LearnCCNA

Search

Objective 3.3

Configure and verify IPv4 and IPv6 static routing

A static route is a route that an administrator types into the router by hand. The router does not learn it, does not age it out, and does not update it when the network changes; it simply trusts what you typed. Static routes are perfect for small networks, for stub networks with only one way in and out, for default routes toward an ISP, and as backups to dynamic routing. They are a poor fit for large networks, because every change must be typed on every affected router.

The exam tests four kinds of static route (default, network, host, floating) for both IPv4 and IPv6, plus the three ways of specifying where a static route points. We begin with the general syntax, then cover each kind.

IPv4 static route syntax: three ways to point the route

The IPv4 command is entered in global configuration mode:

Router(config)# ip route <destination> <mask> {<next-hop> | <interface> |
                <interface> <next-hop>} [<distance>]

Written out, the three forms are:

1. Next-hop form. You give only the IP address of the neighbor router. The router performs a recursive lookup to find the exit interface. This is the most common form and works on any interface type.

R1(config)# ip route 10.9.9.0 255.255.255.0 10.1.1.2

Routing table result:

S        10.9.9.0/24 [1/0] via 10.1.1.2

2. Exit-interface form (directly attached static route). You give only the local interface. The router treats the destination as if it were directly connected to that interface. This is fine on point-to-point links such as serial lines, where there is only one possible device at the other end. On a multi-access Ethernet interface it is a bad idea: the router must ARP for every individual destination address in the remote network, which only works if the neighbor performs proxy ARP, and it bloats the ARP table.

R1(config)# ip route 10.9.9.0 255.255.255.0 Serial0/0/0

Routing table result (note the different wording and the absence of [1/0]):

S        10.9.9.0/24 is directly connected, Serial0/0/0

3. Fully specified form. You give both the exit interface and the next-hop address. No recursive lookup is needed, and no proxy ARP is needed because the router knows exactly which interface to use and exactly which neighbor to ARP for. This is the recommended form on Ethernet links when you want to avoid recursion.

R1(config)# ip route 10.9.9.0 255.255.255.0 GigabitEthernet0/0 10.1.1.2

Routing table result:

S        10.9.9.0/24 [1/0] via 10.1.1.2, GigabitEthernet0/0

In all three forms, the route is installed only if the exit interface is up/up (for the interface forms) or the next hop is reachable via some route in the table (for the next-hop form). If the interface goes down, the static route silently disappears from show ip route and reappears when the interface comes back. It remains in the running configuration the whole time.

A complete IPv4 static routing example

Topology: R1’s Gi0/0 is 10.1.1.1/24 (LAN). R1’s Gi0/1 is 10.1.12.1/30, connected to R2’s Gi0/1 10.1.12.2/30. R2’s Gi0/0 is 10.2.2.1/24 (R2’s LAN). R2’s Gi0/2 is 203.0.113.2/30 toward an ISP router at 203.0.113.1.

R1 needs a route to R2’s LAN and a default route toward the Internet through R2:

R1(config)# ip route 10.2.2.0 255.255.255.0 10.1.12.2
! Network route: reach R2's LAN via R2
R1(config)# ip route 0.0.0.0 0.0.0.0 10.1.12.2
! Default route: everything else also goes to R2

R2 needs a route back to R1’s LAN and its own default route to the ISP:

R2(config)# ip route 10.1.1.0 255.255.255.0 10.1.12.1
! Network route back to R1's LAN
R2(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1
! Default route toward the ISP

Verification on R1:

R1# show ip route static
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       ...
Gateway of last resort is 10.1.12.2 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 10.1.12.2
      10.0.0.0/8 is variably subnetted, 5 subnets, 3 masks
S        10.2.2.0/24 [1/0] via 10.1.12.2

R1# show running-config | include ip route
ip route 0.0.0.0 0.0.0.0 10.1.12.2
ip route 10.2.2.0 255.255.255.0 10.1.12.2

R1# ping 10.2.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms

show ip route static filters the output to static routes only. show ip route <address> shows exactly which single route the router would use for a destination, which is the fastest way to answer “which path will this packet take?”:

