Static Routing

Mental model

A router only knows two kinds of networks:

1. Directly attached: networks on one of its own interfaces. Learned automatically when you configure an IP + mask on an interface.
2. Reachable through some other router: it has to be told how to get there.

Static routing is the “telling”: manually configured entries.

Three legitimate use cases for static routing in 2026:

For anything bigger than ~5 routers with redundant paths, use a dynamic protocol. Static routing doesn’t recover from failures by itself unless you’ve layered a floating static or scripted reconvergence.

How a static route enters the routing table

Three conditions must all be true for a static route to appear in show ip route:

1. You configured it with ip route ....
2. The next-hop is reachable. The router must have a route to the next-hop IP (or the exit interface must be up/up).
3. No higher-priority route exists for the same prefix at a better (lower) AD.

If you write a static route but it doesn’t show in the route table, it’s almost always condition 2: the next-hop isn’t reachable. Test with ping <next-hop> from the router.

Three syntaxes: which to use when

Syntax 1: next-hop IP

R1(config)# ip route 10.2.0.0 255.255.255.0 10.0.1.2

Router does an ARP lookup for 10.0.1.2 to resolve the next-hop’s MAC, then forwards.

Use on: Ethernet, GRE tunnels, any multi-access medium where ARP makes sense.

Syntax 2: exit interface only

R1(config)# ip route 10.2.0.0 255.255.255.0 Serial0/0/0

Router sends packets directly out the named interface. No ARP needed (point-to-point links).

Use on: Serial / HDLC / PPP / point-to-point sub-interfaces. Never on plain Ethernet (causes catastrophic ARP for every destination IP).

Syntax 3: fully-specified (both)

R1(config)# ip route 10.2.0.0 255.255.255.0 GigabitEthernet0/0 10.0.1.2

Most explicit: tells the router both the exit interface and the next-hop. Helpful in scenarios with multiple paths or when you want to avoid recursive lookups.

Use on: any scenario where you want explicitness, especially when the next-hop is reachable through multiple interfaces.

The three-way comparison

Default route: the catch-all

A default route matches anything that doesn’t match a more specific route:

R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1

Read aloud: “for any destination, send to 203.0.113.1.”

This is the route that points to the internet on every home/edge router. Without it, any traffic to an unknown destination is dropped (and the router may even send an ICMP unreachable back).

Verify with:

R1# show ip route
Gateway of last resort is 203.0.113.1 to network 0.0.0.0

The phrase “Gateway of last resort” in show output is your hint that a default route exists. If missing, no default is set.

Default routes can be:

• Static: ip route 0.0.0.0 0.0.0.0 <next-hop>
• OSPF: default-information originate injects a default into OSPF
• EIGRP: redistribute a static default into EIGRP
• BGP: receive a default from your ISP (the most common in service-provider environments)

Floating static: the backup route

A floating static is a static route with artificially high administrative distance so it’s only used if the primary path fails:

! Primary path: OSPF learns 10.2.0.0/24 (AD 110)
! Backup path: static with AD 200
R1(config)# ip route 10.2.0.0 255.255.255.0 10.99.99.2 200

The floating static “floats”: present in the config always, but only inserted into the routing table when the better source disappears.

Use cases:

• Backup WAN link (primary = MPLS via OSPF; backup = LTE via static)
• Failover to a different egress router
• Maintenance-window simulation (administratively bump primary AD, watch static take over)

Critical: specify the AD. Static’s default AD is 1, beats everything. A “backup” static with default AD = 1 becomes the primary path.

Administrative Distance: the AD ladder

When the same prefix is learned from multiple sources, the router compares AD first. Lower AD wins.

You’ll be quizzed on the order in interviews and on the CCNA exam. Memorize the connected → static → eBGP → EIGRP → OSPF → RIP → iBGP ladder. See Routing Decision Process for the full process.

Recursive lookup: what happens behind the scenes

When you write:

ip route 10.2.0.0 255.255.255.0 10.0.1.2

The router does:

1. Packet arrives destined for 10.2.0.0/24.
2. Routing table says: “via 10.0.1.2.”
3. Router needs to know how to reach 10.0.1.2. Look up 10.0.1.2 in the routing table.
4. Finds: 10.0.1.0/30 is directly connected, Gi0/1.
5. ARP for 10.0.1.2 on Gi0/1. Get the MAC.
6. Build the Ethernet frame and send.

