Routing fundamentals

0 of 37 nailed

Core14

Walk me through how a router decides where to send a packet.
Say this first
There are two separate jobs. To build the table, the router keeps one source per exact prefix: the lowest administrative distance wins, and inside one protocol the lowest metric wins (equal metrics become ECMP). To forward a packet, it uses the longest prefix in the table that matches the destination. Prefix length comes first: a /24 from RIP beats a /16 from OSPF, because AD only compares routes to the same prefix.
Go deeper
Building the routing table (control plane)

Each protocol picks its own best path with its own metric: OSPF cost, EIGRP composite metric, RIP hop count, the BGP best path algorithm.

Each protocol offers that route to the RIB.

If two sources offer the same prefix and the same length, the lower administrative distance wins. The loser stays in its own protocol table and is installed if the winner goes away.

Equal-metric paths from one protocol are installed together, up to maximum-paths.

Forwarding a packet (data plane)
CEF looks up the destination in the FIB, which is built from the RIB, and uses the most specific matching entry. If nothing matches and there is no default route, the packet is dropped and the router sends ICMP Destination Unreachable to the source.

Worked example
Output
O 10.1.0.0/16 [110/20] via 10.0.12.2 R 10.1.1.0/24 [120/2] via 10.0.13.2 S* 0.0.0.0/0 [1/0] via 203.0.113.1
Destination Entries that match Entry used Why
10.1.1.5 /24, /16, /0 RIP /24 longest match, AD is never compared
10.1.2.5 /16, /0 OSPF /16 longest match
192.0.2.10 /0 static default only match
If RIP and OSPF both advertised exactly 10.1.1.0/24, only the OSPF copy (AD 110) would be installed.
They will ask next
Can you compare an OSPF cost with an EIGRP metric?
No. A metric only means something inside its own protocol. Between protocols the router uses administrative distance, and only when the prefixes are identical.

What happens to the route that loses on AD?
It stays in its protocol's own table (OSPF database, EIGRP topology table, BGP table, static config) but not in the RIB. When the winner is removed, the next best source is installed. Floating static routes depend on exactly this behaviour.

Where does ECMP fit in this order?
After metric. If one protocol has several paths with the same best metric to the same prefix, all of them go into the RIB up to the maximum-paths limit, and CEF shares traffic across them per flow.
Traps
Saying the router checks administrative distance first when forwarding. AD only decides which source installs a prefix; the lookup itself is longest match.
Blending the two jobs together. Interviewers listen for the split between building the table and using it.
How did you do?Book 3.3 Internet (IP)Book 3.4 Routing Own page

Destination	Entries that match	Entry used	Why
10.1.1.5	/24, /16, /0	RIP /24	longest match, AD is never compared
10.1.2.5	/16, /0	OSPF /16	longest match
192.0.2.10	/0	static default	only match

Explain longest prefix match with an example. Which route does the router use for a few different destinations?

Say this first

The router compares the destination address with every prefix in its table and uses the matching entry with the most mask bits. A /25 beats a /24, which beats a /16, which beats the /0 default, no matter which protocol or AD each came from. The default route matches everything, which is why it is used last.

Go deeper

The table

Output

S*    0.0.0.0/0 [1/0] via 203.0.113.1
O        10.0.0.0/8 [110/30] via 10.255.0.2, 00:10:02, GigabitEthernet0/0/1
D        10.20.0.0/16 [90/3072] via 10.255.1.2, 00:10:02, GigabitEthernet0/0/2
O        10.20.30.0/24 [110/20] via 10.255.0.2, 00:10:02, GigabitEthernet0/0/1
S        10.20.30.128/25 [1/0] via 10.255.2.2

The lookups

Destination	Entries that match	Winner
10.20.30.200	/0, /8, /16, /24, /25	static /25 via 10.255.2.2
10.20.30.100	/0, /8, /16, /24	OSPF /24, even though the EIGRP /16 has a lower AD
10.20.99.1	/0, /8, /16	EIGRP /16
10.99.1.1	/0, /8	OSPF /8
172.16.5.5	/0	static default

Why .200 and .100 split

A /25 fixes the first bit of the last octet. 10.20.30.128/25 covers .128 to .255.

200 is 11001000: the first bit is 1, so it is inside the /25.
100 is 01100100: the first bit is 0, so it is not, and the /24 is the best match.

How fast routers do it

IOS CEF stores the FIB in a multiway trie keyed on address bits. Hardware platforms do the same lookup in the ASIC, with TCAM (entries sorted so the first hit is the longest) or an algorithmic LPM table. Either way the lookup cost does not grow with the number of routes.

They will ask next

Why would anyone install a /32 route?
A /32 is the most specific match possible, so it always wins. Loopbacks used as router IDs and BGP next hops are /32s, remotely triggered black holing uses /32s, and a /32 static can pin an IP SLA probe to one path.
What if the most specific match points at Null0?
The packet is dropped, even if a shorter route (like the default) would have delivered it. That is exactly how summary discard routes stop loops.

Traps

Picking the route with the lower AD or metric when the prefix lengths differ. Length is compared first.
Doing the binary on the wrong octet. Find the octet where the mask stops, and only look there.

How did you do?Book 3.3 Internet (IP)Own page

What is administrative distance, and what are the default values on a Cisco router?

Say this first

Administrative distance is how much the router trusts a source of routing information. When two sources offer the same prefix, the lower AD is installed. It is local to the router and is never advertised. Connected 0, static 1, EIGRP summary 5, eBGP 20, EIGRP internal 90, IGRP 100, OSPF 110, IS-IS 115, RIP 120, EIGRP external 170, iBGP 200, unknown 255 (never installed).

Go deeper

The full Cisco table

Source	AD
Connected interface	0
Static route	1
EIGRP summary (discard route on the summarizing router)	5
eBGP	20
EIGRP internal	90
IGRP (obsolete)	100
OSPF (intra-area, inter-area and external alike)	110
IS-IS	115
RIP	120
ODR (On-Demand Routing)	160
EIGRP external	170
iBGP and locally originated BGP aggregates	200
Default route learned with `ip address dhcp`	254
Unknown or untrusted	255

Details people get wrong

A static route that names only an exit interface shows is directly connected in the table, but its AD is still 1. show ip route for it says distance 1, metric 0 (connected).
OSPF gives the same 110 to every route type by default. You can split them with distance ospf intra-area 110 inter-area 110 external 120.
AD 255 means the route is never installed. Setting a static route to 255 is a way to keep it in the config but out of the table.

Other vendors

Junos calls it route preference: direct 0, static 5, OSPF internal 10, IS-IS level 1 internal 15, level 2 internal 18, RIP 100, OSPF external 150, BGP 170 (the same for iBGP and eBGP). The idea is identical, the numbers are not, which matters when you mix vendors and redistribute.

They will ask next

Why is eBGP 20 but iBGP 200?
A prefix learned straight from another AS over eBGP is normally the only good way to reach it, so it should beat an IGP copy. A prefix learned over iBGP is usually internal or already known to the IGP, and the IGP knows the real path inside the AS. AD 200 makes sure the IGP route wins, which also keeps BGP next hops resolved through the IGP instead of through BGP itself.
Is the AD sent to neighbors?
No. AD is a local tie-breaker. Two routers can use different values, which is useful for a migration but can also create loops if done carelessly.
How do you change it?
Per static route with a number at the end (ip route 0.0.0.0 0.0.0.0 198.51.100.1 250), per protocol with the distance command (distance eigrp 90 170, distance bgp 20 200 200), or per source and prefix with distance <ad> <source> <wildcard> <acl> in RIP and EIGRP.

Traps

Saying a static route to an interface has AD 0. It is 1; it is only displayed as directly connected.
Forgetting EIGRP external 170. It is the value behind most redistribution surprises with OSPF.
Quoting Junos and Cisco numbers as if they were the same table.

How did you do?Book 3.4 Routing Own page

What is the difference between administrative distance and metric?

Say this first

Metric ranks paths inside one routing protocol: it is advertised and grows hop by hop. Administrative distance ranks different sources of the same prefix: it is local to one router and never advertised. The router uses metric to choose the best OSPF path, then AD to choose between that OSPF route and, say, an EIGRP route to the exact same prefix.

Go deeper

	Administrative distance	Metric
Compares	different sources (protocols, statics)	paths inside one protocol
Scope	local to the router	carried in updates, accumulates
Applies when	same prefix and length from two sources	always, inside the protocol
Shown as	first number in `[110/20]`	second number in `[110/20]`

Example

R1 learns 10.5.0.0/24 from OSPF with cost 3 and from EIGRP with metric 3072. The numbers are not comparable. R1 installs the EIGRP route because 90 is lower than 110:

Output

D        10.5.0.0/24 [90/3072] via 10.0.13.2, 00:02:11, GigabitEthernet0/0/2

If OSPF had two paths, one with cost 3 and one with cost 5, OSPF itself would have picked cost 3 before offering anything to the RIB.

Order of decisions

Inside each protocol: best metric.
Between sources, for the same prefix: lowest AD.
For each packet: longest prefix match across everything installed.

They will ask next

Two routes to the same prefix have the same AD and the same metric. What happens?
If they come from the same protocol, both are installed as equal cost paths (ECMP) up to maximum-paths. Two different protocols with the same AD is a corner case you only get by changing defaults, and you should avoid building it.

Traps

Saying a lower metric beats a lower AD. Metric is never compared across protocols.

How did you do?Book 3.4 Routing Own page

What metric does each common routing protocol use?

Say this first

RIP counts hops, up to 15. OSPF uses cost, by default 100 Mbps divided by interface bandwidth, summed along the path. EIGRP uses a composite of the slowest bandwidth and total delay. IS-IS uses a metric of 10 per interface by default regardless of speed. BGP has no single metric: it picks a path with an ordered list of attributes, and its MED attribute is the one called "metric".

Go deeper

Protocol	Metric	Default behaviour to know
RIP	hop count	16 means unreachable, so the network is at most 15 hops wide
OSPF	cost = reference bandwidth / interface bandwidth	reference is 100 Mbps, so FastEthernet, 1G and 10G all cost 1
EIGRP	256 x (10^7 / slowest bandwidth in kbps + total delay in tens of microseconds)	with default K values only bandwidth and delay count
IS-IS	sum of interface metrics	every interface is 10 unless you set it; narrow metrics cap a link at 63
BGP	best path algorithm	weight, local preference, AS path length, origin, MED and more, in order

OSPF reference bandwidth

Because the default reference is 100 Mbps, OSPF cannot tell 1G from 100G. Set the same value on every router in the domain, in Mbps:

Cisco IOS

router ospf 1
 auto-cost reference-bandwidth 400000

EIGRP worked number

One GigabitEthernet hop to a neighbor's GigabitEthernet LAN: 10^7 / 1,000,000 = 10, total delay 10 + 10 microseconds = 2 tens of microseconds, so 256 x (10 + 2) = 3072. That is the [90/3072] you see so often in labs. Named mode with wide metrics scales this for links faster than 1 Gbps.

