Cisco Catalyst SD-WAN Routing Configuration Guide, Releases 26.x and Later

PDF

Cisco Catalyst SD-WAN Routing Configuration Guide, Releases 26.x and Later

Configure HSRP using the CLI

Updated: September 28, 2026

Want to summarize with AI?

Log in

Provides instructions for configuring HSRP on network interfaces, covering steps for enabling, setting priorities, and applying authentication and timer adjustments.

Before you begin

You can configure HSRP using the Cisco SD-WAN Manager CLI Add-on feature templates and CLI device templates. For more information on configuring using CLI templates, see CLI Templates. The following commands can be used in any order.

Procedure

  1. Enable HSRP on the interface.

    Create (or enable) the HSRP group in IPv4 using its number and virtual IP address:

    Device(config)# interface interface-type
Device(config-if)# standby group-number ip [ip-address [secondary]]

    Activate HSRP in IPv6:

    Device(config)# interface interface-type
Device(config-if)# standby group-number ipv6 {link-local-address | autoconfig }

  2. Set the HSRP version.

    Note that the nostandby or nostandby version 2 commands are rejected when the interface has IPv6 groups.

    Device(config)# interface interface-type
Device(config-if)# standby version {1|2}

  3. Configure group priority and preemption.

    Set the priority value used in choosing the active router, and configure HSRP preemption and preemption delay:

    Device(config)# interface interface-type
Device(config-if)# standby group-number ip [ip-address [secondary]]
Device(config-if)# standby group-number priority [priority]
Device(config-if)# standby group-number preempt [ delay{ [ minimum seconds] [ reload seconds] [ sync seconds]}]

  4. Enable HSRP authentication (MD5 or text authentication).

    • Configure HSRP MD5 authentication using a key chain.

      Key chains allow a different key string to be used at different times according to the key chain configuration. HSRP queries the appropriate key chain to obtain the current live key and key ID for the specified key chain.

      Device(config)# interface interface-type
Device(config-if)# ip address ip-address mask [secondary ]
Device(config-if)# standby group-number priority [priority]
Device(config-if)# standby group-number preempt [ delay{ [ minimum seconds] [ reload seconds] [ sync seconds]}]
Device(config-if)# standby group-number authentication md5 key-chain key-chain-name
Device(config-if)# standby group-number ip [ip-address [secondary]]

    • Configure HSRP text authentication.

      The authentication string can be up to eight characters in length; the default string is Cisco.

      Device(config)# interface interface-type
Device(config-if)# ip address ip-address mask [secondary ]
Device(config-if)# standby group-number priority [priority]
Device(config-if)# standby group-number preempt [ delay{ [ minimum seconds] [ reload seconds] [ sync seconds]}]
Device(config-if)# standby group-number authentication text string
Device(config-if)# standby group-number ip [ip-address [secondary]]

  5. Adjust HSRP timers.

    Configure the time between the hello packets and the time before other routers declare the active router to be inactive:

    Device(config)# interface interface-type
Device(config-if)# standby group-number ip [ip-address [secondary]]
Device(config-if)# standby group-number timers hellotime holdtime

  6. Adjust HSRP object tracking.

    Configure HSRP to track an object and change the HSRP priority based on the state of the object:

    Device(config)# interface interface-type
Device(config-if)# standby group-number track object-number [decrement priority-decrement] [shutdown]

  7. Optimize CPU and network performance with HSRP multiple group optimization.

    • Configure an HSRP group as a client group:

      Device(config)# interface interface-type
Device(config-if)# standby group-number follow group-name

    • Configure the HSRP client group refresh interval:

      Device(config)# interface interface-type
Device(config-if)# standby group-number mac-refresh seconds

  8. Configure a specific virtual MAC address.

    Specify a virtual MAC address for HSRP:

    Device(config)# interface interface-type
Device(config-if)# standby group-number mac-address mac-address

  9. Link IP redundancy clients to HSRP groups.

    Configure the name of a standby group:

    Device(config)# interface interface-type
Device(config-if)# standby group-number name [redundancy-name]

    The configured interface participates as a member of the specified HSRP group and provides high-availability failover with other routers in the group.

Example

The following is a complete HSRP configuration example on Cisco IOS XE Catalyst SD-WAN devices through CLI:

config-transaction
!
    interface GigabitEthernet0/0/1.94
    encapsulation dot1Q 94
    vrf forwarding 509
    ip address 10.96.194.2 255.255.255.0
    ip directed-broadcast
    ip mtu 1500
    ip nbar protocol-discovery
    standby version 2
    standby 1 preempt
    standby 94 ip 10.96.194.1
    standby 94 timers 1 4
    standby 94 priority 110
    standby 94 preempt delay minimum 180
    standby 94 authentication md5 key-string 7 094F471A1A0A
    standby 94 track 8 shutdown
    standby 194 ipv6 2001:10:96:194::1/64
    standby 194 timers 1 4
    standby 194 priority 110
    standby 194 preempt delay minimum 180
    standby 194 authentication md5 key-string 7 094F471A1A0A
    standby 194 track 80 shutdown
    ip policy route-map clear-df
    ipv6 address 2001:10:96:194::2/64
    ipv6 mtu 1500
    arp timeout 1200
    end

What to do next

  • Verify HSRP operation and monitor for proper failover behavior.

  • Adjust settings based on observed performance as needed.