The lookup for 10.0.1.2 is the recursive lookup. If the routing table can’t find the next-hop, the static route is removed from the route table (still in running-config, but not active).

This is why “next-hop unreachable” is the #1 cause of “my static route isn’t showing up.” Always verify next-hop reachability first.

Summary routes (poor-man’s summarization with statics)

You can advertise a static summary by writing a single static for a large block:

R1(config)# ip route 10.0.0.0 255.255.0.0 Null0

Black-holes anything in 10.0.0.0/16 not matched by a more specific route. Used for:

• BGP origination: advertise a summary you “own” without route flapping when child prefixes flap.
• Loop prevention: prevent traffic from leaving your network for prefixes that shouldn’t exist.

The Null0 is a virtual “drop” interface. Combined with a more specific route to the real next-hop, you get summarization with safety:

R1(config)# ip route 10.0.0.0 255.255.0.0 Null0
R1(config)# ip route 10.0.1.0 255.255.255.0 10.0.99.2
R1(config)# ip route 10.0.2.0 255.255.255.0 10.0.99.2

If a packet arrives for 10.0.5.5 (which doesn’t have a specific route), it hits the /16 to Null0 and drops. No loop, no upstream confusion.

IPv6 static routes

Syntax mirrors IPv4 with ipv6 route and prefix notation:

R1(config)# ipv6 unicast-routing                              ! enable IPv6 routing globally
R1(config)# ipv6 route 2001:db8:2::/64 2001:db8:1::2          ! next-hop
R1(config)# ipv6 route 2001:db8:2::/64 GigabitEthernet0/0     ! exit interface
R1(config)# ipv6 route ::/0 2001:db8:1::1                      ! default route
R1(config)# ipv6 route 2001:db8:3::/64 2001:db8:9::2 200       ! floating static

Verification:

R1# show ipv6 route
R1# show ipv6 route static

All the same principles (next-hop, exit-interface, AD, floating) work identically.

Configuration patterns: production-quality

! With description for traceability
R1(config)# ip route 10.2.0.0 255.255.255.0 10.0.1.2 name BRANCH-2-PRIMARY

! With description + AD for floating backup
R1(config)# ip route 10.2.0.0 255.255.255.0 10.99.99.2 200 name BRANCH-2-BACKUP

! Default route via primary ISP
R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1 name DEFAULT-PRIMARY-ISP

! Floating default via backup ISP
R1(config)# ip route 0.0.0.0 0.0.0.0 198.51.100.1 200 name DEFAULT-BACKUP-ISP

! Black-hole an internal summary
R1(config)# ip route 10.0.0.0 255.255.0.0 Null0 name ENTERPRISE-SUMMARY

The name keyword adds a human-readable description visible in show running-config: a small touch, big help during outage debugging.

Verification

R1# show ip route
R1# show ip route static
R1# show ip route 10.2.0.0
R1# show ip route 10.2.0.5                          ! shows actual route for a specific IP
R1# show ip cef
R1# show ip cef 10.2.0.5
R1# show running-config | include ip route

show ip route 10.2.0.5 is the daily-driver: type any destination IP and the router tells you exactly which route would be used.

show ip cef (Cisco Express Forwarding) shows the FIB (Forwarding Information Base), the hardware-accelerated forwarding table. Useful when you suspect software-vs-hardware forwarding inconsistencies.

The 5-step static-routing debug

When a static route “isn’t working”:

1. Is the route in the running-config? show running-config | include ip route. If not, you never saved it or there was a typo.

2. Is the route in the routing table? show ip route static. If in running-config but not in the route table → next-hop unreachable. Verify with ping <next-hop>.

3. Mask correct? ip route 10.2.0.0 255.255.255.0 matches 10.2.0.0/24. If the destination is /23, you wrote the wrong mask.

4. Higher-priority route exists for the same prefix? show ip route <dest>: what AD won? If another protocol learned the same prefix at lower AD, your static is shadowed.

5. Recursive lookup OK? If the next-hop is several hops away, can the router get there? show ip route <next-hop> and walk the chain.

Worked scenarios

Scenario 1. R1 needs to reach 192.168.50.0/24. Next-hop is 10.0.0.2 on R1’s Ethernet. Write the static route.