They will ask next

Why does hop count make RIP a poor choice on mixed links?
It treats a 1 Gbps hop and a slow WAN hop as equal, so RIP happily sends traffic over two slow links instead of three fast ones.
What do you set the IS-IS metric to in practice?
Operators enable wide metrics (metric-style wide) and set metrics per link by bandwidth or by design intent, because the default of 10 everywhere ignores speed.

Traps

Forgetting to raise the OSPF reference bandwidth, then wondering why OSPF load balances a 1G and a 10G link.
Saying BGP uses hop count. AS path length is one tie-breaker deep in the list, not a metric.

How did you do?Book 3.4 Routing Own page

Read this show ip route output for me. What does each part of a route line mean?

Say this first

Each line gives the source code (C, L, S, O, D, B and so on), the prefix, [AD/metric], the next hop after via, the age of the route and the exit interface. Header lines group subnets of one classful network and count subnets and masks. Gateway of last resort shows the default route, and * marks a candidate default.

Go deeper

The output

Output

R1# show ip route | begin Gateway
Gateway of last resort is 203.0.113.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 203.0.113.1
      10.0.0.0/8 is variably subnetted, 8 subnets, 4 masks
C        10.0.12.0/30 is directly connected, GigabitEthernet0/0/1
L        10.0.12.1/32 is directly connected, GigabitEthernet0/0/1
C        10.0.13.0/30 is directly connected, GigabitEthernet0/0/2
L        10.0.13.1/32 is directly connected, GigabitEthernet0/0/2
O        10.1.0.0/24 [110/2] via 10.0.12.2, 01:12:44, GigabitEthernet0/0/1
D        10.2.0.0/16 [90/3072] via 10.0.13.2, 00:45:10, GigabitEthernet0/0/2
O IA     10.5.0.0/16 [110/3] via 10.0.12.2, 01:12:44, GigabitEthernet0/0/1
O E2     10.9.0.0/16 [110/20] via 10.0.12.2, 00:03:51, GigabitEthernet0/0/1
      203.0.113.0/24 is variably subnetted, 2 subnets, 2 masks
C        203.0.113.0/30 is directly connected, GigabitEthernet0/0/0
L        203.0.113.2/32 is directly connected, GigabitEthernet0/0/0

| begin Gateway skips the long legend of codes.

Reading one line

O IA 10.5.0.0/16 [110/3] via 10.0.12.2, 01:12:44, GigabitEthernet0/0/1

O IA: OSPF inter-area route.
[110/3]: AD 110, OSPF cost 3.
via 10.0.12.2: next hop. 01:12:44: time since the route was last changed. Then the exit interface.

Codes you must know

Code	Meaning
C, L	connected subnet, local /32 of the router's own address
S, S*	static, static that is a candidate default
O, O IA, O E1, O E2, O N1, O N2	OSPF intra-area, inter-area, external type 1 and 2, NSSA external
D, D EX	EIGRP internal, EIGRP external
B	BGP
i L1, i L2, i ia	IS-IS level 1, level 2, inter-area
R	RIP

The 10.0.0.0/8 is variably subnetted, 8 subnets, 4 masks header counts the entries under it (8) and the different lengths among them (/30, /32, /24 and /16).

They will ask next

What does an ECMP route look like?

One prefix line, then one extra line per path:

Output

O        10.1.0.0/24 [110/2] via 10.0.12.2, 01:12:44, GigabitEthernet0/0/1
                     [110/2] via 10.0.13.2, 01:12:44, GigabitEthernet0/0/2

How do you see everything about one route?

Give an address: show ip route 10.5.1.1.

Output

Routing entry for 10.5.0.0/16
  Known via "ospf 1", distance 110, metric 3, type inter area
  Last update from 10.0.12.2 on GigabitEthernet0/0/1, 01:12:44 ago
  Routing Descriptor Blocks:
  * 10.0.12.2, from 10.255.0.2, 01:12:44 ago, via GigabitEthernet0/0/1
      Route metric is 3, traffic share count is 1

from 10.255.0.2 is the router ID of the router that advertised it (here the ABR). The * marks the path the router is currently using.

Why do static routes have no age?
The age shows when a protocol last refreshed or changed the route. Static routes are not learned from anyone, so IOS prints none.

Traps

Reading [110/20] as metric 110. The first number is AD.
Reading the age as uptime of the neighbor. It is the time since the route itself last changed.

How did you do?Book 3.3 Internet (IP)Own page

What are connected and local routes, and why does IOS show an L route for every interface?
Say this first
A connected route (C) is the subnet of an interface that has an IP address and is up/up. Since IOS 15 the router also shows a local route (L), a /32 for its own address on that interface. The L route makes the router's own addresses visible in the routing table. In CEF they are receive entries: packets to them are punted to the CPU instead of being forwarded.
Go deeper
Example
Output
C 10.0.12.0/30 is directly connected, GigabitEthernet0/0/1 L 10.0.12.1/32 is directly connected, GigabitEthernet0/0/1
The router owns 10.0.12.1. Anything else in 10.0.12.0/30 is reached by ARP on Gi0/0/1.

When they appear and disappear

Both need an IP address and line protocol up. Shut the interface, or lose the link, and both are removed at once, along with every static route that depended on that interface.

Secondary addresses get their own C and L entries.

Connected routes have AD 0, so no protocol can override them for the same prefix.

Redistribution
redistribute connected takes the C routes. The L /32s are not redistributed. If you want a router's loopback in another protocol, it is the connected subnet of the loopback that gets advertised.

Other platforms
Junos shows the same pair as Direct (the subnet) and Local (the /32). Linux puts local addresses in the separate local table (ip route show table local).
They will ask next
An interface is up/down. Is its subnet in the routing table?
No. Connected routes need line protocol up. That is why a static route pointing out that interface also disappears, which is exactly the behaviour you want for failover on a link that really goes down.
Traps
Thinking L routes are learned from somewhere. They are generated from the router's own addresses.
How did you do?Book 3.3 Internet (IP)Own page

A packet arrives and nothing in the routing table matches its destination. What does the router do?

Say this first

It drops the packet and sends an ICMP Destination Unreachable, type 3 code 0 (network unreachable), back to the source. The ICMP is rate limited. With a default route there is always a match, so this only happens when the router has no gateway of last resort.

Go deeper

What you see

show ip route says Gateway of last resort is not set. A Windows host shows Reply from 10.0.12.1: Destination net unreachable. with the router's address. A ping from another IOS router shows U.U.U: each U is an unreachable reply and each dot is one the router suppressed by rate limiting.

Related cases that look similar

Situation	Result
No route at all	drop, ICMP type 3 code 0
Route exists, destination is on a connected subnet, ARP gets no answer	drop, ICMP host unreachable (code 1)
Route points to Null0	drop, ICMP unreachable unless `no ip unreachables` is set on Null0
TTL reaches 0	drop, ICMP time exceeded (type 11)

Rate limiting and hardening

IOS rate limits ICMP unreachables by default (ip icmp rate-limit unreachable). Many operators also put no ip unreachables on Null0 and on internet-facing interfaces, so a flood of packets to discarded destinations does not turn into a flood of ICMP from the router's CPU.

They will ask next

Why does a traceroute sometimes show a star at the last hop of a router?
The last hop answers with ICMP port unreachable, and IOS rate limits unreachables. A burst of three probes often gets one reply suppressed, so you see something like 2 msec * 2 msec.

Traps

Saying the router floods the packet or sends it to every neighbor. Routers drop what they cannot route.

How did you do?Book 3.3 Internet (IP)Own page

When would you use static routes instead of a dynamic routing protocol?

Say this first

Static routes fit small or stub places where there is one way out: a branch with a single WAN link, a default route to an ISP, a route to a firewall or a partner. They cost nothing and do exactly what you typed. They do not notice failures on their own and do not scale. Once there are redundant paths or many prefixes, a dynamic protocol is easier and safer. Most networks use both.

Go deeper

	Static	Dynamic
CPU, memory, bandwidth	none	hellos, updates, SPF or DUAL
Failover	only if the interface goes down, or with tracking	automatic
Scale	every change is manual on every router	adds and removes routes itself
Predictability	exactly what you configured	depends on metrics and timers
Security	nothing to spoof	needs authentication and passive interfaces

Typical static uses

Default route at the internet edge.
Stub branch: the branch has a default to the hub, and the hub has a static for the branch subnet, often redistributed into the IGP.
Floating static backup over LTE or a VPN.
Null0 discard routes for aggregates you announce in BGP.
Routes to devices that do not run a protocol, such as some firewalls and appliances.

They will ask next

What breaks first when a network built on statics grows?
Consistency. Every new subnet needs edits on many routers, people miss one, and you get black holes or asymmetric paths. Failover also needs IP SLA tracking on every static that matters.

Traps

Claiming static routes always fail over when the path breaks. They only react to their own interface going down, unless you add tracking.

How did you do?Book 3.4 Routing Own page

What are the different ways to write a static route on IOS, and which one should you use on Ethernet?

Say this first

Next hop only, exit interface only, or both (fully specified). On Ethernet use a next hop or, better, both. Exit interface only on a multi-access link makes the router ARP for every destination and depend on proxy ARP. On a point-to-point link such as a serial, PPP or tunnel interface, exit interface only is fine because there is only one possible neighbor.

Go deeper

The three forms

Cisco IOS

ip route 192.0.2.0 255.255.255.0 10.0.12.2
ip route 192.0.2.0 255.255.255.0 GigabitEthernet0/0/1
ip route 192.0.2.0 255.255.255.0 GigabitEthernet0/0/1 10.0.12.2

Form	How it resolves	Watch out for
Next hop	recursive lookup of 10.0.12.2	can resolve through another route, even the default
Exit interface	treated as directly connected	ARP per destination on Ethernet
Fully specified	uses that interface and that neighbor	none; best on Ethernet

Useful options at the end of the line

Cisco IOS

ip route 0.0.0.0 0.0.0.0 198.51.100.1 250 name BACKUP-LTE
ip route 0.0.0.0 0.0.0.0 203.0.113.1 track 1 name ISP1
ip route 10.99.0.0 255.255.0.0 10.0.12.2 tag 500

A number is the AD (floating static).
track ties the route to an IP SLA or interface tracking object.
tag marks the route for route-maps during redistribution.
name is a comment that shows up in the config.
permanent keeps the route even when the interface goes down. Use it rarely.