R1# show ip route 10.2.2.50
Routing entry for 10.2.2.0/24
  Known via "static", distance 1, metric 0
  Routing Descriptor Blocks:
  * 10.1.12.2
      Route metric is 0, traffic share count is 1

Routes are removed with the no form, and you must repeat the destination and mask:

R1(config)# no ip route 10.2.2.0 255.255.255.0 10.1.12.2

3.3.a Default route

A default route matches every destination and is used when nothing more specific matches. Its prefix and mask are all zeros:

R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1

This installs S* 0.0.0.0/0 [1/0] via 203.0.113.1 and sets the gateway of last resort. Read the command as “for destination 0.0.0.0 with mask 0.0.0.0 (i.e., match zero bits, so match everything), send to 203.0.113.1.”

Default routes are used at the edge of a network where all unknown traffic should go one way: a branch office toward headquarters, or an enterprise edge router toward the ISP. On a serial point-to-point link you may also see the exit-interface form ip route 0.0.0.0 0.0.0.0 Serial0/0/0.

The IPv6 default route uses ::/0, which is the same idea (all-zeros address, zero-bit prefix length):

R1(config)# ipv6 route ::/0 2001:db8:12::2

3.3.b Network route

A network route (the ordinary static route) points to a whole subnet: a prefix with any mask shorter than /32. All of the examples above except the default route are network routes. For instance, ip route 10.2.2.0 255.255.255.0 10.1.12.2 says “the 256 addresses from 10.2.2.0 to 10.2.2.255 are reachable via 10.1.12.2.”

A network route can also be a summary that covers many smaller subnets in one line. If R2 has LANs 10.2.0.0/24, 10.2.1.0/24, 10.2.2.0/24, and 10.2.3.0/24, R1 does not need four routes; one summary covers all of them:

R1(config)# ip route 10.2.0.0 255.255.252.0 10.1.12.2
! 10.2.0.0/22 covers 10.2.0.0 through 10.2.3.255

Summaries keep routing tables small. The trade-off is that a summary may claim addresses that do not actually exist yet, so traffic to a nonexistent subnet inside the summary is forwarded to R2, which then drops it.

3.3.c Host route

A host route points to a single address. In IPv4 it uses the mask 255.255.255.255 (/32); in IPv6 it uses /128. Host routes are used to steer traffic for one specific server down a particular path, or to reach a device such as a management loopback.

R1(config)# ip route 10.2.2.100 255.255.255.255 10.1.12.2
! Only the single address 10.2.2.100 is covered
R1(config)# ipv6 route 2001:db8:2::100/128 2001:db8:12::2

Routing table result:

S        10.2.2.100/32 [1/0] via 10.1.12.2

Because a /32 is the longest possible IPv4 prefix, a host route always wins the longest-prefix-match lookup for its one address, even against a connected route. That is also why IOS represents the router’s own interface addresses as L /32 routes.

3.3.d Floating static

A floating static route is a static route whose administrative distance has been raised so that it is worse than a route learned from a dynamic protocol (or than another static route). The router installs the better route normally and keeps the floating static in reserve. When the primary route disappears, the floating static “floats up” into the routing table and carries traffic until the primary returns.

The classic use case is a backup WAN link. Suppose R1 reaches 10.2.2.0/24 through OSPF over a fast primary link (AD 110) and also has a slow backup link (a cellular or DSL connection) to a neighbor at 172.16.5.2. You want the backup used only when OSPF loses the route:

R1(config)# ip route 10.2.2.0 255.255.255.0 172.16.5.2 130
! AD 130 is worse than OSPF's 110, so OSPF wins while it is alive

While OSPF is healthy:

R1# show ip route 10.2.2.0
Routing entry for 10.2.2.0/24
  Known via "ospf 1", distance 110, metric 2, type intra area

The static route is nowhere in the routing table, although it is still in the running configuration. When the primary link fails and OSPF withdraws the route:

R1# show ip route 10.2.2.0
Routing entry for 10.2.2.0/24
  Known via "static", distance 130, metric 0

When OSPF comes back, the OSPF route (AD 110) replaces the static (AD 130) again automatically.

