IPv4 and IPv6 static routes: default, network, host and floating

Why this matters

Even networks that run OSPF everywhere still depend on static routes. A branch router points its default route at the internet provider. A firewall needs a host route so that traffic to one server takes a particular path. A backup link sits behind a floating static route, ready for the day the primary fails. A network technician will add these by hand, and a junior network engineer will be asked why one of them does not work.

Static routes fail in quiet ways. A typo in the next-hop address installs a route that goes nowhere. A route that depends on an unreachable next hop never appears in the table. A backup route with the wrong distance takes over from the primary at once, or never takes over at all. A route is added on one router but not on the router that has to send the replies. This lesson covers the four kinds of static route, in IPv4 and IPv6, and the faults that come with each. It builds on the reading order from lesson 13: longest match, then distance, then metric.

The lesson

The examples use this small network. R1 connects to its provider at 203.0.113.1 and to R2 over 10.0.12.0/30. R1's LAN is 10.1.1.0/24 and R2's LAN is 10.2.2.0/24.

 PC-A 10.1.1.0/24          10.0.12.0/30                10.2.2.0/24
 LAN ---- Gi0/0/0 [R1] Gi0/0/1 .1 -------- .2 Gi0/0/1 [R2] Gi0/0/0 ---- LAN
                   Gi0/0/2
                      |
                 203.0.113.1 (provider)

The command forms are:

ip route   <network> <mask> <next-hop | exit-interface [next-hop]> [distance]
ipv6 route <prefix>/<length> <next-hop | exit-interface [next-hop]> [distance]

IOS routes IPv4 by default. For IPv6, the global command ipv6 unicast-routing must be entered first. Without it, a router with IPv6 addresses on two LANs acts as an IPv6 host: it neither forwards IPv6 packets between interfaces nor sends router advertisements. ipv6 address autoconfig is no substitute; it makes an interface a SLAAC client.

Default route

A default route matches every destination, so it catches anything no more specific route covers. Both the network and the mask are all zeros:

R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1
R1(config)# ipv6 unicast-routing
R1(config)# ipv6 route ::/0 2001:db8:f::1

Watch for two mistakes. ip route 0.0.0.0 255.0.0.0 203.0.113.1 matches only 0.0.0.0/8, not everything. ip route 0.0.0.0 0.0.0.0 203.0.113.0 names the provider's subnet instead of its router. In IPv6, the default is ::/0. ::/128 is the unspecified address, a single address, and matches almost nothing.

The table marks a static default as S* and sets the gateway of last resort:

R1# show ip route | include Gateway|0.0.0.0
Gateway of last resort is 203.0.113.1 to network 0.0.0.0
S*    0.0.0.0/0 [1/0] via 203.0.113.1

The brackets read distance first, metric second: an administrative distance of 1, the default for a static route, and a metric of 0.

Link-local next hops. If the upstream router's only known IPv6 address is its link-local FE80::1, the route must name the exit interface before the address, because a link-local address is valid only on one link:

R3(config)# ipv6 route ::/0 GigabitEthernet0/0/1 FE80::1

ipv6 route ::/0 FE80::1 G0/0/1 has the arguments in the wrong order, and ip route accepts only IPv4.

Layer 3 switches. ip default-gateway is used only when ip routing is off; it gives the switch itself a way off its management subnet. A Layer 3 switch with ip routing on ignores it, so routed packets to remote networks are dropped. It needs ip route 0.0.0.0 0.0.0.0 10.0.0.1 instead. Turning routing off to make ip default-gateway work would stop it routing between its VLANs.

Network route

A network route points at a subnet or a summary. On R1, to reach R2's LAN:

R1(config)# ip route 10.2.2.0 255.255.255.0 10.0.12.2
R1(config)# ipv6 route 2001:db8:77::/48 2001:db8:0:12::2

In IPv6 the length goes with the prefix. ipv6 route 2001:db8:77:: 2001:db8:0:12::2 48 is rejected: IOS needs the prefix and its length together, and a number after the next hop is read as an administrative distance, not a prefix length.