When the route leaves the table

A static is installed only while its next hop resolves and its interface is up. Fully specified routes leave the table as soon as their interface goes down. Next hop only routes can survive by resolving the next hop through some other route, which is a common surprise.

They will ask next

What do you get on IPv6?
The same three forms with ipv6 route. If the next hop is a link-local address you must also give the interface, because link-local addresses are only unique per link.

Traps

Pointing a default route at an Ethernet interface with no next hop. It works in a lab and hurts in production.

How did you do?Book 3.3 Internet (IP)Own page

How do you configure a default route, and what is the difference between ip route 0.0.0.0, ip default-gateway and ip default-network?

Say this first

ip route 0.0.0.0 0.0.0.0 <next-hop> installs a static default and is what you use on a router. ip default-gateway only works when IP routing is off, for example on a layer 2 switch for its management address. ip default-network is a legacy command that flags a classful network as a candidate default; you rarely see it now.

Go deeper

On a router

Cisco IOS

ip route 0.0.0.0 0.0.0.0 203.0.113.1

Output

Gateway of last resort is 203.0.113.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 203.0.113.1

0.0.0.0/0 matches every address with a prefix length of 0, so longest match makes it the last resort.

On a layer 2 switch

Cisco IOS

no ip routing
ip default-gateway 10.10.99.1

With ip routing enabled, IOS ignores ip default-gateway. That is a classic reason a layer 3 switch cannot be reached from another subnet after someone turned routing on.

Sending a default into a protocol

Protocol	Usual way
OSPF	`default-information originate` (add `always` to send it without a default in the RIB)
EIGRP	redistribute the static default, or a summary of 0.0.0.0/0 on an interface
RIP	`default-information originate`
BGP	`neighbor x.x.x.x default-originate`, or `network 0.0.0.0` with a default in the RIB

IPv6 uses ipv6 route ::/0 <next-hop>.

They will ask next

Why do people say always is dangerous with OSPF default-information originate?
With always, the router advertises a default even when it has no way out. If its internet link fails, it keeps attracting traffic and drops it. Without always, the advertisement follows the presence of a default in its own table.

Traps

Using ip default-gateway on a router with routing enabled and expecting it to work.

How did you do?Book 3.3 Internet (IP)Own page

What is a floating static route, and how do you choose its administrative distance?
Say this first
It is a backup static route with an AD higher than the primary route to the same prefix, so it stays out of the routing table until the primary disappears. The AD must be higher than whatever source provides the primary: above 1 to back up another static, above 110 to back up OSPF, above 170 if the primary is an EIGRP external route. Values like 200, 250 or 254 are common.
Go deeper
Two defaults, primary over fiber, backup over LTE
Cisco IOS
ip route 0.0.0.0 0.0.0.0 203.0.113.1 name ISP1 ip route 0.0.0.0 0.0.0.0 198.51.100.1 250 name LTE-BACKUP
While both are valid, only the AD 1 route is in show ip route. You see the backup only in the running config, or with show ip static route on IOS-XE.

Backing up a dynamic route
If the branch learns its routes to HQ from OSPF over MPLS, a backup over a VPN tunnel looks like this:

Cisco IOS
ip route 10.0.0.0 255.0.0.0 172.31.0.1 115
AD 115 is above OSPF's 110, so the static only appears when the OSPF route is withdrawn.

The catch
The primary static above stays in the table as long as Gi0/0/0 is up and 203.0.113.1 is in a connected subnet. If the ISP fails upstream while the Ethernet link to their router stays up, the primary never leaves and the backup never floats in. The fix is IP SLA tracking on the primary.
They will ask next
Why not use AD 255 for the backup?
255 means "never install". A floating static at 255 would never be used.

Does the other end need anything?
Yes. The far side needs its own way back over the backup path, or traffic leaves on the backup and returns on the dead primary. Failover has to work in both directions.
Traps
Choosing an AD below the primary's. A backup static with AD 100 beats OSPF and steals all the traffic.
Assuming a static on Ethernet fails over when the ISP fails. The link to the ISP's router usually stays up.
How did you do?Book 3.3 Internet (IP)Own page

Compare distance vector, link state and path vector routing protocols.

Say this first

Distance vector routers tell their neighbors which destinations they can reach and at what distance, and believe what neighbors tell them; nobody sees the whole topology. RIP is the classic example, EIGRP an advanced one. Link state routers flood a description of their own links to every router in the area, all build the same map, and each runs SPF (Dijkstra) to compute shortest paths: OSPF and IS-IS. Path vector is BGP: like distance vector, but each route carries the full list of ASes it crossed, which prevents loops and allows policy.

Go deeper

	Distance vector	Link state	Path vector
Examples	RIP, EIGRP	OSPF, IS-IS	BGP
What is sent	routes and distances	the router's own links (LSAs, LSPs)	routes with AS path and attributes
Sent to	directly connected neighbors	flooded to every router in the area	configured peers over TCP 179
View	only what neighbors report	full topology of the area	paths and policy, no topology
Algorithm	Bellman-Ford (RIP), DUAL (EIGRP)	SPF (Dijkstra)	best path selection
Loop prevention	split horizon, poison reverse, holddown, max hops; DUAL feasibility condition	same database everywhere	own AS in the path means reject
Scaling tool	summarization anywhere	areas and levels	aggregation, policy, route reflectors

Updates and timers

RIP sends its full table every 30 seconds.
EIGRP sends partial, bounded updates only when something changes.
OSPF refreshes each LSA every 30 minutes; IS-IS refreshes LSPs every 15 minutes by default. Both flood changes immediately.
BGP sends incremental updates and keepalives.

They will ask next

Why is EIGRP called advanced distance vector rather than link state?
EIGRP routers still only learn routes and distances from neighbors and never build a topology map. It adds reliable partial updates, a topology table of neighbor-reported distances, and DUAL, which keeps loop-free backup paths and converges much faster than RIP.
Which converges faster?
Link state protocols and EIGRP converge in well under a second with tuning. RIP can take minutes because of its timers and holddown.

Traps

Saying link state routers send their whole routing table. They send their links, and each router computes its own table.

How did you do?Book 3.4 Routing Own page

Why use a prefix list instead of an ACL to filter routes?
Say this first
An ACL used for route filtering only looks at the network address, so it cannot tell 10.1.0.0/16 from 10.1.0.0/24. A prefix list matches the address and the prefix length, with ge and le for length ranges. It is also easier to read, editable by sequence number and built for this job. ACLs remain the tool for filtering packets; prefix lists never touch traffic.
Go deeper
Same intent, different results
Cisco IOS
access-list 10 permit 10.0.0.0 0.255.255.255 ip prefix-list ONLY-SLASH8 seq 5 permit 10.0.0.0/8 ip prefix-list ALL-OF-10 seq 5 permit 10.0.0.0/8 le 32
Route ACL 10 ONLY-SLASH8 ALL-OF-10
10.0.0.0/8 match match match
10.1.0.0/16 match no match
10.1.0.0/24 match no match
172.16.0.0/16 no no no
Why prefix lists win for routes

They match length, which is what you usually care about (block anything longer than /24 from an ISP).

Sequence numbers let you insert and delete single lines.

show ip prefix-list detail shows hit counts per line.

The old workaround
In BGP and redistribution, an extended ACL can match length by using the source field for the network and the destination field for the mask. It works, nobody can read it, and prefix lists replaced it.
They will ask next
Can a prefix list filter packets on an interface?
No. Prefix lists only match routes. For traffic you use ACLs, and a route-map for PBR matches packets with an ACL.
Traps
Saying ACLs are faster or more capable for route filtering. They lack the length check.
How did you do?Book 3.4 Routing Own page

Route	ACL 10	ONLY-SLASH8	ALL-OF-10
10.0.0.0/8	match	match	match
10.1.0.0/16	match	no	match
10.1.0.0/24	match	no	match
172.16.0.0/16	no	no	no

Working17

Your primary default route points at the ISP over Ethernet. How do you make it fail over when the ISP breaks upstream but the link stays up?
Say this first
Tie the primary static to an object that tests the path. An IP SLA ICMP probe pings a target through the primary ISP, a track object follows the probe result, and the static has track 1 on it. When the probe fails the route is removed and the floating static with the higher AD takes over. Probe something beyond the ISP's first hop and pin the probe to the primary path with a /32.
Go deeper
Configuration
Cisco IOS
ip sla 1 icmp-echo 192.0.2.53 source-interface GigabitEthernet0/0/0 frequency 5 ip sla schedule 1 life forever start-time now ! track 1 ip sla 1 reachability delay down 10 up 30 ! ip route 192.0.2.53 255.255.255.255 GigabitEthernet0/0/0 203.0.113.1 ip route 192.0.2.53 255.255.255.255 Null0 254 ip route 0.0.0.0 0.0.0.0 203.0.113.1 track 1 name ISP1 ip route 0.0.0.0 0.0.0.0 198.51.100.1 250 name ISP2-BACKUP

The probe pings 192.0.2.53 every 5 seconds (the default frequency is 60).

delay down 10 up 30 waits 10 seconds of failure before failing over and 30 seconds of success before failing back, so a lossy link does not flap the default route.

The /32 makes the probe always use ISP1. Without it, after failover the probe would follow the backup default, succeed, bring the primary back, fail again, and flap.

The Null0 /32 at AD 254 covers the case where Gi0/0/0 itself goes down and the first /32 disappears: the probe is discarded instead of leaking out ISP2.

Checking it
Output
R1# show track 1 Track 1 IP SLA 1 reachability Reachability is Up 1 change, last change 02:11:40 Delay up 30 secs, down 10 secs Latest operation return code: OK Latest RTT (millisecs) 6 Tracked by: Static IP Routing 0
After a failure, Reachability is Down and show ip route shows S* 0.0.0.0/0 [250/0] via 198.51.100.1.

Choosing the target
Pinging the ISP gateway only proves the first hop. A target deeper in the ISP or a well-run public resolver tests more of the path, but if that one host goes down you fail over for nothing. Some designs use two probes combined with a boolean track (track 3 list boolean or).
They will ask next
What else breaks during a dual ISP failover?
NAT. Each ISP needs its own NAT rule, usually ip nat inside source route-map with a route-map that matches the outgoing interface, so traffic is translated to the right ISP's address after failover.

