CCNA Static Routing: Default, Network, Host and Floating Static Routes (IPv4 and IPv6)

A static route is a route an administrator types into the router's configuration; it tells the router which next hop or exit interface to use for one destination prefix, and its configuration never changes unless someone edits it (whether it is actually in the routing table is a separate question, covered below). Static routes are shown with the code S in the routing table (S* when the route is also the candidate default) and get a default administrative distance of 1, so they beat any dynamically learned route to the exact same prefix unless you give them a higher distance.

The IPv4 and IPv6 commands have the same shape: destination, then where to send it, then an optional distance.

ip route 192.168.60.0 255.255.255.0 10.0.78.2            ! next hop only
ip route 192.168.60.0 255.255.255.0 GigabitEthernet0/0/2  ! exit interface only
ip route 192.168.60.0 255.255.255.0 GigabitEthernet0/0/2 10.0.78.2      ! fully specified
ip route 192.168.60.0 255.255.255.0 10.0.78.2 140         ! with distance 140

ipv6 unicast-routing
ipv6 route 2001:db8:beef:20::/64 2001:db8:0:78::2
ipv6 route 2001:db8:beef:20::/64 GigabitEthernet0/0/2 fe80::8
ipv6 route 2001:db8:beef:20::/64 2001:db8:0:78::2 140

Three details trip people up:

• IPv4 uses a dotted subnet mask (255.255.255.0), never a wildcard mask (0.0.0.255) and never a prefix length. IPv6 uses prefix/length notation and the ipv6 route command; ip route does not accept an IPv6 prefix.
• When you give both, the interface comes first, then the next-hop address. The optional distance always comes last.
• The next hop is the neighbour's address on a link you can reach, normally the far end of a directly connected subnet. It is never your own interface address and never an address inside the remote destination network.

CCNA exam topic 3.2 names four kinds of static route: default, network, host and floating. They differ only in the prefix you route and the distance you give it; the command is the same.

A static default route is configured with an all-zeros prefix: ip route 0.0.0.0 0.0.0.0 next-hop for IPv4 and ipv6 route ::/0 next-hop for IPv6. A /0 prefix has no network bits, so it matches every destination, but because it is the shortest possible match it is used only when nothing more specific exists. In show ip route it appears as S* 0.0.0.0/0, and the header changes to Gateway of last resort is next-hop to network 0.0.0.0.

EDGE1(config)# ip route 0.0.0.0 0.0.0.0 100.64.10.1
EDGE1(config)# ipv6 route ::/0 2001:db8:e0::1

What makes a route a default route

Two things must both be zero: the address and the prefix length. The length is what gives a default its reach. Keep the all-zeros address but give it a full-length mask (32 bits in IPv4, 128 in IPv6) and the entry matches only one address: 0.0.0.0 in IPv4, or :: in IPv6, the unspecified address a host uses as a source before it has an address of its own. Neither is useful as a default. The opposite mistake is a short but non-zero prefix, such as a /3 or /8 aggregate: it covers a large range but still leaves destinations outside it unmatched, so it is a broad network route, not a default.

ip default-gateway versus a default route

ip default-gateway is for a device that is not routing: a Layer 2 switch, or a router with no ip routing, uses it to reach other subnets for its own management traffic. Once ip routing is enabled (a router, or a Layer 3 switch doing inter-VLAN routing), IOS ignores ip default-gateway, and the routing table shows Gateway of last resort is not set. A routing device needs ip route 0.0.0.0 0.0.0.0 next-hop instead. Turning routing off to make the default gateway work would break inter-VLAN routing. In IPv6 a router does not use a "default gateway" command at all; it uses ipv6 route ::/0.

Default routes that point at each other

Suppose a distribution router sends its default traffic to the edge router at 10.0.78.1, and the edge router's own default was mistakenly entered as ip route 0.0.0.0 0.0.0.0 10.0.78.2, pointing back at the distribution router instead of at the ISP. Packets for the internet bounce between the two until their TTL expires. A traceroute shows the signature: the same two addresses alternating hop after hop. The fix is to correct the router whose default points the wrong way.