The network and mask must agree. If an engineer enters ip route 192.168.40.0 255.255.0.0 10.0.0.2, IOS answers %Inconsistent address and mask. With mask 255.255.0.0 the network address would be 192.168.0.0, so 192.168.40.0 has bits set in the host part. Either use 192.168.0.0 255.255.0.0 or 192.168.40.0 255.255.255.0.

Routes work in both directions. Suppose R1 has the route above, and R2 has only connected routes. R1 can ping R2's LAN hosts from its WAN address, because R2 knows 10.0.12.0/30 as connected. But PC-A on 10.1.1.0/24 cannot. Its packets reach R2's LAN, and the replies, addressed to 10.1.1.0/24, have no route on R2. The fix is on R2:

R2(config)# ip route 10.1.1.0 255.255.255.0 10.0.12.1

Next hop, exit interface, or both. These behave differently:

• Next hop only. IOS installs the route only if it can reach the next hop through another route, a recursive lookup. If R4 has ip route 172.31.0.0 255.255.0.0 10.0.99.2 and nothing covers 10.0.99.2, the route never appears in show ip route. Nothing else is wrong with it: its distance is still 1, and no extra keyword is needed. It appears as soon as 10.0.99.2 becomes reachable.
• Exit interface only. The route is installed while the interface is up and removed when it goes down. If Serial0/1/0 fails, ip route 10.50.0.0 255.255.0.0 Serial0/1/0 leaves the table. It stays in the running configuration and returns when the link recovers. On a point-to-point serial link this works well. On Ethernet it does not: the router treats every destination as directly connected and ARPs for each one, relying on the neighbour's proxy ARP. If the neighbour disables proxy ARP, everything behind it becomes unreachable, while the route stays installed.
• Both (a fully specified route), such as ip route 10.9.0.0 255.255.0.0 GigabitEthernet0/0 10.0.9.2, is the safe form on Ethernet.

A wrong next hop can still install. R2's Gi0/0/2 is 10.0.23.2/24 and its neighbour R3 is 10.0.23.3. If the route was typed with 10.0.23.30, that address lies in a connected subnet, so the route installs:

S     10.30.0.0/16 [1/0] via 10.0.23.30

But nothing answers ARP for 10.0.23.30, so packets are never delivered. Check the next hop against the neighbour's real address.

Worked example: a /21 route. R5 has:

ip route 10.60.0.0 255.255.0.0 10.0.56.6
ip route 10.60.8.0 255.255.248.0 10.0.57.7 5
ip route 0.0.0.0 0.0.0.0 10.0.58.8

Where does a packet to 10.60.12.40 go?

1. The mask 255.255.248.0 is a /21. In the third octet the block size is 256 − 248 = 8.
2. So 10.60.8.0/21 covers 10.60.8.0 to 10.60.15.255.
3. The third octet of the destination, 12, falls between 8 and 15. The /21 matches.
4. The /16 and the default also match, but the /21 is the longest. R5 uses 10.0.57.7.

The distance of 5 on the /21 plays no part, because distance only decides between routes of the same prefix length.

The same rule applies when the routes are all static. If R6 has static routes for 172.20.0.0/16, 172.20.14.0/24 and 172.20.14.64/26, plus a default, a packet to 172.20.14.77 uses the /26: block size 64, covering .64 to .127.

IPv6 longest match. With routes for 2001:db8:10::/48 via 2001:db8:0:1::2, 2001:db8:10:20::/64 via 2001:db8:0:2::2 and ::/0, a packet to 2001:db8:10:21::9 has a fourth hextet of 21, not 20, so the /64 does not match. The /48 does, so the next hop is 2001:db8:0:1::2.

Discard routes. A route to Null0 silently drops matching traffic. ip route 10.80.0.0 255.255.0.0 Null0 stops packets for unused parts of 10.80.0.0/16 leaving by the default route toward the provider, because the /16 is more specific. A wildcard such as 0.0.255.255 is not a mask and is wrong here.

Host route

A host route matches one address: a /32 in IPv4, written with mask 255.255.255.255, or a /128 in IPv6.

R2(config)# ip route 192.168.50.10 255.255.255.255 10.0.23.3
R2(config)# ipv6 route 2001:db8:50::10/128 2001:db8:0:23::3

The address must be the host itself. ip route 192.168.50.0 255.255.255.255 10.0.23.3 is a host route to the wrong address, and ip route 192.168.50.10 255.255.255.0 10.0.23.3 is rejected as an inconsistent address and mask.

