Network Routing: Static Routes, OSPF and NAT

A router connects different IP networks and forwards packets by destination IP address. An Ethernet switch forwards frames within a network by MAC address. The router's control plane builds routes; its data plane uses those routes to forward packets.

Local delivery or the gateway

A host applies its own subnet mask to decide whether a destination is local. From 192.168.1.10/24, 192.168.1.50 is local: the sender uses ARP to find that host's MAC address. The server 192.168.2.20 is remote, so the sender uses its gateway, 192.168.1.1. The frame is addressed to the gateway's MAC, while the packet inside is addressed to the server's IP.

ARP requests remain within their broadcast domain. Routers do not forward these Layer 2 broadcasts between subnets. A Layer 3 switch can perform the same routing job, using a switch virtual interface (SVI) as each VLAN's gateway.

Work through two routers

PC A is 192.168.1.10/24. R1 has LAN address 192.168.1.1 and connects to R2 over 10.0.12.0/30: R1 is .1, R2 is .2. R2's LAN interface is 192.168.2.1/24, beside server 192.168.2.20.

1. PC A sends a frame to R1's LAN MAC. Its packet has source 192.168.1.10, destination 192.168.2.20, and TTL 64.
2. R1 checks and removes the incoming frame. It reads the destination, lowers TTL to 63, and finds a route to 192.168.2.0/24 through 10.0.12.2.
3. R1 uses ARP to find R2's MAC on that Ethernet link. It builds a new frame with R1's outgoing MAC as source and R2's MAC as destination.
4. R2 removes that frame and lowers TTL to 62. The destination network is directly connected, so R2 resolves the server's MAC and sends the final frame.

The MAC addresses belong to the current link and change at each router. The IP endpoints remain the same unless NAT translates them. On a point-to-point serial link, the outgoing frame uses that link's encapsulation and needs no MAC resolution. IPv6 uses Neighbor Discovery on Ethernet and calls its counter Hop Limit.

When delivery stops

A router discards a packet whose TTL expires and sends ICMP Time Exceeded. This limits the lifetime of a packet caught in a routing loop. Changing TTL also requires an updated IPv4 header checksum; IPv6 has no header checksum.

If no installed route matches, including no default route, the router drops the packet and normally reports ICMP Destination Unreachable. It does not flood an unknown IP destination across its interfaces.

A reply makes its own journey. R1 needs a route to the server LAN, and R2 needs a route back to the PC LAN. A correct outward route alone cannot make ping succeed.

Traceroute sends probes with increasing TTL values. Replies identify responding hops. A line of * means no reply arrived; filtering, a missing route, or a router declining to answer can cause that silence. Inspect tables around the last responding hop, then continue checking the path.

A routing table connects a destination prefix to a forwarding instruction. A prefix combines a network address with its length, such as 10.1.3.0/24. The instruction names a next-hop router, an exit interface, or both. A /32 IPv4 host route or /128 IPv6 host route covers one address.

Identify the source

Connected routes appear when an addressed interface is up/up and disappear when it goes down. Static routes come from configuration. Dynamic routes come from routing protocols. Cisco also installs a local host route for each interface address, identifying traffic meant for the router itself.

The legend in show ip route explains the codes present on that device.

Decode the whole line

O 10.1.3.0/24 [110/20] via 10.0.12.2, 00:12:44, GigabitEthernet0/1

Read it from left to right. OSPF supplied the destination 10.1.3.0/24. The brackets show administrative distance, 110, followed by metric, 20. The next hop is 10.0.12.2, the route age is 00:12:44, and the exit is GigabitEthernet0/1.

Administrative distance rates the route source. A lower value is preferred when different sources offer the same prefix. A value of 255 prevents installation. The metric measures the path according to one protocol: OSPF cost, RIP hop count, or EIGRP's bandwidth-and-delay measure. Comparing an OSPF cost of 20 with a RIP metric of 2 tells you nothing about which source wins; the units differ.