Answer:

R1(config)# ip route 192.168.50.0 255.255.255.0 10.0.0.2

Scenario 2. R1 has two paths to 10.5.0.0/24: a primary via OSPF (AD 110) and a backup via static. You want the static to only kick in when OSPF fails. AD for the floating static?

Answer: Any AD > 110. Common choice: 200. Anything from 111 to 254 works. AD 255 means unreachable (the route never installs).

Scenario 3. A static route appears in show running-config but not in show ip route. The next-hop is 10.0.0.2. What’s wrong?

Answer: The router can’t reach 10.0.0.2 via any other route. Either the interface in that subnet is down, the next-hop IP is wrong, or there’s no path to that next-hop at all. Test with ping 10.0.0.2 from the router.

Scenario 4. You configured ip route 10.2.0.0 255.255.255.0 Serial0/0/0 on an Ethernet-attached router (no Serial interfaces at all). What happens?

Answer: The static route never installs because Serial0/0/0 doesn’t exist. Use next-hop IP on Ethernet, or specify the correct interface.

Scenario 5. R1 has a default route ip route 0.0.0.0 0.0.0.0 203.0.113.1. It also has a static for 10.0.0.0/8 via 10.99.99.2. A packet arrives for 10.1.5.5. Which route wins?

Answer: The /8 static. Longest-prefix match wins. 10.1.5.5 matches 10.0.0.0/8 (8 bits matching) and matches 0.0.0.0/0 (0 bits matching). /8 > /0, so the more specific wins regardless of order in the config.

Scenario 6. You want every router in the network to have a default route, but only the edge router has internet uplink. Most reliable approach?

Answer: Two options:

1. Manual: Static ip route 0.0.0.0 0.0.0.0 <next-hop> on every router, pointing at the next hop toward the edge.
2. Better: OSPF with default-information originate on the edge router; OSPF propagates the default to all neighbors automatically.

The second scales better and adapts to topology changes; the first requires touching every router on edits.

Scenario 7. A router has these two statics:

ip route 10.0.0.0 255.255.0.0 Null0
ip route 10.0.5.0 255.255.255.0 10.99.0.5

A packet arrives for 10.0.6.10. Where does it go?

Answer: Null0 (the summary). 10.0.6.10 falls in 10.0.0.0/16 but not in 10.0.5.0/24. Longest-prefix match → only the /16 matches → packet hits Null0 and drops. This is the deliberate “loop-prevention summary” pattern.

Scenario 8. You’re configuring a floating static as backup for a primary route via EIGRP (AD 90). You write:

ip route 10.5.0.0 255.255.255.0 10.99.0.5 90

Will this behave as a floating backup?

Answer: No. With AD 90 the static ties EIGRP. IOS never load-balances across two different route sources; it installs only one of them, which makes the backup unpredictable. Use any AD > 90, typically 200, to make it strictly a backup.

Common mistakes

1. Wrong mask. Writing 255.255.255.0 when the destination is a /16 means the route never matches. Double-check.

2. Pointing to a next-hop that isn’t reachable. Route appears in show running-config but never in show ip route. Test next-hop reachability first.

3. Using exit-interface on Ethernet without a next-hop. Causes the router to ARP for every destination IP. Use next-hop on Ethernet, or fully-specified.

4. Setting the floating AD equal to the primary protocol’s. The router installs only one of the two sources, so which one wins is unpredictable. Always pick an AD higher than the primary protocol’s.

5. Leaving floating static AD = 1. Default AD for static is 1, beats everything. If you don’t specify a higher AD, your “backup” static overrides OSPF/EIGRP as the primary.

6. Routing loops via reciprocal statics. R1 says “10.2.0.0 via R2”, R2 says “10.2.0.0 via R1.” Packets bounce between them until TTL expires. Always trace routes end-to-end.

7. No ipv6 unicast-routing for IPv6 statics. IPv6 routes won’t activate without the global enable, even if you’ve configured everything else.

8. Forgetting that Null0 drops packets, not “doesn’t route them.” A summary to Null0 black-holes anything not matched by more specific entries. Intended for some designs; a surprise for others.