A network route names the network address of the remote subnet (or summary) and the mask that defines its size; the router forwards any destination whose leading prefix bits match. Getting the mask right is the whole job: the route covers exactly the range its prefix length defines, no more and no less.

The address must be the network address

IOS rejects a route whose address has host bits set for the mask given:

R7(config)# ip route 172.20.5.1 255.255.255.0 10.0.78.2
%Inconsistent address and mask
R7(config)# ip route 172.20.5.0 255.255.255.0 10.0.78.2

Keeping the host address and switching to an all-ones mask would be accepted, but the result is a host route to one address, not a route to the subnet.

Match the mask to the LAN's size

For 10.44.8.0/27 the mask is 255.255.255.224. Using 255.255.255.240 (/28) would cover only the first 16 of its 32 addresses, and the rest of the LAN would become unreachable (or follow a default route). Convert the prefix length to the dotted mask carefully: /19 = 255.255.224.0, /21 = 255.255.248.0, /23 = 255.255.254.0.

Summary routes

One route can cover several contiguous subnets if it uses a shorter prefix. 192.168.32.0/22 covers 192.168.32.0 to 192.168.35.255; it does not include 192.168.37.0. To cover both 192.168.32.0/22 and 192.168.36.0/22 you need 192.168.32.0/21 (255.255.248.0), which spans 192.168.32.0 to 192.168.39.255. The block must also be aligned: a /21 must start on a multiple of 8 in the third octet.

IPv6 works the same way in hexadecimal. Eight /64s, 2001:db8:f00d:20:: to 2001:db8:f00d:27::, share their first 61 bits (the fourth hextet runs 0x20 to 0x27, which differ only in the last three bits), so ipv6 route 2001:db8:f00d:20::/61 next-hop covers exactly those eight. One bit longer (/62) covers only half of them, and one bit shorter (/60) covers sixteen, 0x20 to 0x2f, sweeping in prefixes that are not behind that router.

ipv6 route 2001:db8:beef:20::/64 2001:db8:0:78::2     ! one LAN
ipv6 route 2001:db8:f00d:20::/61 2001:db8:0:78::2     ! eight aligned /64s

As in IPv4, the prefix you route is the remote LAN, and the next hop is the neighbour's address on the shared link, never an address inside the remote prefix.

A host route is a static route to a single address: a /32 in IPv4 (mask 255.255.255.255) or a /128 in IPv6. Because it is the longest possible prefix, longest-prefix match always prefers it over any network, summary or default route that also covers the address, whatever their administrative distances.

ip route 192.168.200.15 255.255.255.255 10.0.79.9      ! one server via an inspection router
ipv6 route 2001:db8:e1::80/128 2001:db8:0:78::2

That makes host routes useful for steering one server's traffic (through a firewall, say) while the rest of its subnet keeps its normal path. The mask is what makes it a host route: it must be all ones. A shorter mask combined with a host address is either rejected for host bits or, written as a network address, routes the whole subnet; a wildcard-style mask is not valid in ip route at all.

The stale host route

Host routes are easy to forget. If a server moves and an old /32 still points to its former location, every other host in the subnet works through the subnet route while that one server fails, because the /32 still wins. Imagine 172.18.4.44 was once reached through 10.0.79.9 and has since moved: show ip route static still lists 172.18.4.44/32 via the old router, and removing it (no ip route 172.18.4.44 255.255.255.255 10.0.79.9) lets the subnet route take over. When exactly one destination fails and its neighbours work, look for a forgotten host route. Adding another route with a higher distance would not help: the stale /32 keeps winning by length.

Making a host route a backup

Distance only decides between routes to the same prefix. A /32 with a high distance is not a backup to a /24; it is simply the best match for that one address, so it carries traffic all the time. To make a host route float, pair it with a primary host route for the same /32 through the normal path, for example ip route 172.18.4.44 255.255.255.255 10.0.78.2 as primary and ip route 172.18.4.44 255.255.255.255 10.0.79.9 20 as backup. The two /32s now compare by distance, and the rest of the subnet is unaffected.

