacts.
-
//
Priority. A value from 1 to 254, with 100 as the default. The highest priority wins the election. A router that owns the virtual IP as its real interface address always has priority 255.
-
//
Preemption. On by default. A higher-priority router that comes back online takes the active role again. Turn it off to avoid a second interruption when a repaired router returns.
-
//
Advertisement interval. Typically 1 s. Backups declare the active router lost after about three intervals plus a short skew, so default failover takes around 3 seconds.
-
//
Tracking. Many implementations lower a router’s priority when an uplink or route it depends on fails, so a router with no path out hands over the gateway role.
-
//
Authentication. VRRPv3 removed the authentication field. Protect the subnet with VLANs and access control lists instead.
VRRP vs HSRP vs GLBP
VRRP is one of three common first hop redundancy protocols (FHRPs). The other two were developed by Cisco and are mainly found on Cisco equipment.
| Feature | VRRP | HSRP | GLBP |
|---|---|---|---|
| Standard | Open, IETF RFC 5798 / 9568 | Cisco proprietary (RFC 2281 is informational) | Cisco proprietary |
| Roles | Active and backup | Active and standby | One gateway coordinator, up to four forwarders |
| Virtual IP | Can be a real interface address | Must be a spare address | Must be a spare address |
| Virtual MAC | 00-00-5E-00-01-{VRID} | 0000.0C07.ACxx (v1) | One per forwarder |
| Default timers | 1 s advertisement, about 3 s failover | 3 s hello, 10 s hold | 3 s hello, 10 s hold |
| Load sharing | Several groups, different gateways per host | Several groups | Built in, round-robin by ARP |
| Preemption by default | On | Off | Off (forwarders on) |
For mixed-vendor networks, and for most industrial Layer 3 switches, VRRP is the usual choice because any vendor can implement it. Two Cisco routers may run HSRP, but a Cisco router and an industrial switch from another maker will normally pair with VRRP.
VRRP on industrial networks
Plant networks increasingly route between VLANs: one subnet per production cell, one for cameras, one for SCADA servers. The Layer 3 switch at the core then becomes the gateway for every PLC, HMI and drive, and a failure there stops traffic between cells even if every ring is healthy. Many field devices accept only one gateway address and cannot be reconfigured on the fly, which makes VRRP the natural fit.
A typical design pairs two Layer 3 switches at the core, each with a VRRP group per VLAN. Splitting the groups so that one switch is active for half the VLANs and the other for the rest uses both switches in normal running. Layer 2 redundancy below them, with ERPS rings or RSTP, keeps the access switches connected to both cores. Our page on ring topology covers that layer, and our guide to Layer 2 vs Layer 3 switches explains when routing belongs in the switch.
Our Layer 3 rack mount industrial switches, and the Layer 3 models among our managed industrial switches, list static routes, OSPFv2/v3, RIPv2/RIPng and VRRPv2/v3, alongside ITU-T G.8032 ERPS, RSTP and MSTP for the Layer 2 side.
Common VRRP mistakes
Most VRRP problems come from the network around it rather than the protocol itself.
-
//
Advertisements blocked between the pair. If the two routers cannot hear each other, both become active, and hosts see a duplicate gateway. Keep the VLAN trunked between them.
-
//
Mismatched settings. The VRID, virtual IP, version and interval must match on every member of the group.
-
//
Preemption loops. A router whose uplink is flapping can take and lose the active role repeatedly. Add a preemption delay or use tracking.
-
//
Expecting zero loss. Default VRRP failover drops traffic for a few seconds. Where the process cannot tolerate that, tune VRRPv3 timers and test the result.
Quick answers on VRRP
VRRP: common questions
Does VRRP work at layer 2 or layer 3?
Layer 3. It protects the IP default gateway and runs over IP, but its advertisements stay on one LAN segment or VLAN.
Is VRRP proprietary to Cisco?
No. VRRP is an open IETF standard. HSRP and GLBP are the Cisco protocols that do the same job.
What is the default VRRP priority?
100. Configurable values run from 1 to 254. Priority 255 is reserved for the router that owns the virtual IP address.
Does VRRP load balance traffic?
Not within one group. Only the active router forwards. To share load, run several groups with different active routers and point different hosts or VLANs at each.
What port does VRRP use?
None. VRRP is not carried in TCP or UDP. It is its own IP protocol, number 112, sent to multicast address 224.0.0.18 for IPv4.
We supply Layer 3 industrial switches as part of a complete network, and as standard we configure the VLANs, VRRP groups and ring protocol to your addressing plan before they ship.