Junos and Linux?
Junos static routes use qualified-next-hop with a higher preference for the backup, and SRX uses RPM probes with ip-monitoring for tracking. On Linux you give two default routes different metrics, but the kernel only removes one when its link goes down, so a probe daemon is needed for real tracking.
Traps
Forgetting the /32 for the probe target. It is the most common cause of a flapping failover.
Forgetting ip sla schedule. An unscheduled probe never runs and the track stays down from the start.
Fixing only one side. The far end, or the ISP, also needs a way to send return traffic over the backup.
How did you do?Book 3.3 Internet (IP)Own page
Someone configured ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 with no next hop. What is wrong with that?
Say this first
Pointing a route only at an Ethernet interface tells the router that every destination is directly on that segment. So it sends an ARP request for each destination address, and it only works because the upstream router answers with proxy ARP. The ARP table and the CEF adjacency table grow by one entry per remote host, and the day the upstream turns proxy ARP off, traffic stops. Add the next hop.
Go deeper
What it looks like
Output
R1# show ip route static | include 0.0.0.0 S* 0.0.0.0/0 is directly connected, GigabitEthernet0/0/0 R1# show ip arp GigabitEthernet0/0/0 Protocol Address Age (min) Hardware Addr Type Interface Internet 192.0.2.80 3 00a0.c9aa.0101 ARPA GigabitEthernet0/0/0 Internet 198.51.100.25 0 00a0.c9aa.0101 ARPA GigabitEthernet0/0/0 Internet 203.0.113.1 41 00a0.c9aa.0101 ARPA GigabitEthernet0/0/0 Internet 203.0.113.2 - 0050.56b1.2c01 ARPA GigabitEthernet0/0/0 Internet 203.0.113.77 1 00a0.c9aa.0101 ARPA GigabitEthernet0/0/0
R1 is 203.0.113.2/30 and the ISP is 203.0.113.1. Every remote internet address has an ARP entry, and all of them map to the ISP router's MAC. That is proxy ARP at work.

Why it hurts

One ARP request and one adjacency per destination host. On an internet edge that is tens of thousands of entries, each kept for the IOS ARP timeout of 4 hours.

CPU spent on ARP, and the first packet to each new destination waits for ARP.

It depends on a feature many ISPs and firewalls disable. Without proxy ARP, every destination outside the /30 fails.

The fix
Cisco IOS
no ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 203.0.113.1
Now there is one ARP entry, for 203.0.113.1, and one adjacency.

When interface-only is fine
On point-to-point interfaces (serial with HDLC or PPP, GRE tunnels, IPsec VTIs) there is no ARP and only one possible neighbor, so ip route 10.50.0.0 255.255.255.0 Tunnel0 is normal.
They will ask next
Does disabling proxy ARP on your own router fix it?
No. Your router is the one sending the ARP requests. Proxy ARP has to be answered by the upstream router, so it is the upstream setting that matters.
Traps
Saying the route works the same as one with a next hop. It works only while the neighbor does proxy ARP.
How did you do?Book 3.3 Internet (IP)Own page
What is a recursive route lookup, and what can go wrong with it?
Say this first
When a route's next hop is not on a connected subnet, the router has to look up the next hop as well to find the real neighbor and exit interface. BGP routes with loopback next hops and static routes pointing at a distant address work this way. CEF resolves the chain in advance, so forwarding is still one lookup. The risk is that the next hop resolves through a route you did not intend, such as the default route, and the route stays up when the real path is gone.
Go deeper
Example
Cisco IOS
ip route 192.0.2.0 255.255.255.0 10.255.0.3
10.255.0.3 is R3's loopback, learned from OSPF.

Output
R1# show ip route 192.0.2.0 Routing entry for 192.0.2.0/24 Known via "static", distance 1, metric 0 Routing Descriptor Blocks: * 10.255.0.3 Route metric is 0, traffic share count is 1 R1# show ip route 10.255.0.3 Routing entry for 10.255.0.3/32 Known via "ospf 1", distance 110, metric 3, type intra area Last update from 10.0.12.2 on GigabitEthernet0/0/1, 00:20:15 ago Routing Descriptor Blocks: * 10.0.12.2, from 10.255.0.3, 00:20:15 ago, via GigabitEthernet0/0/1 Route metric is 3, traffic share count is 1
Two lookups: 192.0.2.0/24 gives next hop 10.255.0.3, and 10.255.0.3/32 gives 10.0.12.2 out Gi0/0/1. show ip cef 192.0.2.0 detail shows the entry as recursive via 10.255.0.3, resolved to 10.0.12.2.

What goes wrong

Resolving through the default route. If OSPF loses 10.255.0.3, IOS can resolve the next hop through 0.0.0.0/0 instead, so the static stays installed and sends traffic toward the internet edge.

Recursion through itself. A next hop that is only reachable through the route that needs it cannot resolve, so the route is not installed. A GRE tunnel whose destination is learned through the tunnel hits the same problem and logs %TUN-5-RECURSIVE while it flaps.

Slow failover. The static only leaves the table when the IGP withdraws the route to its next hop.

Why CEF makes this cheap
CEF links the 192.0.2.0/24 entry to the 10.255.0.3 entry. If the IGP path to 10.255.0.3 changes, only that one entry is updated and every prefix that recurses through it follows at once. That hierarchy is what BGP Prefix Independent Convergence builds on.
They will ask next
How does Junos treat a static route with a next hop that is not directly connected?
It does not install it unless you add resolve to the route. Junos makes recursion something you ask for, while IOS does it by default.

How do you stop a static from resolving through the default?
Use a fully specified static (interface plus next hop) when the next hop is directly connected, or track the next hop with IP SLA so the route is removed when the real path fails.
Traps
Assuming the router does two lookups for every packet. CEF has already resolved the chain.
How did you do?Book 3.3 Internet (IP)Own page
How do you write an IPv6 static route with a link-local next hop, and why is the interface required?
Say this first
ipv6 route 2001:db8:50::/48 GigabitEthernet0/0/1 FE80::2. A link-local address is only unique on its own link, and the same FE80 address can exist behind every interface, so IOS needs the interface to know which link the next hop is on. A global next hop can be given alone. ipv6 unicast-routing must be enabled for the router to forward IPv6 at all.
Go deeper
Configuration
Cisco IOS
ipv6 unicast-routing ! interface GigabitEthernet0/0/1 ipv6 address 2001:db8:12::1/64 ipv6 address FE80::1 link-local ! ipv6 route 2001:db8:50::/48 GigabitEthernet0/0/1 FE80::2 ipv6 route ::/0 GigabitEthernet0/0/0 FE80::1 ipv6 route ::/0 GigabitEthernet0/0/2 FE80::1 250
The last line is a floating default with AD 250, the same idea as IPv4.

Output
Output
R1# show ipv6 route static ... S ::/0 [1/0] via FE80::1, GigabitEthernet0/0/0 S 2001:DB8:50::/48 [1/0] via FE80::2, GigabitEthernet0/0/1
Why people prefer link-local next hops

They do not change when the global prefix is renumbered.

Routing protocols already use them: OSPFv3 and EIGRP for IPv6 next hops are link-local addresses.

Setting them by hand (ipv6 address FE80::1 link-local) makes them short and readable instead of EUI-64 derived.
They will ask next
The two default routes above both use FE80::1 as next hop. Is that a problem?
No. They are on different links, and the interface in each route tells the router which FE80::1 it means. That is the whole reason the interface is mandatory.
Traps
Giving only FE80::2 with no interface. IOS rejects it because the link is ambiguous.
How did you do?Book 4.2 IP Version 6 Own page
What is ECMP, and how does a Cisco router share traffic across equal paths?
Say this first
Equal-cost multipath installs several paths with the same best metric for one prefix. On IOS, OSPF, EIGRP and RIP install up to 4 by default and BGP only 1; maximum-paths raises it to the platform limit. CEF shares traffic per flow: it hashes source and destination addresses so packets of one flow stay on one path and arrive in order. EIGRP can also share unequal paths with variance.
Go deeper
What it looks like
Output
O 10.1.0.0/24 [110/2] via 10.0.12.2, 01:12:44, GigabitEthernet0/0/1 [110/2] via 10.0.13.2, 01:12:44, GigabitEthernet0/0/2
Configuration
Cisco IOS
router ospf 1 maximum-paths 8 ! router bgp 65001 address-family ipv4 maximum-paths 4 maximum-paths ibgp 4
BGP is pickier
BGP only treats paths as multipath candidates when they tie on weight, local preference, AS path length, origin and MED, are of the same type (all eBGP or all iBGP) and have the same IGP cost to the next hop. By default the AS paths must also be identical; bgp bestpath as-path multipath-relax relaxes that to the same length, which is common when multihoming to two providers.

Per flow, not per packet
Per-packet sharing (ip load-sharing per-packet on the interface) spreads load evenly but reorders TCP segments, which causes duplicate ACKs and slows transfers. Per-flow is the default and the right choice. The cost is that one large flow can only ever use one link.
They will ask next
Do two equal static routes give you ECMP?
Yes. Two statics to the same prefix with the same AD are both installed and CEF shares across them.

How do you check which path one flow takes?
show ip cef exact-route <source> <destination> runs the hash and prints the chosen exit interface and next hop.
Traps
Saying ECMP doubles the speed of a single download. A single flow stays on one path.
Forgetting that BGP defaults to one path. Without maximum-paths, the second ISP link sits idle for outbound traffic.
How did you do?Book 3.4 Routing Own page

What is the difference between the RIB and the FIB?

Say this first

The RIB is the routing table: the control plane's result, one best entry per prefix from all sources. The FIB is the forwarding copy built from it, with recursion already resolved and every entry pointing to an adjacency that holds the layer 2 rewrite. Protocols write to the RIB; packets only ever touch the FIB. On switches and big routers the FIB is programmed into the forwarding ASIC.

Go deeper

Three layers

Protocol tables: OSPF database, EIGRP topology table, BGP table. Every path each protocol knows.
RIB: the winners after metric and AD. show ip route.
FIB and adjacency table: what forwarding uses. show ip cef, show adjacency.

Where to look on each platform

Layer	IOS-XE	Junos	Linux with FRR
Protocol	`show ip ospf database`, `show ip bgp`	`show ospf database`, `show route receive-protocol bgp <peer>`	`vtysh -c "show ip bgp"`
RIB	`show ip route`	`show route`	`vtysh -c "show ip route"` (zebra)
FIB	`show ip cef`	`show route forwarding-table`	`ip route` (the kernel table is the FIB)

Why the split matters

The control plane can churn without disturbing forwarding until the result changes.
Hardware has limited FIB space. A full TCAM means routes exist in the RIB but cannot be programmed.
RIB and FIB can disagree after bugs or programming failures. "It is in show ip route" does not prove the box forwards that way; check the FIB.

