First-hop redundancy

The routers elect a master (VRRP) or active router (HSRP) by priority; it holds the virtual IP and a virtual MAC (VRRP 00:00:5e:00:01:<VRID>, HSRP 0000.0c07.acXX) and advertises that it is alive (VRRP: every second to 224.0.0.18, IP protocol 112). When the advertisements stop, a backup takes both over and sends gratuitous ARP: the hosts change nothing. Preemption gives the role back to a higher-priority router (on by default in VRRP, off in HSRP); tracking lowers a router's priority when its uplink fails. VRRP is the open standard (version 2, RFC 3768, which keepalived speaks by default; version 3, RFC 5798, adds IPv6); HSRP and GLBP are Cisco's, and GLBP spreads hosts over every router by handing out several virtual MACs for one address.

How first-hop redundancy works, step by step

VRRP is the open standard: version 3 is RFC 5798 (IPv4 and IPv6), version 2 is RFC 3768, and keepalived speaks version 2 unless told otherwise. A laptop at 10.0.1.10 has the default route via 10.0.1.254, an address no card was given. Two routers, routerA (10.0.1.2, priority 150) and routerB (10.0.1.3, priority 100), form virtual router ID (VRID) 1 for it:

1. Both start as backup and listen on multicast 224.0.0.18, IP protocol 112.
2. The election. Hearing no better advertisement, routerA becomes master. Highest priority wins (1 to 254, default 100); a tie goes to the higher real address. 255 is reserved for the router that owns the address as its own, 0 means "I am resigning".
3. The master takes the pair. It adds 10.0.1.254 and answers ARP for it with the virtual MAC 00:00:5e:00:01:01: the prefix 00:00:5e:00:01 is VRRP's, the last byte is the VRID.
4. It advertises every advert_int, here 1 second, with the VRID, its priority and the virtual address. The IP TTL is 255, and receivers discard anything else, so advertisements cannot come from off the link.
5. The backup waits out the master-down interval: 3 × advertisement interval + skew, where skew = (256 − priority) / 256 s. For routerB that is 3 + 156/256 ≈ 3.6 s. A higher-priority backup times out first.
6. Failover. When advertisements stop, routerB becomes master, puts 10.0.1.254 on its own card with the same virtual MAC, and sends gratuitous ARPs so switches learn the MAC's new port. The laptop's route and ARP entry stay right; it never notices.
7. Preemption. When routerA returns with 150, it ignores routerB's lower advertisements, times out and takes the role back. VRRP preempts by default.

Each network needs its own group. The first-hop redundancy lab runs VRID 2 for 10.0.2.254 on the server side, so replies also have a gateway that survives. HSRP and GLBP on Cisco gear do the same job with their own timers and MACs.

What it looks like on a Linux machine

keepalived puts the virtual MAC on a macvlan card it creates (use_vmac), named vrrp.<VRID>. On the master the address sits on that card; on the backup the card is up and empty:

routerA$ ip -br addr show vrrp.1
vrrp.1@eth0      UP             10.0.1.254/24
routerB$ ip -br addr show vrrp.1
vrrp.1@eth0      UP

The advertisements, seen from the laptop with tcpdump -nn -e -v -i eth0 vrrp:

00:00:5e:00:01:01 > 01:00:5e:00:00:12, ethertype IPv4 (0x0800), length 54: (tos 0xc0, ttl 255, id 4, offset 0, flags [none], proto VRRP (112), length 40)
    10.0.1.2 > 224.0.0.18: VRRPv2, Advertisement, vrid 1, prio 150, authtype none, intvl 1s, length 20, addrs: 10.0.1.254

When routerA stops, routerB's keepalived log records the takeover:

Sat Oct 10 18:22:04 2026: (lan) Receive advertisement timeout
Sat Oct 10 18:22:04 2026: (lan) Entering MASTER STATE
Sat Oct 10 18:22:04 2026: (lan) setting VIPs.
Sat Oct 10 18:22:04 2026: (lan) Sending/queueing gratuitous ARPs on vrrp.1 for 10.0.1.254

Meanwhile ip neigh show 10.0.1.254 on the laptop still says lladdr 00:00:5e:00:01:01, and a ping running every 0.2 s loses a few packets at most.

What goes wrong, and how you see it

Alive but useless. routerA loses its uplink but its LAN card is fine, so it keeps advertising 150 and swallows the laptop's traffic. Track the uplink: track_interface { eth1 weight -60 } drops routerA to 90, below routerB's 100, and 10.0.1.3 > 224.0.0.18 ... vrid 1, prio 100 takes over.

Two masters. If advertisements do not reach the other router (a firewall dropping protocol 112, a VLAN missing on one trunk), both claim 10.0.1.254. Both vrrp.1 cards hold the address and the switch's MAC table flaps between two ports. Allow ip protocol vrrp in the firewall and check that both routers see each other's packets.

Mismatched VRIDs or intervals. Two routers with different virtual_router_id are two groups, and both become master. With different advert_int values keepalived logs an advertisement interval mismatch and the timers no longer agree. Keep every setting of a group identical on both routers.

Flapping on return. A preempting router that comes back before its routes are ready takes the role and drops traffic. preempt_delay holds it back; nopreempt leaves the role where it is. In the lab, a restarted routerA with nopreempt stays silent while routerB keeps 10.0.1.254/24.

Questions people ask

VRRP vs HSRP vs GLBP? All give hosts one default gateway that survives a router. VRRP is the open standard and preempts by default. HSRP is vendor-specific, uses UDP 1985 with 3 s hellos and a 10 s hold time, and does not preempt unless told to. GLBP hands out several virtual MACs for one address, so hosts spread over all routers instead of one master.

Does the backup router carry any traffic? Not for that group. To use both, run two groups with opposite priorities and give half the hosts each gateway.

Why does the virtual MAC matter? Hosts cache the gateway's MAC in their ARP table. A MAC that moves with the role means nothing in that cache goes stale during a failover.

See it on real machines