A static route can name a next-hop address, an exit interface, or both (a fully specified route); the choice changes how the route is shown, how the router resolves Layer 2 addresses, and what keeps the route installed.

A route to Null0 (a discard route) also displays as "is directly connected, Null0", so read the interface name before deciding what kind of route produced an entry.

Interface-only routes on Ethernet

On a point-to-point serial link there is only one possible neighbour, so an interface-only route works. On Ethernet, a multi-access medium, the router has no next-hop address to resolve, so it sends an ARP request for each final destination (10.66.3.15, 10.66.7.40 and so on). That works only if the neighbouring router answers those ARPs on the hosts' behalf with proxy ARP, which is enabled by default on IOS router interfaces. The ARP cache then fills with one entry per remote host, every one of them carrying the neighbour's MAC address. If the neighbour has no ip proxy-arp, the entries stay Incomplete and traffic fails. The fix is to give the route a next hop, either on its own or together with the interface. Routes that only help the router reach the neighbour, or a next hop that sits inside the remote network, leave the problem in place.

Recursive lookup

A next-hop-only route needs a second lookup. Say R7 has ip route 10.91.0.0 255.255.0.0 10.0.89.2, and 10.0.89.2 is two routers away: R7 reaches 10.0.89.0/30 only through another static via 10.0.78.2 on Gi0/0/2. To send to 10.91.4.4, R7 first finds the route to 10.0.89.2, then frames the packet to the MAC of 10.0.78.2 (the directly reachable router), not to the far next hop. The routes depend on one another: if Gi0/0/2 goes down, the route to 10.0.89.0/30 is withdrawn, and the 10.91.0.0/16 route, which resolved through it, leaves the table too.

For IPv4, IOS will also re-resolve a next-hop-only route through whatever other route covers the next hop, even a default route, after its original path fails; naming the interface as well pins the route to that link. IPv6 static routes are stricter: by default they do not resolve their next hop through a default route (IOS needs ipv6 route static resolve default for that).

A static route is installed only while it is usable: its next hop must resolve to a connected or routed path that is up, and no route to the same prefix with a lower administrative distance may exist. A route that is in the running configuration but not in show ip route is configured, not installed.

Common reasons a static route is missing

• The next hop does not resolve. If the only connected subnet containing the next hop is on an interface that is administratively down or down/down, the route stays out of the table, and show ip route prefix reports % Network not in table. The same applies in IPv6 when the next hop is not on any connected or routed prefix, for example after a typo in one hextet of the neighbour's address.
• The next hop is the router's own address. IOS refuses it outright: %Invalid next hop address (it's this router). Use the neighbour's address on the link. On a /30 such as 10.0.78.4/30 there are only two usable addresses, .5 and .6, so if the router is .6 the neighbour must be .5.
• A better route exists. A route with a lower distance to the identical prefix keeps a floating static out (see the next section).
• Distance 255. A distance of 255 means "never trust"; such a route is never installed. 254 is the highest usable distance.

Installed automatically when the problem clears

IOS re-evaluates configured statics continuously. When the interface comes back up (no shutdown) or the next hop becomes reachable, the route is installed on its own: you do not re-enter it or clear the routing table. When the condition fails again, it is withdrawn again, and the configuration line is kept throughout.

The permanent keyword is the opposite of floating: it keeps a static in the table even when its interface goes down. It is rarely what a backup design needs.

A floating static route is a backup route to the same prefix as a primary route, configured with a higher administrative distance so it stays out of the routing table while the primary exists and is installed automatically when the primary is withdrawn. The distance is the last argument of the command.