They will ask next

Is every RIB route in the FIB?
Normally yes, plus extra entries the RIB does not show: receive entries for the router's own addresses, host adjacencies for resolved neighbors, and drop entries for reserved ranges.

Traps

Using RIB and FIB as two names for the same table.

How did you do?Book 3.5 Implementation Own page

How does CEF forward a packet? Explain the FIB and the adjacency table.

Say this first

CEF keeps two tables built before any traffic arrives. The FIB has every prefix with its resolved next hop. The adjacency table has one entry per next hop with the full layer 2 header already built from ARP. For each packet the router does one FIB lookup, takes the matching adjacency, writes the prebuilt header and sends it. Special adjacencies cover the rest: glean, receive, drop, null and punt.

Go deeper

The FIB

Output

R1# show ip cef
Prefix               Next Hop             Interface
0.0.0.0/0            203.0.113.1          GigabitEthernet0/0/0
0.0.0.0/8            drop
0.0.0.0/32           receive
10.0.12.0/30         attached             GigabitEthernet0/0/1
10.0.12.0/32         receive              GigabitEthernet0/0/1
10.0.12.1/32         receive              GigabitEthernet0/0/1
10.0.12.2/32         attached             GigabitEthernet0/0/1
10.0.12.3/32         receive              GigabitEthernet0/0/1
10.1.0.0/24          10.0.12.2            GigabitEthernet0/0/1
127.0.0.0/8          drop
203.0.113.0/30       attached             GigabitEthernet0/0/0
203.0.113.0/32       receive              GigabitEthernet0/0/0
203.0.113.1/32       attached             GigabitEthernet0/0/0
203.0.113.2/32       receive              GigabitEthernet0/0/0
203.0.113.3/32       receive              GigabitEthernet0/0/0
224.0.0.0/4          drop
224.0.0.0/24         receive
240.0.0.0/4          drop
255.255.255.255/32   receive

attached on a subnet is a glean adjacency: the subnet is connected, but hosts in it still need ARP.
attached on a /32 such as 10.0.12.2 is a resolved neighbor with a complete adjacency.
receive is for the router itself: its addresses, and the network and broadcast addresses of its subnets.

The adjacency

Output

R1# show adjacency GigabitEthernet0/0/1 detail
Protocol Interface                 Address
IP       GigabitEthernet0/0/1      10.0.12.2(9)
                                   0 packets, 0 bytes
                                   epoch 0
                                   sourced in sev-epoch 2
                                   Encap length 14
                                   00A0C9AA0202005056B1120A0800
                                   L2 destination address byte offset 0
                                   L2 destination address byte length 6
                                   Link-type after encap: ip
                                   ARP

The 14-byte string is the Ethernet header CEF will paste on: destination MAC 00A0.C9AA.0202 (R2), source MAC 0050.56B1.120A (R1's Gi0/0/1), EtherType 0800 (IPv4). ARP says where it was learned.

Special adjacencies

Type	Meaning
glean	connected subnet, MAC not known yet: punt to trigger ARP
receive	packet is for the router: send to the CPU
drop	discard (reserved ranges, failures)
null	route to Null0: discard
punt	feature needs the CPU to handle the packet
incomplete	ARP was sent but not answered

They will ask next

Why is the first ping from a router to a new neighbor often lost?
The first packet hits a glean adjacency. The router sends an ARP request and drops that packet while it waits, so you see .!!!!. Once ARP completes the adjacency is complete and the rest succeed.

Traps

Saying CEF is a cache built from traffic. That was fast switching. CEF is built from the RIB and ARP before traffic arrives.

How did you do?Book 3.5 Implementation Own page

What is the difference between process switching, fast switching and CEF?

Say this first

Process switching sends every packet to the CPU for a full routing table and ARP lookup. Fast switching process-switches the first packet to a destination and caches the result, so later packets use the cache, but the cache is built on demand and thrown away when routes change. CEF builds the FIB and adjacency table from the RIB and ARP ahead of time, so every packet, including the first, is forwarded with one lookup. CEF is the default on every current IOS and IOS-XE platform.

Go deeper

Method	How	Weakness
Process switching	CPU handles each packet: RIB lookup, ARP lookup, rewrite	slow and CPU bound
Fast switching	first packet per destination process switched, result cached	first packet penalty, cache churn when routes change, many new destinations (a worm scan) overwhelm it
CEF	FIB and adjacencies prebuilt from the control plane	none of the above; needs memory for the full table

What CEF still punts to the CPU

Packets addressed to the router itself (receive).
TTL expiry, which needs an ICMP time exceeded.
Packets to a connected host whose ARP is not resolved yet (glean).
IP options and some features the platform cannot do in the fast path.

Hardware platforms

Catalyst and Nexus switches and large routers program the same FIB and adjacency model into ASIC tables (TCAM and SRAM). Distributed CEF (dCEF) gives each line card its own copy. The CPU only sees punted traffic, which is why control plane policing exists.

They will ask next

Why did old guides say to turn off route caching before running debug ip packet?
debug ip packet only sees packets the CPU handles. no ip route-cache on the interface forced process switching so the debug saw everything. On a busy router that can push the CPU to 100 percent, so use an ACL on the debug, a packet capture, or Embedded Packet Capture instead.

Traps

Describing CEF as fast switching with a bigger cache. CEF is topology-driven, not traffic-driven.

How did you do?Book 3.5 Implementation Own page

Why does BGP use path vector rather than link state or plain distance vector?
Say this first
Between organizations, the problems are scale, privacy and policy, not shortest paths. Link state would flood every network's internal topology to the whole internet. Plain distance vector has only a metric, so it cannot express business policy and suffers count to infinity. Path vector carries the list of ASes a route crossed: a router that sees its own AS drops the route, and operators choose paths with attributes and policy instead of a single cost.
Go deeper
What the AS path gives you

Loop prevention without timers. If AS 64500 appears in the path of a route arriving at AS 64500, the route is discarded.

Policy. Prefer one provider, avoid an AS, prefer customer routes over peer routes. A single metric cannot express "cheaper" or "contractually allowed".

Privacy. An AS reveals its prefixes and that it can reach them, not its internal links.

Why it scales
BGP sends incremental updates over TCP, only changes after the initial exchange. The internet table is around a million IPv4 prefixes, far too many to model as a link state topology.

The cost
BGP converges slowly compared with IGPs, and the path it picks is the policy-preferred one, not necessarily the fastest. Inside an AS you still run an IGP for fast convergence and next hop reachability.
They will ask next
What does iBGP use for loop prevention, since the AS path does not change inside the AS?
The iBGP split horizon rule: a route learned from an iBGP peer is not advertised to another iBGP peer. That is why iBGP needs a full mesh, route reflectors or confederations.
Traps
Saying BGP picks the shortest or fastest path. It picks the best path by attributes and policy.
How did you do?Book 4.1 Global Internet Own page
What are the benefits and the costs of route summarization?
Say this first
Summarizing advertises one shorter prefix instead of many specific ones. It shrinks routing tables, hides flaps inside the block from the rest of the network, and bounds EIGRP queries and OSPF inter-area flooding. The costs: routers outside lose detail and may pick a longer path, and when a subnet dies behind a summarizing router, that router keeps attracting its traffic and drops it. Summaries also only work when the addressing plan was built for them.
Go deeper
The math
10.20.0.0/24, 10.20.1.0/24, 10.20.2.0/24 and 10.20.3.0/24 differ only in the last two bits of the third octet (000000 00 to 000000 11). The first 22 bits are common, so the summary is 10.20.0.0/22.

Benefits

Smaller RIB and FIB everywhere outside the block.

Stability: a flapping /24 inside the summary causes no updates outside it.

EIGRP queries stop at a router that only knows the summary.

OSPF: one type 3 LSA instead of many at the ABR.

Costs

Suboptimal routing. Two hubs advertise the same summary with similar metrics. A remote router sends traffic to whichever hub looks closer for the summary, even when the specific subnet sits behind the other hub.

Black holes. DSW1 and DSW2 both advertise 10.20.0.0/16. DSW1 loses its link to 10.20.30.0/24. The core still sends part of that traffic to DSW1, which only has its summary discard route and drops it.

Planning. Subnets scattered across the network cannot be summarized.

Where you can summarize
Protocol Where
OSPF only at ABRs (area range) and ASBRs (summary-address)
EIGRP on any interface
IS-IS at the level 1 / level 2 boundary and on redistribution
BGP anywhere with aggregate-address
They will ask next
How do you avoid the black hole between two summarizing routers?
Give them a routed link between each other that carries the specific routes, with no summarization on that link. The router that lost the subnet then has a more specific route via its partner, which beats its own discard route.
Traps
Selling summarization as free. Interviewers want to hear about suboptimal paths and black holes.
Getting the summary length wrong by counting the subnets instead of the common bits.
How did you do?Book 3.3 Internet (IP)Book 4.1 Global Internet Own page
What is a Null0 route, and what do you use it for?
Say this first
Null0 is a virtual interface that is always up and discards everything routed to it. A route to Null0 drops traffic in the forwarding plane at no CPU cost. It is used for summary discard routes that stop loops, anchor routes so BGP can announce an aggregate, remotely triggered black hole filtering during attacks, and blocking unused space. Longer routes always win over it, so it only catches traffic for parts of a block with no better route.
Go deeper
Anchor route for a BGP announcement
BGP's network statement only announces a prefix that exists in the RIB with that exact length.

Cisco IOS
interface Null0 no ip unreachables ! ip route 198.51.100.0 255.255.255.0 Null0 name BGP-ANCHOR ! router bgp 64500 address-family ipv4 network 198.51.100.0 mask 255.255.255.0
Output
S 198.51.100.0/24 is directly connected, Null0
The /24 is always announced, even when individual subnets inside it come and go. Traffic for real subnets follows their longer IGP routes; traffic for unused addresses is dropped at the edge.

Remotely triggered black hole (RTBH)

Every edge router has ip route 192.0.2.1 255.255.255.255 Null0.

During an attack on 203.0.113.10, a trigger router announces 203.0.113.10/32 to the edge routers over iBGP with next hop 192.0.2.1.

Each edge router resolves the next hop to Null0 and drops traffic to the victim at the border, before it fills internal links.

Why no ip unreachables on Null0
By default IOS answers dropped packets with ICMP unreachables, rate limited but still from the CPU. A flood toward a discard route should be dropped silently.
They will ask next
What are the equivalents on Junos and Linux?
Junos static routes take discard (drop silently) or reject (drop and send ICMP unreachable). Linux has ip route add blackhole 198.51.100.0/24, plus unreachable and prohibit route types that send ICMP.
Traps
Thinking a Null0 route for an aggregate blocks the real subnets inside it. Longest match sends them to their specific routes.
How did you do?Book 3.3 Internet (IP)Book 4.1 Global Internet Own page

Protocol	Where
OSPF	only at ABRs (`area range`) and ASBRs (`summary-address`)
EIGRP	on any interface
IS-IS	at the level 1 / level 2 boundary and on redistribution
BGP	anywhere with `aggregate-address`

How does route redistribution work, and what rules do you need to know?