Because a /32 is the longest possible IPv4 match, a host route overrides any network route for that one address only. R7 routes 10.70.0.0/16 via 10.0.71.1. The security team adds a host route for the server 10.70.4.20 via a firewall at 10.0.72.2:

R7(config)# ip route 10.70.4.20 255.255.255.255 10.0.72.2

Traffic to 10.70.4.20 now goes through the firewall. Traffic to 10.70.4.21 still matches only the /16 and goes via 10.0.71.1. That is exactly what the host route was meant to do.

Floating static

A floating static route is a backup. It has an administrative distance higher than the route it backs up, so it stays out of the routing table while the primary exists and is installed only when the primary is withdrawn. The name describes it floating above the table until it is needed.

R1 learns 10.40.0.0/16 through OSPF on its primary link. OSPF's distance is 110, so the backup needs more:

R1(config)# ip route 10.40.0.0 255.255.0.0 172.16.9.2 120

A distance of 100 or 1 would replace the OSPF route at once. A distance of 110 ties with OSPF and does not guarantee backup-only behaviour.

For a backup default route behind a primary static default, any distance above 1 works. R3 has two providers:

R3(config)# ip route 0.0.0.0 0.0.0.0 198.51.100.1
R3(config)# ip route 0.0.0.0 0.0.0.0 192.0.2.9 250
R3(config)# ipv6 route ::/0 2001:db8:f::1
R3(config)# ipv6 route ::/0 2001:db8:e::1 5

While the primaries are up, show ip route does not list the route via 192.0.2.9. That is correct, not a rejected command: the table holds only the best route for each prefix, and the primary's distance of 1 is lower. A distance of 250 is still usable; only 255 means a route is never installed. If both default routes had the same distance, the router would load-share between them instead, which is why the IPv6 backup needs its 5. With distances 1 and 10, only the route with distance 1 is installed.

Floating routes can be layered. R1 has:

ipv6 route 2001:db8:acad::/48 2001:db8:0:a::1
ipv6 route 2001:db8:acad::/48 2001:db8:0:b::1 200

It also learns 2001:db8:acad::/48 from OSPFv3 via 2001:db8:0:c::1. Normally the first static route wins with distance 1. If the link to 2001:db8:0:a::1 fails and R1 has no other route to that next hop, the first route is withdrawn. The remaining routes have the same prefix length, so the lowest distance wins: OSPFv3 at 110 beats the static at 200, and traffic to 2001:db8:acad:5::1 goes via 2001:db8:0:c::1. The route via 2001:db8:0:b::1 is installed only if OSPFv3 loses the prefix too.

Verifying static routes. show ip route static and show ipv6 route static filter the table to static entries, each with its prefix, distance and next hop or exit interface:

R1# show ipv6 route static
IPv6 Routing Table - default - 9 entries
S   ::/0 [1/0]
     via 2001:DB8:F::1
S   2001:DB8:77::/48 [1/0]
     via 2001:DB8:0:12::2
S   2001:DB8:ACAD::/48 [1/0]
     via 2001:DB8:0:A::1

show ipv6 neighbors lists the neighbour cache, not routes. To see a floating route before it is installed, look in the running configuration.

What the exam is really asking

• Default route syntax. 0.0.0.0 0.0.0.0 and the next-hop router's address; ::/0, never ::/128.
• Link-local next hop. Exit interface first, then the FE80 address.
• ipv6 unicast-routing is needed before a router forwards IPv6.
• ip default-gateway vs a default route. The first works only with routing off.
• Inconsistent address and mask means host bits are set in the network.
• The return route. A ping from the router's WAN address can succeed while a LAN host fails.
• Recursive next hop. No route to the next hop, no static route in the table.
• Exit-interface routes leave the table when the interface goes down, and on Ethernet depend on proxy ARP.
• Host route = /32 or /128, exactly one address.
• Floating static. Distance above the primary: above 110 to back up OSPF, above 1 to back up a static. Equal distances load-share; 255 is never used.
• Longest match beats distance. A distance on a more specific route does not stop it winning.