! OSPF default (distance 110) is primary; a cellular router is the backup
ip route 0.0.0.0 0.0.0.0 100.64.99.1 170

The rules that decide whether a backup really floats:

• Above the primary, below 255. Against OSPF (110) the usable window is 111 to 254. Anything lower than the primary's distance wins and the "backup" carries traffic straight away; leaving the distance out means 1, which loses only to connected routes; and 255 is never installed, so it can never take over. The window depends on the primary: behind a static primary at distance 1, a backup at 20 is plenty, with no need to exceed OSPF's value.
• Distance, not metric. Floating is about administrative distance. A static route's metric is 0 and is not configurable in the ip route command, and choosing an exit interface over a next hop does not make a route a backup.
• Equal distance means load sharing. Two statics to the same prefix with the same distance are both installed and the router shares traffic across them (equal-cost multipath). The order in which the lines were typed plays no part. To make one a backup, raise its distance; raise the other one instead and the roles swap.
• Identical prefix only. Distance is compared only between routes to exactly the same prefix and length.

Reading a floating static in the table

Once it is installed, the route shows its own distance, for example S 172.22.0.0/16 [40/0] via 10.0.79.9. The bracket is always [distance/metric].

A ladder of backups

Several floating statics with different distances form a ladder. Suppose OSPF is down and two statics exist at 140 and 160. The router uses the lowest distance whose next hop is valid. If the 140 route's interface was down, the 160 route is used; when that interface returns, the 140 route becomes valid again and replaces the 160 route at once. An installed static is not "sticky".

The prefix-length trap

A backup with a different prefix length is not a backup at all. If OSPF supplies 172.24.0.0/16 and you add ip route 172.24.16.0 255.255.240.0 10.0.79.9 210, the /20 is a different prefix: both routes are installed together, and traffic to 172.24.16.0/20 follows the static by longest-prefix match while the rest of the /16 follows OSPF. The reverse also happens: if OSPF actually supplies 172.24.3.0/24 and 172.24.4.0/24, a static 172.24.0.0/16 with distance 210 is installed beside them (there is no OSPF /16 for it to lose to). Traffic to those two /24s still follows OSPF, while every other 172.24.x.x destination uses the static. Always check the primary's real prefix in show ip route and copy it exactly.

A floating static takes over only when the primary route is removed from the routing table. When a static primary's next hop sits on a directly connected Ethernet subnet, that happens only when the router's own exit interface goes down (a recursively resolved next hop can also be withdrawn when the route it resolves through disappears, as described above). IOS does not check whether the next-hop router is alive. If the provider hands off through its own switch and the provider's router behind that switch fails, the edge router's interface stays up/up, the next hop still resolves through the connected subnet, the primary stays installed, and traffic is black-holed while the backup waits.

Rewriting the primary in a different form changes nothing here. Adding the exit interface, or using it alone, still leaves a route that IOS keeps for as long as the interface is up; ARP entries timing out do not remove a static route. Detecting a remote failure needs something that tests reachability, such as object tracking with IP SLA, or a dynamic routing protocol whose neighbour loss withdraws the route (an OSPF primary disappears when the adjacency drops, which is why a floating static behind OSPF does fail over). Tracking is beyond this topic; the point to know is the limitation.

A related point: a routing table can hold more than one candidate default route. When one is at distance 1 and another at a higher distance, only the first is installed, and the reason is distance, not a limit on how many defaults may exist.

IPv6 static routes use ipv6 route prefix/length and follow the same rules for default, network, host and floating routes, with two IPv6-specific requirements: the router must be enabled for IPv6 routing, and a link-local next hop must be paired with its exit interface.

ipv6 unicast-routing

IPv6 forwarding is off on IOS routers until you enter the global command ipv6 unicast-routing. Without it, the router behaves as an IPv6 host: it keeps its addresses, answers pings to them and can ping its link-local neighbours, but it forwards nothing between interfaces and sends no Router Advertisements, so SLAAC hosts on the LAN learn no default gateway. Static routes in the configuration do not change that. No interface-level IPv6 command and no IPv4 command substitutes for it: interface commands only give that interface addresses, and the IPv4 routing switch has no effect on IPv6 forwarding.