Say this first

A router running two routing sources copies routes from one into the other: statics into OSPF, OSPF into EIGRP during a merger, an IGP into BGP. The receiving protocol needs a seed metric. Only routes that are in the RIB from that source, plus connected networks the source protocol runs on, are taken. It is not transitive on one router. OSPF needs subnets on older releases. And you always filter it with a route-map.

Go deeper

Seed metrics

Into	Default	What to do
OSPF	metric 20, type E2 (1 for routes from BGP)	set metric and E1 or E2 deliberately
EIGRP	routes from other protocols are not advertised without a metric	`metric <bw> <delay> <rel> <load> <mtu>`
RIP	routes from other protocols are not advertised without a metric	`metric <hops>`
BGP	MED is set from the IGP metric	usually reset or filtered

Example

Cisco IOS

router ospf 1
 redistribute eigrp 100 subnets route-map EIGRP-TO-OSPF
!
router eigrp 100
 redistribute ospf 1 metric 100000 10 255 1 1500 route-map OSPF-TO-EIGRP

The EIGRP seed is bandwidth 100,000 kbps, delay 10 (tens of microseconds), reliability 255, load 1, MTU 1500.

What gets taken

redistribute ospf 1 on R2 takes routes that are in R2's routing table as OSPF routes, plus the connected subnets of interfaces where OSPF runs. If R2 prefers an EIGRP copy of some prefix, that prefix is not redistributed from OSPF, because it is not an OSPF route in R2's table.

Not transitive

R2 runs RIP, OSPF and EIGRP. RIP goes into OSPF, and OSPF goes into EIGRP. The RIP routes do not reach EIGRP, because in R2's own table they are RIP routes, not OSPF routes. Redistribute RIP into EIGRP as well if you need them.

OSPF E1 and E2

E2 keeps the seed metric everywhere in the domain. E1 adds the internal cost to the ASBR, so routers prefer the closer exit. With two ASBRs injecting the same prefix, E1 usually gives the better path.

They will ask next

What happens if you forget the metric when redistributing OSPF into EIGRP?
Nothing is advertised. The routes are taken but have an infinite metric. You set it on the redistribute line, with default-metric under the process, or in the route-map.

Traps

Redistributing without a route-map. One typo pulls an internet table or a default route into the IGP.
Forgetting subnets on an older IOS release and wondering why only classful networks appear.

How did you do?Book 3.4 Routing Own page

When and how would you change the administrative distance of a protocol or a route?
Say this first
To make the router prefer a different source for the same prefix. Common cases: floating statics, a protocol migration where you flip which protocol wins one router at a time, fixing redistribution preferences, and BGP backdoor routes so an IGP path beats an eBGP one. You set it per static route, per protocol with distance, or per neighbor and prefix with a distance line and an ACL. AD is local, so inconsistent changes across routers can create loops.
Go deeper
Syntax
Cisco IOS
ip route 0.0.0.0 0.0.0.0 198.51.100.1 250 ! router ospf 1 distance ospf intra-area 110 inter-area 110 external 175 ! router eigrp 100 distance eigrp 90 170 ! router bgp 64500 address-family ipv4 distance bgp 20 200 200 ! router rip distance 125 10.0.12.2 0.0.0.0 20 ! access-list 20 permit 172.16.0.0 0.0.255.255

distance eigrp <internal> <external>.

distance bgp <external> <internal> <local>.

The RIP line gives AD 125 to routes from neighbor 10.0.12.2 that match ACL 20.

Migration example: EIGRP to OSPF
Run OSPF beside EIGRP everywhere. EIGRP still wins (90 and 170 beat 110). Then, router by router, set distance eigrp 120 180, check that OSPF routes take over, and finally remove EIGRP.

BGP backdoor
Site A and site B learn each other's prefixes from the provider over eBGP (AD 20) and also have a private link running OSPF. On site A's router, name site B's prefix:

Cisco IOS
router bgp 64500 address-family ipv4 network 10.60.0.0 mask 255.255.0.0 backdoor
The eBGP-learned 10.60.0.0/16 now gets AD 200, so the OSPF route over the private link wins. Site B's router does the same for site A's prefix. A backdoor network is not advertised by the router that has it.
They will ask next
Can you change AD on one router only?
Yes, AD is local. That is what makes per-router migrations possible, and also why careless changes cause loops: two routers that each prefer the other for the same prefix will bounce packets.
Traps
Lowering a protocol's AD below static (1) or connected (0) to win. Connected cannot be beaten, and fighting static routes hides configuration errors.
How did you do?Book 3.4 Routing Own page

How does a route-map work? Explain the match and set logic.

Say this first

A route-map is an ordered list of numbered entries, each permit or deny, with match conditions and set actions. The router checks entries from the lowest sequence number, and the first entry that matches decides: permit applies its sets and selects the item, deny rejects it. Nothing matched means an implicit deny at the end. An entry with no match clause matches everything. Several values on one match line are OR; separate match lines are AND.

Go deeper

Example: redistribute only LAN subnets, tagged, as E1

Cisco IOS

ip prefix-list LAN-NETS seq 5 permit 10.10.0.0/16 le 24
!
route-map CONNECTED-TO-OSPF permit 10
 match ip address prefix-list LAN-NETS
 set metric 50
 set metric-type type-1
 set tag 500
route-map CONNECTED-TO-OSPF deny 20
!
router ospf 1
 redistribute connected subnets route-map CONNECTED-TO-OSPF

The deny 20 entry only repeats the implicit deny, but it makes the intent obvious to the next engineer.

The rules people get wrong

Rule	Example
Same match command, several values: OR	`match ip address prefix-list A B` matches A or B
Different match commands: AND	`match tag 500` plus `match ip address prefix-list A` needs both
A deny inside the ACL or prefix-list means "no match", not "drop"	the item falls through to the next sequence
`deny` entry means "not selected"	not redistributed, not advertised, routed normally in PBR
First match wins	later entries are not checked, except with `continue` in BGP

Where route-maps are used

Redistribution, BGP neighbor policy in and out, policy-based routing, conditional default origination, NAT with several ISPs, and inbound distribute-lists in OSPF.

They will ask next

An ACL in a permit route-map entry has a deny line that matches a route. What happens to the route?
The entry does not match, so the route moves on to the next sequence. If no later entry matches, the implicit deny at the end rejects it.

Traps

Forgetting the implicit deny. A route-map with only a deny entry rejects everything.
Reading deny in a PBR route-map as dropping traffic. It means "do not policy route; use the routing table".

How did you do?Book 3.4 Routing Own page

Explain the ge and le keywords in a prefix list with examples.

Say this first

An entry is prefix/len plus an optional length range. The first len bits of the route must match the prefix. With no ge or le, the route length must equal len exactly. ge n allows lengths from n to 32, le n allows lengths from len to n, and both together give a range. The rule is len < ge <= le <= 32. Every list ends with an implicit deny, and 0.0.0.0/0 le 32 means any route.

Go deeper

Worked examples

Entry	Matches	Does not match
`permit 10.0.0.0/8`	10.0.0.0/8 only	10.20.0.0/16
`permit 10.0.0.0/8 le 24`	10.0.0.0/8, 10.20.0.0/16, 10.20.30.0/24	10.20.30.128/25, 11.0.0.0/8
`permit 10.0.0.0/8 ge 24`	10.20.30.0/24, 10.20.30.128/25, 10.1.1.1/32	10.0.0.0/8, 10.20.0.0/16
`permit 10.0.0.0/8 ge 16 le 24`	10.20.0.0/16, 10.20.30.0/24	10.0.0.0/8, 10.20.30.128/25
`permit 192.168.0.0/16 ge 24 le 24`	every /24 inside 192.168.0.0/16	192.168.0.0/16, 192.168.1.0/25
`permit 0.0.0.0/0`	the default route only	everything else
`permit 0.0.0.0/0 le 32`	every route	nothing
`deny 0.0.0.0/0 ge 25`	(denies) anything longer than /24	/24 and shorter pass to the next line

A real inbound filter from an ISP

Cisco IOS

ip prefix-list FROM-ISP seq 5 deny 0.0.0.0/0 ge 25
ip prefix-list FROM-ISP seq 10 deny 10.0.0.0/8 le 32
ip prefix-list FROM-ISP seq 15 deny 172.16.0.0/12 le 32
ip prefix-list FROM-ISP seq 20 deny 192.168.0.0/16 le 32
ip prefix-list FROM-ISP seq 25 permit 0.0.0.0/0 le 24
!
router bgp 64500
 address-family ipv4
  neighbor 203.0.113.1 prefix-list FROM-ISP in

Drop anything longer than /24, drop RFC 1918 space at any length, accept the rest including the default.

Reading one entry out loud

10.0.0.0/8 ge 16 le 24: "anything inside 10/8 whose length is between 16 and 24".

They will ask next

How do you see which lines are being hit?
show ip prefix-list detail FROM-ISP lists each sequence with its hit count.
Is there an IPv6 version?
Yes, ipv6 prefix-list with the same logic, lengths up to 128. For example ipv6 prefix-list FROM-ISP6 seq 5 deny ::/0 ge 49 drops anything longer than /48.

Traps

Thinking 10.0.0.0/8 ge 24 includes the /8. The length must be 24 or more.
Forgetting the implicit deny and losing every route not listed.

How did you do?Book 3.4 Routing Own page

What is policy-based routing, and how do you configure it on IOS?
Say this first
PBR forwards packets based on something other than the destination: source address, protocol, ports, DSCP. You match traffic with an ACL in a route-map, set a next hop, and apply the route-map inbound on the interface where the traffic arrives. Traffic that does not match, or hits a deny, is routed normally. Use set ip next-hop verify-availability with tracking so PBR stops using a next hop that is dead.
Go deeper
Send guest traffic to the second ISP
Cisco IOS
ip access-list extended GUEST-TRAFFIC permit ip 10.50.0.0 0.0.0.255 any ! ip sla 2 icmp-echo 198.51.100.1 source-interface GigabitEthernet0/0/3 frequency 5 ip sla schedule 2 life forever start-time now track 2 ip sla 2 reachability ! route-map PBR-GUEST permit 10 match ip address GUEST-TRAFFIC set ip next-hop verify-availability 198.51.100.1 1 track 2 ! interface GigabitEthernet0/0/1.50 ip policy route-map PBR-GUEST
Behaviour to know

Applied inbound. Traffic the router itself generates needs ip local policy route-map.

set ip next-hop is used before the routing table. set ip default next-hop is used only if the routing table has no explicit route for the destination; a default route does not count as explicit.

