Routing Fundamentals

A router is a Layer 3 device that forwards packets between different IP networks. When a packet arrives on an interface, the router examines the destination IP address, looks it up in the routing table, and forwards the packet out the appropriate interface toward the next hop. This decision happens for every packet, billions of times per second on modern routers.

The fundamental question routing answers: given a destination IP address, which outgoing interface and next-hop IP address should this packet be sent to? The routing table is the data structure that answers this question. Each entry in the routing table contains: a destination prefix (network address + prefix length), a next-hop IP address (or outgoing interface for connected networks), and a metric (cost/preference).

How Routes Enter the Routing Table

Routes enter the routing table through three mechanisms:

1. Connected routes (Administrative Distance = 0): automatically installed when an interface is configured with an IP address and the interface is up. If GigabitEthernet0/0 is configured with 192.168.1.1/24, the route 192.168.1.0/24 is instantly in the routing table as "Connected" via that interface.

2. Static routes (AD = 1): manually configured by the administrator. Example: ip route 10.0.0.0 255.0.0.0 192.168.1.254. Static routes don't update automatically when topology changes — they're fixed until manually removed.

3. Dynamic routes (various ADs): learned from routing protocols (OSPF, EIGRP, BGP, RIP). The protocol discovers the network topology and automatically installs routes. When topology changes (a link fails), the protocol reconverges and updates the routing table.

Administrative Distance

Administrative Distance (AD) is the "trustworthiness" of a routing information source, expressed as a number from 0 to 255. Lower is better. When multiple routing protocols learn a route to the same destination, the route from the lowest-AD source wins and is installed in the routing table.

AD is a tie-breaker between sources, not between routes within the same protocol. OSPF internal (AD=110) always loses to EIGRP internal (AD=90) when both know a route to the same prefix — regardless of OSPF's metric. The logic: some protocols are considered more reliable than others, and the administrator configures trustworthiness via AD.

Cisco IOS Default Administrative Distances:
Source                   AD
Connected                 0  (most trusted)
Static                    1
EIGRP summary route       5
eBGP                     20
EIGRP internal           90
IGRP                    100
OSPF                    110
IS-IS                   115
RIPv2                   120
EIGRP external          170
iBGP                    200
Unknown / untrustworthy 255  (never installed in routing table)

Metric

Within a routing protocol, the metric determines which of multiple paths to the same destination is best. Each protocol uses different metrics: OSPF uses cumulative interface cost (bandwidth-based, default cost = 10^8/bandwidth-bps), EIGRP uses a composite metric (bandwidth + delay + load + reliability), RIP uses hop count (number of routers crossed), BGP uses a complex set of attributes (AS path length, local preference, MED, etc.).

A route with a lower metric is preferred over a higher-metric route within the same routing protocol. If two routes have identical metrics, the router can use ECMP (Equal-Cost Multi-Path) — load balancing across multiple equal-cost paths.

Longest Prefix Match (LPM) is the algorithm every router uses to select the best routing table entry for a destination IP address. Given multiple matching prefixes, the one with the longest (most specific) prefix length is selected.

Why LPM Enables Internet Scale

LPM enables hierarchical routing — the combination of specific routes and summary routes. An ISP can advertise a summary 10.0.0.0/8 to the internet while internally having specific routes for 10.10.10.0/24, 10.10.20.0/24, etc. Internet routers use the /8 summary; the ISP's own routers use the more specific /24 routes.

This is also how the default route (0.0.0.0/0) works. Every destination matches 0.0.0.0/0 because zero bits are checked — but any more specific route will always win via LPM. The default route is literally the "prefix of last resort" when no more specific route matches.

Floating Static Routes

A floating static route uses a higher-than-normal AD to act as a backup. Example: a primary route learned via OSPF (AD=110) and a backup static route with AD=200 to the same destination. Normally, the OSPF route wins (lower AD). If the OSPF route disappears (the dynamic routing protocol loses the route), the floating static route "floats" to the top and becomes active — automatic failover without any routing protocol reconfiguration.

! Primary route via OSPF (AD 110 — installed when OSPF learns it)
! Backup floating static (AD 200 — only installed when OSPF route gone)
ip route 10.0.0.0 255.0.0.0 192.168.2.1 200   ! AD=200

! Verify both routes
show ip route 10.0.0.0
! Should show OSPF route normally
! Disconnect OSPF neighbor — floating static appears automatically

Types of Static Routes

Standard static route: explicit next-hop IP and/or outgoing interface. Most common type.