The same technique also makes a backup default route. If the primary default is learned from an ISP by eBGP (AD 20) or by OSPF (AD 110), a floating static default with a higher AD sits in reserve:

R1(config)# ip route 0.0.0.0 0.0.0.0 172.16.5.2 250

Any AD from 2 up to 254 works as long as it is numerically higher than the AD of the primary route. AD 255 would make the route unusable, so never use it.

IPv6 static routing

IPv6 static routes work the same way, with three differences you must remember:

  1. IPv6 routing is off by default on Cisco routers. You must enable it with ipv6 unicast-routing in global configuration mode, or the router will not forward IPv6 packets between interfaces at all (it will still have IPv6 addresses and can ping, but it will not route).
  2. The mask is written as a prefix length (/64), never in dotted-decimal.
  3. If the next hop is a link-local address (fe80::...), you must also specify the exit interface, because link-local addresses are only unique per link and the router cannot resolve which interface to use.

The syntax is:

Router(config)# ipv6 route <prefix>/<length> {<next-hop> | <interface> |
                <interface> <next-hop>} [<distance>]

Full example using the same topology, now with IPv6 addresses. R1 Gi0/0 is 2001:db8:1::1/64, R1 Gi0/1 is 2001:db8:12::1/64, R2 Gi0/1 is 2001:db8:12::2/64 with link-local fe80::2, and R2’s LAN is 2001:db8:2::/64.

R1(config)# ipv6 unicast-routing
! Turn on IPv6 forwarding; without this nothing is routed
R1(config)# ipv6 route 2001:db8:2::/64 2001:db8:12::2
! Network route using a global unicast next hop
R1(config)# ipv6 route 2001:db8:2::100/128 2001:db8:12::2
! Host route to one server
R1(config)# ipv6 route ::/0 2001:db8:12::2
! Default route
R1(config)# ipv6 route 2001:db8:3::/64 GigabitEthernet0/1 fe80::2
! Link-local next hop: the exit interface is REQUIRED
R1(config)# ipv6 route 2001:db8:2::/64 2001:db8:99::2 150
! Floating static backup with AD 150

Verification:

R1# show ipv6 route
IPv6 Routing Table - default - 8 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, R - RIP, H - NHRP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external, ND - ND Default, NDp - ND Prefix, DCE - Destination
       NDr - Redirect, RL - RPL, O - OSPF Intra, OI - OSPF Inter
       OE1 - OSPF ext 1, OE2 - OSPF ext 2, ON1 - OSPF NSSA ext 1
       ON2 - OSPF NSSA ext 2, la - LISP alt, lr - LISP site-registrations
       ld - LISP dyn-eid, lA - LISP away, le - LISP extranet-policy
       lp - LISP publications, a - Application, m - OMP
S   ::/0 [1/0]
     via 2001:DB8:12::2
C   2001:DB8:1::/64 [0/0]
     via GigabitEthernet0/0, directly connected
L   2001:DB8:1::1/128 [0/0]
     via GigabitEthernet0/0, receive
S   2001:DB8:2::/64 [1/0]
     via 2001:DB8:12::2
S   2001:DB8:2::100/128 [1/0]
     via 2001:DB8:12::2
S   2001:DB8:3::/64 [1/0]
     via FE80::2, GigabitEthernet0/1
C   2001:DB8:12::/64 [0/0]
     via GigabitEthernet0/1, directly connected
L   2001:DB8:12::1/128 [0/0]
     via GigabitEthernet0/1, receive
L   FF00::/8 [0/0]
     via Null0, receive

Points to notice in the output:

  • IPv6 output puts the via information on a second, indented line.
  • L ...::1/128 ... receive is the IPv6 local route, exactly like the IPv4 L /32.
  • L FF00::/8 via Null0, receive is always present: it represents the multicast range.
  • The floating static (AD 150) does not appear because the AD-1 static for the same prefix is installed. show ipv6 route static would still not show it; only the running config does.
  • IPv6 addresses are displayed in uppercase hex by IOS, but you can type them in lowercase.

Other verification commands: show ipv6 route static, show ipv6 interface brief, ping ipv6 2001:db8:2::1 (or simply ping 2001:db8:2::1), and show running-config | include ipv6 route.