Without tracking, PBR keeps using a next hop as long as it looks reachable on a connected link, even if the path beyond it is dead.

The return traffic follows normal routing on the far side, so paths are often asymmetric.

Verifying
show route-map PBR-GUEST shows a Policy routing matches packet counter. show ip policy lists which interfaces have a policy. debug ip policy shows match decisions, so use it with care on a busy router.
They will ask next
What else does the guest-to-ISP2 design need?
NAT to ISP2's address. With two ISPs, use one NAT rule per ISP with a route-map that matches the outgoing interface, so each flow is translated to the address of the link it actually leaves on.

Is PBR done in hardware?
On Catalyst switches and most hardware routers, yes, programmed into TCAM. Some actions or very large ACLs fall back to software, so check the platform limits before relying on PBR at line rate.
Traps
Applying the policy outbound or on the wrong interface. It goes where the traffic enters.
Testing with a ping from the router itself. Router-generated traffic is not policy routed by an interface policy.
How did you do?Book 3.4 Routing Own page
What is a VRF, what is VRF-lite, and how do you configure it?
Say this first
A VRF is a separate routing table, with its own interfaces and routing processes, inside one router. Interfaces in different VRFs cannot reach each other unless you leak routes, and the same addresses can exist in two VRFs. VRF-lite means VRFs without MPLS: each VRF is carried hop by hop on its own subinterface or VLAN, and each router runs a routing instance per VRF. It suits a few VRFs over a few hops.
Go deeper
Configuration on IOS-XE
Cisco IOS
vrf definition CORP address-family ipv4 exit-address-family ! vrf definition GUEST address-family ipv4 exit-address-family ! interface GigabitEthernet0/0/1.10 encapsulation dot1Q 10 vrf forwarding CORP ip address 10.10.0.1 255.255.255.0 ! interface GigabitEthernet0/0/1.50 encapsulation dot1Q 50 vrf forwarding GUEST ip address 10.50.0.1 255.255.255.0 ! interface GigabitEthernet0/0/0.550 encapsulation dot1Q 550 vrf forwarding GUEST ip address 172.16.50.1 255.255.255.252 ! ip route vrf GUEST 0.0.0.0 0.0.0.0 172.16.50.2 ! router ospf 10 vrf CORP capability vrf-lite network 10.10.0.0 0.0.0.255 area 0
Guest users get a default route toward a firewall on their own uplink VLAN, and CORP runs OSPF in its own table.

Gotchas

vrf forwarding removes the interface's IP address. IOS warns % Interface GigabitEthernet0/0/1.50 IPv4 disabled and address(es) removed due to enabling VRF GUEST. Apply the VRF first, then the address.

An RD is optional for VRF-lite on current IOS-XE. BGP needs one as soon as it carries the VRF.

capability vrf-lite turns off checks OSPF does when it thinks it is on an MPLS PE. Without it, some inter-area and external routes may not be installed in a VRF-lite design.

Every command needs the VRF: show ip route vrf GUEST, ping vrf GUEST 10.50.0.10, traceroute vrf GUEST ....

The older ip vrf and ip vrf forwarding syntax is IPv4 only. vrf definition supports both families.

VRF-lite or MPLS L3VPN
VRF-lite needs a subinterface and a routing instance per VRF on every hop. With many VRFs or many hops, an MPLS L3VPN or EVPN core carries all VRFs over one set of links with labels, RDs and route targets.
They will ask next
Where do you see VRFs on a device you already manage?
The management VRF: Mgmt-intf on IOS-XE routers, Mgmt-vrf on Catalyst 9000 switches, management on NX-OS. It keeps the management port out of the data plane routing table.

How do VRFs compare with ACLs for separation?
ACLs filter traffic between networks that can still route to each other; one missing line opens a path. VRFs have no route between them at all unless you add one, and they allow overlapping addresses.
Traps
Configuring the IP address before vrf forwarding and then wondering where it went.
Testing with a plain ping. Without vrf, the ping uses the global table.
How did you do?Book 4.4 Multiprotocol Label Switching Own page

Expert6

What is CEF polarization, and how do you avoid it?
Say this first
CEF picks one of several equal paths by hashing fields of the packet. If every router in a chain uses the same hash on the same fields, the next router only receives flows that already produced one hash result, and it splits them the same way again, so some of its links get almost nothing. That is polarization. IOS avoids it with the universal algorithm, which mixes a per-router ID into the hash. Adding layer 4 ports or using different hash inputs per tier helps too.
Go deeper
How it happens
CORE1 has two equal paths, to DSW1 and DSW2. The hash on source and destination sends flow set A to DSW1 and set B to DSW2. DSW1 also has two equal paths onward. If DSW1 runs exactly the same hash, all of set A gives the same result again and lands on one of DSW1's links. The other link sits idle.

Fixes on IOS
It is one global setting, so pick one of these:

Cisco IOS
! addresses plus a per-router ID (the default on current releases) ip cef load-sharing algorithm universal ! addresses plus layer 4 ports ip cef load-sharing algorithm include-ports source destination

universal adds a per-router identifier (random unless you set one) to the hash, so neighbors split differently.

include-ports adds layer 4 ports, which spreads many flows between the same two hosts.

Checking one flow
Output
R1# show ip cef exact-route 10.10.1.5 10.20.1.9 10.10.1.5 -> 10.20.1.9 =>IP adj out of GigabitEthernet0/0/2, addr 10.0.13.2
Limits that remain

A single elephant flow still lives on one link.

Few flows (for example two backup servers talking to one target) hash unevenly however good the algorithm is.

Data center platforms and EtherChannels have the same problem and their own hash seed settings.
They will ask next
Why not use per-packet load sharing and avoid hashing altogether?
Packets of one TCP flow would take different paths with different delays and arrive out of order. TCP reacts with duplicate ACKs and retransmissions, so throughput goes down, not up.
Traps
Blaming the routing protocol when ECMP paths are uneven. The control plane installed equal paths; the hash decides the split.
How did you do?Book 3.5 Implementation Own page
The route is in show ip route, but traffic to that prefix is still dropped. How do you troubleshoot it?
Say this first
Move from the RIB down to the forwarding plane. Check the FIB entry with show ip cef <destination> detail and compare it with the RIB. Check the adjacency for that next hop is complete (ARP resolved). Then look at what sits on top of routing: ACLs, PBR, uRPF, NAT, VRF membership, MTU. On hardware platforms confirm the route is programmed and the TCAM is not full. Finally check the return path, because the reply can be what is lost.
Go deeper
1. RIB against FIB
Output
R1# show ip route 10.5.1.1 R1# show ip cef 10.5.1.1 detail
The FIB should have the same prefix and next hop. A missing entry, a different next hop or a drop entry points at a CEF or programming problem.

2. The adjacency
Output
R1# show ip arp 10.0.12.2 R1# show adjacency GigabitEthernet0/0/1 detail
An Incomplete ARP entry means the next hop does not answer ARP: wrong address, wrong VLAN, layer 2 problem or a down neighbor. In show ip traffic, a rising encapsulation failed drop counter tells the same story.

3. Things that override routing
show ip interface GigabitEthernet0/0/1 shows inbound and outbound ACLs, policy routing and uRPF on the interface. Check:

An ACL that denies the traffic.

PBR sending it somewhere else.

uRPF dropping it because the source fails the reverse path check.

The interface sits in a VRF, so the global table you checked is not the one being used (show ip route vrf <name>).

MTU: large packets with DF set are dropped while pings with default size work.

4. Hardware
On switches and hardware routers, use the platform's hardware FIB and TCAM utilization commands. A full TCAM means some routes are not in hardware and are forwarded in software or dropped.

5. The return path
Ping and traceroute from the other side. Asymmetric routing through a stateful firewall drops the reply even when the forward path is perfect.
They will ask next
What would make the RIB and FIB disagree?
A software bug, a failed hardware programming update, a full TCAM, or a route that just changed and has not finished programming. IOS has CEF consistency checkers, and a clear ip route for the prefix forces it to be reinstalled, but find the cause before clearing in production.
Traps
Stopping at show ip route. The RIB says what the router wants to do, not what the forwarding plane does.
Forgetting the return path. Half of "cannot reach" problems are replies that never come back.
How did you do?Book 3.5 Implementation Own page

What determines how fast a routed network converges after a failure, and how do you make it faster?

Say this first

Convergence is detection, plus propagation, plus computation, plus updating the FIB. Detection is usually the biggest piece: a lost carrier is noticed fast, but a silent failure waits for hello timers (OSPF 40 s dead time on LAN, EIGRP 15 s hold, BGP 180 s hold), which is why BFD exists. After that come flooding and SPF or DUAL timers, and the time to rewrite thousands of FIB entries. Precomputed backups (EIGRP feasible successors, LFA and TI-LFA, BGP PIC) remove most of the computation and FIB time.

Go deeper

The four parts

Part	What drives it	How to shrink it
Detection	carrier loss, protocol hello and dead timers	BFD (for example 50 ms x 3 = 150 ms), carrier-delay tuning, point-to-point links
Propagation	flooding and update pacing	LSA and SPF throttle timers, fewer hops, summarization
Computation	SPF, DUAL, BGP best path	feasible successors, LFA/TI-LFA, incremental SPF
FIB update	number of prefixes to rewrite	hierarchical FIB and BGP PIC: change one shared next hop entry

Typical config pieces on IOS-XE

Cisco IOS

interface GigabitEthernet0/0/1
 bfd interval 50 min_rx 50 multiplier 3
 ip ospf network point-to-point
!
router ospf 1
 bfd all-interfaces
 timers throttle spf 50 200 5000

timers throttle spf 50 200 5000 runs the first SPF 50 ms after a change, then backs off up to 5 seconds if changes keep coming.

Why point-to-point helps

On an Ethernet link between two routers, OSPF network type point-to-point skips DR election and the wait timer, so adjacencies form and recover faster.

Precomputed backups

EIGRP feasible successors are installed with no queries.
OSPF and IS-IS loop-free alternates (and TI-LFA with segment routing) preinstall a backup next hop.
BGP PIC Edge (bgp additional-paths install) preinstalls a backup path, and the hierarchical FIB switches every prefix that shares a next hop in one step.

The side effect to mention

During link state convergence, routers finish at slightly different times and can loop packets briefly between them (microloops). Fast reroute and ordered FIB updates reduce them.