Default route (0.0.0.0/0): matches all destinations with no more specific match. Every internet-connected router needs a default route pointing to the upstream ISP.

Null route: points to the null0 interface (a virtual drop interface). Packets forwarded to null0 are silently discarded. Used to create "aggregate" entries that prevent routing loops — advertise a summary /16 but route unroutable /24s to null0.

Floating static: high AD for backup when primary dynamic route disappears.

Summary static route: a single static route covering a range of more specific networks (supernet).

! Standard static route — send 10.0.0.0/8 via 192.168.1.1
ip route 10.0.0.0 255.0.0.0 192.168.1.1

! Default route — send all unmatched traffic to ISP
ip route 0.0.0.0 0.0.0.0 203.0.113.1

! Null route — discard traffic to unallocated parts of summary
ip route 10.0.0.0 255.0.0.0 null0 254   ! AD=254, only wins if no other route

! IPv6 static routes
ipv6 route 2001:db8::/32 2001:db8:1::1
ipv6 route ::/0 2001:db8::1              ! IPv6 default route

! Verify
show ip route static
show ip route 10.0.0.0

Recursive Routing and Recursion Depth

A static route specifying a next-hop IP (rather than an interface) may require recursive lookup. The router installs the route with next-hop 10.0.1.1, but must look up 10.0.1.1 in the routing table to find the outgoing interface. If that lookup yields another next-hop, the recursion deepens. If no route exists for the next-hop IP, the static route is inactive (doesn't appear in the routing table). Static routes pointing to IP addresses only work if the next-hop IP is reachable.

Dynamic routing protocols automate route distribution. Routers running the same protocol exchange routing information, build a picture of the network topology, and independently calculate the best paths. When topology changes (link failure, new subnet added), the protocol propagates the change, and all routers reconverge automatically.

Classification: Distance Vector vs. Link State vs. Path Vector

Distance Vector protocols (RIP, IGRP): each router knows only the distance (metric) to each destination and the direction (vector) to send traffic. Routers share their routing tables with neighbors. "Routing by rumor" — a router trusts its neighbor's distance without knowing the underlying topology. Slow convergence (routers don't know if a neighbor's route is loop-free) and limited scalability (15-hop max for RIP).

Link State protocols (OSPF, IS-IS): each router generates LSAs (Link State Advertisements) describing its directly connected links and neighbors. All routers flood LSAs throughout the topology. Every router has an identical Link State Database (LSDB) representing the complete topology. Each router independently runs Dijkstra's shortest-path-first (SPF) algorithm on the LSDB to calculate routing. Complete topology knowledge enables fast, loop-free convergence.

Path Vector protocols (BGP): each route advertisement includes the complete path (sequence of Autonomous Systems) to the destination. This provides loop detection (a router rejects advertisements containing its own AS). BGP is optimized for policy-based routing between organizational boundaries, not for fast convergence.

OSPF Fundamentals

OSPF forms adjacencies with neighboring routers on the same link. Adjacency formation requires: matching area ID, matching authentication (if configured), matching hello/dead timers, matching MTU (by default), and compatible subnet information. Routers exchange Hello packets (every 10 seconds on Ethernet, 30 seconds on serial by default) to establish and maintain adjacencies.

On broadcast networks (Ethernet), OSPF elects a DR (Designated Router) and BDR (Backup Designated Router) to reduce flooding overhead. All other routers (DROther) form adjacencies only with the DR and BDR, not with each other. The DR represents the network segment in the LSDB, reducing the n^2 adjacency problem to n adjacencies.

OSPF Areas

Large OSPF domains are divided into areas to limit LSA flooding and SPF calculation scope. Each area has a full LSDB; flooding of detailed LSAs is confined within the area boundary. Area 0 (the backbone area) is the hub — all other areas must connect to Area 0 (directly or via virtual links). Area border routers (ABRs) sit between areas and summarize routes at the boundary.

OSPF router types: Internal Router (all interfaces in same area), ABR (Area Border Router — connects multiple areas), ASBR (AS Boundary Router — redistributes external routes into OSPF), Backbone Router (has at least one Area 0 interface).