9. Static default with no upstream connectivity check. Static defaults don’t track health. If the next-hop is alive but the path beyond it is broken, traffic still gets forwarded to a black hole. Combine with IP SLA + track to make a static health-aware:

   R1(config)# ip sla 1
   R1(config-ip-sla)# icmp-echo 8.8.8.8 source-interface Gi0/1
   R1(config-ip-sla)# frequency 5
   R1(config)# ip sla schedule 1 start-time now life forever
   R1(config)# track 1 ip sla 1 reachability
   R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1 track 1
   

   Now the default route is only installed when IP SLA confirms 8.8.8.8 is reachable.

10. Hard-coding next-hops that change. ISP-provided IPs may change. Use BGP if your upstream is multi-homed or large-scale; static only when the next-hop is fixed.

Lab to try tonight

1. Three-router line: HQ in the middle, BR1 left, BR2 right. /30 links. LAN behind each branch.

2. Configure statics on HQ: reach BR1 LAN (10.1.0.0/24) and BR2 LAN (10.2.0.0/24). Test with show ip route and ping.

3. Default routes on the branches. Each branch points its default to HQ. Verify with show ip route 0.0.0.0.

4. Branch-to-branch traffic: verify BR1 can reach BR2 via HQ (transit through HQ).

5. Floating backup: bring up a direct BR1↔BR2 link. On each branch, add a static for the other branch’s LAN via HQ (AD 1), then a floating static for the same /24 via the direct link with AD 200. Verify the floating static doesn’t install while the path through HQ is healthy. (A floating /24 that competes only with the default route would win immediately: longest prefix beats AD.)

6. Failure test: shutdown the HQ↔BR2 link. On BR2 the primary static loses its next-hop and the floating static installs. BR1 still points at HQ, because a static can’t see a failure beyond its next-hop; fix that with IP SLA tracking (step 9).

7. Recovery: no shutdown. Watch primary re-take over, floating static deactivate.

8. Null0 summary: on HQ, add ip route 10.0.0.0 255.0.0.0 Null0 as a black-hole summary. Confirm that any packet for an unassigned 10.x.x.x falls into Null0.

9. IP SLA-tracked default: configure an IP SLA pinging an internet target. Tie the default route’s installation to the track object. Block the internet target with an ACL. Watch the default route disappear.

10. Bonus: IPv6 static: enable ipv6 unicast-routing on all three. Add IPv6 statics to mirror the IPv4 ones. Verify with show ipv6 route.

Cheat strip

Frequently asked questions

Q: When should I use static routing instead of a dynamic protocol? A: When the topology is stable and small: a small branch site with one WAN link, or a stub network where there’s nothing to learn. Also for a default route pointing at the ISP (very common). Dynamic routing (OSPF, EIGRP, BGP) is worth the CPU cost as soon as you have redundancy, multiple sites, or frequent topology changes: statics don’t recompute paths when a link fails.

Q: What’s a default route? A: A route matching everything (destination 0.0.0.0/0 in IPv4 or ::/0 in IPv6): the “if nothing else matches, send it here” route. Almost every router has one, pointing at the next hop toward the internet. Configure with ip route 0.0.0.0 0.0.0.0 <next-hop>. Also called the “gateway of last resort” in show ip route output.

Q: What’s the difference between a next-hop IP and an exit interface in a static route? A: ip route 10.0.0.0 255.0.0.0 192.168.1.1 (next-hop IP) tells the router “send this to that neighbor”: the router resolves the next-hop’s MAC via ARP. ip route 10.0.0.0 255.0.0.0 Serial0/0 (exit interface) tells the router “send this out that interface”: on point-to-point links this is fine; on Ethernet it triggers proxy-ARP for every destination, which is wasteful. Best practice on multi-access (Ethernet) links: always specify next-hop IP.

Q: What happens if I have both a static route and OSPF for the same prefix? A: The static route wins because its administrative distance (AD) is 1 vs OSPF’s 110: lower AD is preferred. This is why manual statics can silently break dynamic routing: someone leaves a debug static in place, an OSPF path fails, and the fallback via OSPF never activates because the static is still “better” from the routing table’s perspective. Use ip route ... 254 (a “floating static” with higher AD) if you want the static to only be used when the dynamic route fails.

Q: How do I remove a static route? A: no ip route followed by the same arguments used to add it. no ip route 10.0.0.0 255.0.0.0 192.168.1.1 removes the exact route. If you don’t remember the exact next-hop, show run | include ip route 10.0.0.0 shows all matching lines. Removing a route doesn’t remove any dynamic-protocol-learned version. Those are still in the routing table.