They will ask next

Why not just set the OSPF hello to 1 second everywhere?
Fast hellos cost CPU on every interface and are processed by the control plane, so a busy CPU can miss them and drop adjacencies. BFD is lightweight, often runs in hardware or a dedicated process, and is shared by all protocols on the link.

Traps

Talking only about SPF speed. On most networks detection dominates.
Tuning timers aggressively without dampening. Fast reaction to a flapping link can make the whole network unstable.

How did you do?Book 3.4 Routing Own page

When you configure a summary, the router installs a route for it pointing to Null0. Why, and what happens without it?

Say this first

The summarizing router advertises the whole block, so it attracts traffic for every address in it, including addresses that do not exist. Without the discard route, a packet for an unused part of the block matches the router's default route and goes back toward the core, which sends it straight back: a loop until TTL expires. The Null0 route drops it at the router that knows the block is not fully there. Real subnets are longer prefixes, so they still win.

Go deeper

Worked example

DSW1 has 10.20.10.0/24 and 10.20.20.0/24, advertises 10.20.0.0/16 to CORE1, and uses a default route toward CORE1.

Output

DSW1# show ip route | include Null0|0.0.0.0/0
S*    0.0.0.0/0 [1/0] via 10.0.1.1
D        10.20.0.0/16 is a summary, 00:31:12, Null0

A packet for 10.20.99.5 arrives at DSW1.

With the discard route: the best match is the /16 to Null0. Dropped once, done.
Without it: the best match is 0.0.0.0/0, so DSW1 sends it to CORE1. CORE1's best match is the /16 via DSW1, so it comes back. The packet bounces until its TTL reaches 0, using bandwidth both ways, and a traceroute shows CORE1 and DSW1 alternating.

Who installs discard routes

Source	Discard route
EIGRP summary on an interface	`D ... is a summary, Null0`, AD 5
OSPF `area range` and `summary-address`	installed by default on IOS (`discard-route` controls it)
BGP `aggregate-address`	`B ... Null0`, AD 200
Your own static summary	add `ip route <summary> <mask> Null0` yourself

The trap with AD 5

A hub learns its internet default from BGP or OSPF and sends spokes an EIGRP summary of 0.0.0.0/0. The discard route for that summary is 0.0.0.0/0 to Null0 at AD 5, which beats the real default (AD 20 or 110), and the hub black-holes internet traffic. Give that summary an AD of 255 so it is advertised but its discard route is never installed:

Cisco IOS

interface Tunnel0
 ip summary-address eigrp 100 0.0.0.0 0.0.0.0 255

They will ask next

Why AD 5 for the EIGRP summary and not 90?
So the discard route reliably beats copies of the same prefix learned from elsewhere, which would otherwise pull the summarized traffic away or create the loop it is meant to prevent.

Traps

Deleting the Null0 summary route because "Null0 is dropping my traffic". The traffic it drops has nowhere real to go; the actual fault is a missing specific route.

How did you do?Book 3.3 Internet (IP)Own page

You redistribute both ways between OSPF and EIGRP on two routers. What can go wrong, and how do you prevent it?
Say this first
With two redistribution points a route can leave domain A on one router, cross domain B, and come back into A on the other router. Because OSPF (110) beats EIGRP external (170), the second redistributor may prefer that copy over the native route, giving a longer path and, when the original disappears, a loop that keeps a dead route alive. The standard fix: tag routes as they enter a domain and deny that tag on the way back out, on both routers. Then fix the AD preference for the routes that come back.
Go deeper
Topology
R1 is in OSPF, R4 in EIGRP 100. R2 and R3 sit between them and redistribute both ways. R4 redistributes a static for a partner network, 192.0.2.0/24, so R2 and R3 see it as EIGRP external, AD 170.

What goes wrong

R2 redistributes 192.0.2.0/24 into OSPF as E2.

R3 now has it from EIGRP (170) and from OSPF (110). It installs the OSPF copy: traffic from R3 goes R3, R1, R2, R4 instead of straight to R4.

Because it is an OSPF route in R3's table, R3 redistributes it into EIGRP, back toward R4.

If R4's static is removed, R4 can install R3's copy, R2 still sees an EIGRP route and keeps feeding OSPF, and the route circulates with no real destination. Traffic loops until TTL expires.

Fix 1: tags (stops the feedback)
The same configuration on R2 and R3:

Cisco IOS
route-map EIGRP-TO-OSPF deny 10 match tag 110 route-map EIGRP-TO-OSPF permit 20 set tag 90 ! route-map OSPF-TO-EIGRP deny 10 match tag 90 route-map OSPF-TO-EIGRP permit 20 set tag 110 ! router ospf 1 redistribute eigrp 100 subnets route-map EIGRP-TO-OSPF ! router eigrp 100 redistribute ospf 1 metric 100000 10 255 1 1500 route-map OSPF-TO-EIGRP
Routes from EIGRP enter OSPF with tag 90 and can never be redistributed back into EIGRP. Routes from OSPF enter EIGRP with tag 110 and can never go back into OSPF. Both OSPF external LSAs and EIGRP external routes carry the tag across the domain.

Fix 2: the AD preference
Tags stop the loop but R3 still prefers the OSPF E2 copy of 192.0.2.0/24. One clean way is to stop each redistributor from installing routes that started in the other domain and came back:

Cisco IOS
route-map NO-EIGRP-ORIGIN deny 10 match tag 90 route-map NO-EIGRP-ORIGIN permit 20 ! router ospf 1 distribute-list route-map NO-EIGRP-ORIGIN in
On R2 and R3 this only filters what OSPF puts in their own routing table; the LSAs still flood to R1. Now R3 uses its native EIGRP external route. The trade-off: if R3 loses its EIGRP side, it cannot reach those prefixes through OSPF itself.

Other options

Raise AD for specific prefixes with distance and an ACL.

Redistribute at one point only, with the second router as a manual backup.

Redistribute only a default route in one direction, which avoids most of the problem.
They will ask next
Why don't EIGRP internal routes have this problem?
EIGRP internal is AD 90, which beats OSPF's 110, so a redistributor always prefers the native internal route over its OSPF copy. The trouble starts with EIGRP externals (170), or with RIP (120), which both lose to OSPF.

Do tags survive across the whole domain?
Yes. OSPF carries a 32-bit tag in type 5 and type 7 LSAs, EIGRP carries a tag in external routes, and RIPv2 has a 16-bit route tag. Every router in the domain sees the tag the redistributor set.
Traps
Saying tags fix suboptimal routing. Tags stop routes being re-injected; the AD choice on the redistributor needs its own fix.
Applying the route-maps on only one of the two redistributors.
How did you do?Book 3.4 Routing Own page

Two VRFs need to reach a shared DNS server in the global table. How do you leak routes between them on VRF-lite?

Say this first

With static routes you point a route in one table at a next hop or interface in another: global at the end of an ip route vrf makes the next hop resolve in the global table, and a global route can point at an interface that sits in a VRF. For anything bigger, use BGP locally: export and import route targets between VRFs on the same router, no neighbors needed. Leaking needs return routes both ways and unique addresses; overlapping ranges need NAT. Inter-VRF traffic that needs policy belongs on a firewall.

Go deeper

Static leaking

GUEST hosts are 10.50.0.0/24 on Gi0/0/1.50. The DNS server 10.200.0.53 sits in the global table behind 10.0.99.2.

Cisco IOS

ip route vrf GUEST 10.200.0.53 255.255.255.255 10.0.99.2 global
ip route 10.50.0.0 255.255.255.0 GigabitEthernet0/0/1.50

The first line gives GUEST a route to the DNS server, resolved in the global table. The second gives the global table a route back to the GUEST hosts through their VRF interface. Without the second line, queries reach the server and the replies are dropped.

Leaking with BGP on one router

Route targets work between VRFs, not with the global table, so in this design the shared servers live in their own VRF called SHARED.

Cisco IOS

vrf definition GUEST
 rd 65000:50
 address-family ipv4
  route-target export 65000:50
  route-target import 65000:50
  route-target import 65000:200
 exit-address-family
!
vrf definition SHARED
 rd 65000:200
 address-family ipv4
  route-target export 65000:200
  route-target import 65000:200
  route-target import 65000:50
 exit-address-family
!
router bgp 65000
 address-family ipv4 vrf GUEST
  redistribute connected
 exit-address-family
 address-family ipv4 vrf SHARED
  redistribute connected
 exit-address-family

Each VRF imports the other's route target, so their connected routes appear in both tables as BGP routes. In production, add an import map so only the shared server prefixes are leaked, not whole VRFs.

Design choices

Need	Approach
A few prefixes, simple	static leaks with `global` or a cross-VRF interface
Many prefixes or many VRFs	BGP route targets with import and export maps
Overlapping addresses	VRF-aware NAT (`ip nat inside source ... vrf GUEST`)
Security policy between VRFs	route each VRF to a firewall (a fusion design) and let it decide

They will ask next

Why is the return route the part people forget?
Leaking is one-way per route. The VRF gets a path to the server, but the server's table needs a path back to the VRF's hosts. Ping from inside the VRF, sourced from a host subnet, to test both directions.

Traps

Leaking whole VRFs into each other, which quietly undoes the separation the VRFs were built for.
Leaking overlapping ranges. Two identical prefixes cannot both live in one table.

How did you do?Book 4.4 Multiprotocol Label Switching Own page

Core14

Say this first

Go deeper

Building the routing table (control plane)

Forwarding a packet (data plane)

Worked example

They will ask next

Traps

Say this first

Go deeper

The table

The lookups

Why .200 and .100 split

How fast routers do it

They will ask next

Traps

Say this first

Go deeper

The full Cisco table

Details people get wrong

Other vendors

They will ask next

Traps

Say this first

Go deeper

Example

Order of decisions

They will ask next

Traps

Say this first

Go deeper

OSPF reference bandwidth

EIGRP worked number

They will ask next

Traps

Say this first

Go deeper

The output

Reading one line

Codes you must know

They will ask next

Traps

Say this first

Go deeper

Example

When they appear and disappear

Redistribution

Other platforms

They will ask next

Traps

Say this first

Go deeper

What you see

Related cases that look similar

Rate limiting and hardening

They will ask next

Traps

Say this first

Go deeper

Typical static uses

They will ask next

Traps

Say this first

Go deeper

The three forms

Useful options at the end of the line

When the route leaves the table

They will ask next

Traps

Say this first

Go deeper

On a router

On a layer 2 switch

Sending a default into a protocol

They will ask next

Traps

Say this first

Go deeper

Two defaults, primary over fiber, backup over LTE

Backing up a dynamic route