OSPF Cost

OSPF's metric is cost = 10^8 / bandwidth-in-bps. A 100 Mbps link has cost = 10^8 / 10^8 = 1. A 10 Mbps link has cost 10. A 1 Mbps link has cost 100. The total path cost is the sum of costs along the path. Problem: 10^8 / 10^9 (1 Gbps) = 0.1, rounded to 1 — same as 100 Mbps. OSPF can't distinguish between 100 Mbps and 1 Gbps with the default reference bandwidth. Fix: change the OSPF reference bandwidth to 10^10 (10 Gbps) or 10^12 (1 Tbps) with auto-cost reference-bandwidth 10000.

! OSPF basic configuration
router ospf 1
 router-id 1.1.1.1
 auto-cost reference-bandwidth 10000   ! 10 Gbps reference
 area 0 authentication message-digest  ! MD5 auth for area 0
 passive-interface default             ! don't send hello on access ports
 no passive-interface GigabitEthernet0/0  ! except this router link

interface GigabitEthernet0/0
 ip ospf 1 area 0
 ip ospf cost 10
 ip ospf hello-interval 10
 ip ospf dead-interval 40

! Verify OSPF
show ip ospf neighbor
show ip ospf database
show ip route ospf

Autonomous Systems

The internet is divided into Autonomous Systems (AS) — collections of IP prefixes under a single administrative control. Each AS has an AS Number (ASN) assigned by an RIR. Cisco's AS is 109. Google's is 15169. Cloudflare's is 13335. AWS has multiple: 16509, 14618, etc. BGP routes between autonomous systems.

eBGP (External BGP): sessions between routers in different ASes — typically over internet-facing connections. iBGP (Internal BGP): sessions within the same AS, used to distribute externally learned routes to all routers in the AS. iBGP requires a full mesh or route reflectors — every iBGP speaker needs to know all external routes.

BGP Path Selection

BGP is a policy-based protocol. When multiple paths exist to the same destination, BGP uses a 14-step selection process (the "BGP decision process") to choose the best path. Key attributes in order of precedence: Weight (Cisco proprietary, local significance), Local Preference (entire AS preference for egress paths, higher = preferred), AS Path Length (shorter = preferred), Origin (IGP preferred over EGP over Incomplete), MED (Multi-Exit Discriminator, hints to neighboring AS about preferred entry), eBGP preferred over iBGP, IGP metric to next-hop.

Network engineers manipulate BGP attributes to control traffic: increase Local Preference to prefer one ISP's paths; prepend your own AS number to make AS Path longer (encouraging neighbors to use a different path for inbound traffic); set MED to influence which of your router's IPs a neighboring AS uses as entry point.

Route Reflectors

iBGP requires all iBGP speakers to have sessions with each other (full mesh). At N routers: N×(N-1)/2 sessions. At 100 routers: 4,950 iBGP sessions. Unscalable. Route Reflectors (RR) break the full mesh requirement: instead of peering with every router, iBGP clients peer only with the Route Reflector. The RR reflects routes between clients. Large networks use hierarchical RR clusters for redundancy and scalability.

When multiple paths to the same destination have identical metrics, most routing protocols install all of them in the routing table. ECMP (Equal-Cost Multi-Path) load balances traffic across these paths, multiplying effective bandwidth and providing automatic failover if one path goes down.

ECMP Load Balancing Methods

Per-packet: each packet is forwarded on the next path in round-robin. Maximizes bandwidth utilization but can cause packet reordering (TCP doesn't handle this well — out-of-order packets trigger retransmissions). Used primarily in high-throughput core networks where packet order is less critical.

Per-flow (5-tuple hashing): a hash of source IP, destination IP, source port, destination port, and protocol determines the path. All packets in the same flow (TCP connection, UDP session) use the same path, preserving order. Standard in most modern routers. Different flows are distributed across paths, providing aggregate load balancing while maintaining per-flow ordering.

Per-destination: all packets to the same destination IP use the same path. Simple but can cause uneven load if one destination generates significantly more traffic.

Unequal-Cost Load Balancing

EIGRP supports unequal-cost load balancing via the variance command. A variance of 2 means paths with metric up to 2× the best metric are eligible for load balancing. Traffic is distributed proportionally — a path with metric 200 (2× the best 100) carries half as much traffic as the best path. This is unique to EIGRP; OSPF and BGP support equal-cost only.

