Troubleshooting

HSRP Both Routers Active (Split Brain)

VSVipul Sir · 6 min readLast updated: 22 July 2026

If both routers show Active for the same HSRP group, they cannot see each other's hellos. Each assumes its peer has failed and takes the virtual IP — producing duplicate-IP errors and intermittent connectivity. The cause is almost always a broken Layer 2 path, a VLAN mismatch, or mismatched HSRP authentication.

What you see

R1# show standby brief
Interface  Grp  Pri P State    Active          Standby         Virtual IP
Gi0/0      1    110 P Active   local           unknown         192.168.1.1

%STANDBY-3-DUPADDR: Duplicate address 192.168.1.1 on GigabitEthernet0/0

Why it happens

HSRP routers exchange hellos on 224.0.0.2 to elect one Active and one Standby. If those hellos stop arriving, each router concludes it is alone and becomes Active. Both then answer for the same virtual IP and virtual MAC.

The %STANDBY-3-DUPADDR message is the definitive signature. Causes are a switch port in the wrong VLAN, a trunk not carrying the HSRP VLAN, an ACL blocking 224.0.0.2, or one router configured with HSRP authentication while the other is not.

How to confirm it

show standby brief
show standby GigabitEthernet0/0 1
show interfaces trunk
show logging | include STANDBY

show standby brief showing Standby: unknown on both routers means neither can see the other — the clearest confirmation of split brain.

The fix

! Make authentication match on BOTH routers (or remove it from both)
interface GigabitEthernet0/0
 standby 1 ip 192.168.1.1
 standby 1 priority 110
 standby 1 preempt
 standby 1 authentication md5 key-string SECRET
!
! Ensure the VLAN carrying HSRP is actually allowed on the trunk
interface GigabitEthernet0/1
 switchport trunk allowed vlan add 10

Only one router should have the higher priority, and it needs preempt to reclaim the Active role after recovering. Without preempt, failover works but failback does not.

How to stop it happening again

Verify with show standby brief that exactly one router is Active and one is Standby before considering the deployment finished.

Questions people ask

What does %STANDBY-3-DUPADDR mean?

Another device is answering for the HSRP virtual IP. In practice it means your peer router has also gone Active because it cannot hear your hellos.

Do I need preempt?

If you want the higher-priority router to take back the Active role after it recovers, yes. Without preempt the backup keeps the role indefinitely, which is valid but often surprises people.

Reading the fix is not the same as doing it

Every fault on this page can be broken and repaired on real Cisco routers and switches in our Ahmedabad lab — which is how it stops being theory. Come and see the rack before you pay anything.