County jail endpoints should use one stable default-gateway address while two routers provide VRRP redundancy. Which address should those endpoints configure as their gateway?

County jail endpoints should use one stable default-gateway address while two routers provide VRRP redundancy. Those endpoints must configure the VRRP virtual IP shared by the redundant routers as their first-hop address. The virtual IP stays constant while master and backup roles move between routers, so cameras, kiosks, and staff PCs keep a single gateway through failover. That is the operational point of an FHRP in a secure municipal facility: stable endpoint configuration with redundant next hops behind the scenes.

Using only the lower-priority router’s physical interface IP so failover never occurs fails because pinning hosts to one physical address defeats VRRP and removes the resilient virtual first hop. Using the PIM rendezvous-point address for jail camera multicast fails because an RP address is for multicast tree signaling, not the unicast default gateway for endpoints. Using a public PAT pool address on the Internet edge firewall fails because a PAT pool is for outbound address sharing, not the LAN default gateway inside the jail VLANs.

Exam caveat: always map “what do clients configure as gateway?” to the virtual IP for HSRP/VRRP/GLBP—not physical interface IPs, RP addresses, or NAT pools. Physical IPs remain for management and router-specific reachability; hosts should not depend on them for everyday default routing when an FHRP is deployed.

Operational check: verify the VRRP virtual IP with show vrrp, confirm DHCP or static endpoint gateways match that VIP, and fail over the master while confirming jail endpoints continue forwarding without gateway renumbering.