In enterprise networks, multiple routing protocols often coexist — OSPF for the campus, EIGRP for the WAN, BGP for internet connectivity. Redistribution imports routes from one routing protocol into another, allowing all routers to know all routes regardless of which protocol originally learned them.

Redistribution Mechanics

On the router running both protocols (the ASBR — Autonomous System Boundary Router), you configure redistribution in both directions. OSPF routes redistributed into EIGRP become EIGRP external routes (AD=170). EIGRP routes redistributed into OSPF become OSPF external type 2 (E2) routes.

Destination-based routing (normal routing) forwards packets based solely on the destination IP address. Policy-Based Routing (PBR) can override routing table decisions and forward packets based on source IP, protocol, port, DSCP value, or any other packet attribute.

Use cases: force specific traffic (e.g., VoIP) to use a higher-quality link; route specific source IPs to a different ISP for legal/compliance reasons; redirect traffic for deep packet inspection; differentiate between internal and external traffic on the same destination subnet.

! PBR example: route traffic from 10.1.0.0/24 via a specific next-hop
ip access-list standard BRANCH-USERS
 permit 10.1.0.0 0.0.0.255

route-map BRANCH-PBR permit 10
 match ip address BRANCH-USERS
 set ip next-hop 192.168.2.1

interface GigabitEthernet0/1
 ip policy route-map BRANCH-PBR

Leaf-Spine and BGP in the Underlay

Modern data center networks use a leaf-spine topology with fully routed (L3) underlay. Every link is a /31 or /30 routed link — no Spanning Tree, no L2 loops. OSPF or increasingly BGP unnumbered provides underlay routing. BGP unnumbered uses IPv6 link-local addresses for session establishment and distributes both IPv4 and IPv6 prefixes — simplifying addressing (no need for /31 subnets on every link).

EVPN-VXLAN Control and Data Plane

The overlay (tenant networks) uses VXLAN for data plane encapsulation and BGP EVPN for control plane. BGP EVPN distributes MAC/IP bindings between VTEPs, eliminating flooding. The underlay routes VXLAN UDP traffic; the overlay provides tenant L2 and L3 connectivity.

Cloud Routing: VPC Route Tables

In AWS, GCP, and Azure, routing is software-defined. Each VPC subnet has a route table. Routes are programmed via API — no routing protocol configuration. Static routes pointing to NAT gateways, transit gateways, VPC peering connections, and virtual private gateways fill the cloud route table. Cloud routing is fundamentally static, managed by control plane APIs, with automatic failover handled by the cloud platform.

# Verify routing table
show ip route
show ip route 10.10.10.50       # lookup specific destination
show ip route summary           # count routes per protocol

# Trace the path
traceroute 8.8.8.8              # standard traceroute
traceroute 8.8.8.8 source 192.168.1.1  # source-specific

# OSPF troubleshooting
show ip ospf neighbor           # check adjacencies
show ip ospf database           # view LSDB
show ip ospf interface Gi0/0    # interface OSPF status
debug ip ospf adj               # watch adjacency formation

# BGP troubleshooting
show ip bgp summary             # BGP peer status
show ip bgp                     # BGP table
show ip bgp 8.8.8.0/24          # specific prefix details
show ip bgp neighbors 10.0.0.1  # specific peer details

# Test routing policy
ip route 10.99.99.0 255.255.255.0 null0  # inject test route
traceroute 10.99.99.1           # verify path
no ip route 10.99.99.0 255.255.255.0 null0  # cleanup

Common Routing Issues

Route not in table: check if the AD of the dynamic route is too high (another protocol's route is winning). Check if the subnet mask in the static route is wrong. Check if the next-hop IP is reachable (recursive lookup failure).

Routing loop: TTL expiry on packets cycling between routers. Traceroute shows the same pair of routers repeated. Common cause: mutual redistribution without proper filtering. Fix: add route tags, use distribute-lists to prevent redistributed routes from being redistributed back.

Asymmetric routing: packets flow via one path outbound, a different path returns. Causes stateful firewall failures (the firewall sees only one direction of a TCP session). Verify routing from both directions: check the remote router's route for the source subnet.