Link-local next hops

Every IPv6 interface has a link-local address in fe80::/10, and link-local addresses are unique only on one link: a router might use the same fe80:: address on all its interfaces, and several of its neighbours might share one too. An fe80:: address alone therefore does not identify a neighbour, so IOS requires the exit interface:

C2(config)# ipv6 route 2001:db8:d0::/64 fe80::7
% Interface has to be specified for a link-local nexthop
C2(config)# ipv6 route 2001:db8:d0::/64 GigabitEthernet0/0/3 fe80::7

The interface decides which neighbour you reach. If two neighbours on Gi0/0/3 and Gi0/0/4 both use fe80::1, a route that names the wrong one of those interfaces sends the traffic to the wrong neighbour even though the address "matches"; the fix is to name the interface that leads to the router you want. The next hop is the neighbour's link-local address, never your own.

A global next hop alone is accepted (the router resolves it recursively, just like IPv4), so both ipv6 route ::/0 2001:db8:e0::1 and ipv6 route ::/0 GigabitEthernet0/0/0 fe80::e0 are valid default routes toward the same upstream router. A global next hop resolves only if the router has a route to it. If the router's interface on that link has a link-local address but no global prefix, a route such as ipv6 route ::/0 2001:db8:e9::1 180 has nothing to resolve through and never installs; the interface plus link-local form is the one that works there.

IPv6 floating statics

Floating works exactly as in IPv4: the distance comes last and must be above the primary's (OSPFv3 also uses 110) and below 255.

ipv6 route ::/0 GigabitEthernet0/0/4 fe80::e9 180
ipv6 route 2001:db8:d5::/64 2001:db8:0:78::2 130

In show ipv6 route, each static prints the prefix and [distance/metric] on one line and the next hop on the next (S ::/0 [1/0] / via 2001:DB8:E0::1); IOS displays hexadecimal in upper case.

Troubleshoot a static-routing problem by checking both directions of the path, hop by hop: every router needs a route to the destination and every router on the way back needs a route to the source. Static routes are one-way; nothing tells the far router how to return traffic.

The missing return route

Suppose RA and RC share 10.0.78.0/30 (RA is .1, RC is .2). RA has a route to RC's LAN, 192.168.33.0/24, but RC has none back to RA's LAN, 192.168.11.0/24. Echo requests from RA's LAN reach their target and the replies die at RC. The fix belongs on RC: ip route 192.168.11.0 255.255.255.0 10.0.78.1, pointing at RA's address on the shared link. IPv6 is the same. A stub router that has only a default route can send traffic out, but the hub needs a specific route back to the stub's LAN (for example ipv6 route 2001:db8:5a::/64 2001:db8:0:5a::5, via the stub's address on the hub link). Changing the hub's own default route instead would redirect its internet traffic.

When the router's own ping fails but hosts' pings work

A ping from a router without a source option uses the address of the exit interface, usually a WAN address. If the far routers have routes back to the LANs but not to that WAN subnet, hosts succeed and the router's ping fails. Either add a return route for the WAN subnet on the far router (pointing back toward the pinging router), or repeat the test with an extended ping that sources from a LAN interface, such as ping 192.168.33.20 source GigabitEthernet0/0/0 where Gi0/0/0 is the LAN side.

A checklist

1. show running-config | include ip route (or ipv6 route): is the route configured with the right prefix, mask and next hop?
2. show ip route static / show ipv6 route static: is it installed, with the distance you expect? If not, does the next hop resolve, and is the interface up?
3. Is something more specific winning? A stale host route or a longer static overrides your route regardless of distance.
4. Does the return path exist on every router back to the source?
5. Traceroute: alternating addresses mean two routers point at each other; a trace that stops shows where the route is missing.
6. On Ethernet, for an interface-only static, check show ip arp for Incomplete entries (no proxy ARP).
7. For IPv6, confirm ipv6 unicast-routing and that a link-local next hop names the correct interface.

Reading general routing-table fields and administrative distance values is covered in the routing-table lesson (exam topic 3.1); OSPF configuration is topic 3.3.