Connected and local entries omit the brackets:

C 10.0.12.0/30 is directly connected, GigabitEthernet0/1
L 10.0.12.1/32 is directly connected, GigabitEthernet0/1

The first reaches the link's subnet. The second identifies R1's own address. The connected route has AD 0.

Read headings and the default correctly

A line such as 10.0.0.0/8 is variably subnetted, 5 subnets, 3 masks groups entries below it. It supplies no next hop and is not a covering route for the entire /8.

The gateway of last resort comes from the installed default route. For example, S* 0.0.0.0/0 [1/0] via 203.0.113.1 sends otherwise unmatched traffic to 203.0.113.1. If the gateway of last resort is not set, destinations outside all listed prefixes are unreachable through this router.

Ask the table a specific question

Use show ip route for the full table, show ip route static or show ip route ospf for one source, and show ip route 10.1.3.5 for a destination lookup. A configured route may be waiting as a backup or unusable; configuration alone does not establish that it is installed.

show ipv6 route uses the same ideas. A local route has length /128, and an OSPFv3 next hop commonly appears as FE80::2 together with its exit interface. The interface identifies which link contains that link-local neighbor.

Route selection has two stages: build the routing table, then consult it for a packet. Keeping these stages separate prevents the most common error: choosing a broad static route over a more specific OSPF route because the static route has lower administrative distance.

Build the table

A routing protocol uses its metric to find its preferred path to a prefix. If several sources offer exactly the same prefix, administrative distance decides which source supplies the installed route. Both the network address and prefix length must match before that comparison applies.

For 172.16.5.0/24, a usable static route with AD 1 takes preference over OSPF with AD 110 and RIP with AD 120. If that static route becomes unusable and is removed, OSPF can supply the route. Metrics from different protocols cannot be compared as though they use one scale.

These are Cisco defaults. Other vendors can use different values for route preference.

Choose a route for one packet

Longest prefix match uses the installed route with the longest prefix that contains the destination. Check address membership before comparing lengths. A long prefix that covers a different range is irrelevant.

Suppose the table contains:

For 10.1.1.200, all four prefixes match, so the /25 sends it to C. For 10.1.1.100, the /25 fails the membership test: its range starts at .128. The /24 wins and sends that packet to B. The address 10.1.2.5 uses A, and 192.0.2.10 uses D.

At the boundary, .127 uses B and .128 uses C. Writing a prefix's first and last addresses is useful when the mask cuts through an octet.

Now consider an installed static 10.0.0.0/8 and an installed OSPF 10.1.1.0/24. They cover different prefixes, so they can coexist. Traffic for 10.1.1.5 uses OSPF's /24; traffic for 10.9.9.9 uses the static /8.

Equal paths and IPv6

Equal-cost multipath (ECMP) allows several equal-metric paths to the same prefix to share traffic, within the device's configured path limit. Four paths is a common Cisco IOS default; the supported limit and default vary by platform and software. Unequal costs do not form OSPF ECMP.

IPv6 uses the same lookup rule. Given 2001:db8:acad::/48, 2001:db8:acad:10::/64, and ::/0, destination 2001:db8:acad:10::25 uses the /64. Destination 2001:db8:acad:20::1 uses the /48; 2001:db8:ffff::1 uses the default. Table order never replaces the prefix comparison.

A new router can be configured through its console. Once addressing and secure remote access are ready, SSH provides network access to the CLI. Cisco IOS and IOS XE interface names vary by model; GigabitEthernet0/0/0 is one common form.

Move between command modes

exit moves back one level; end returns to privileged EXEC. Type ? for available choices. Abbreviations work while unambiguous, such as conf t. From configuration mode, do show ip interface brief runs an EXEC check without leaving that mode.

Global commands include hostname R1, enable secret followed by a chosen secret, no ip domain-lookup to stop name lookups after mistyped commands, and banner motd to display a login warning.

Address and enable an interface

configure terminal
ipv6 unicast-routing
interface GigabitEthernet0/0/0
 description Link to R2
 ip address 10.0.12.1 255.255.255.252
 ipv6 address 2001:db8:acad:12::1/64
 ipv6 address fe80::1 link-local
 no shutdown
end

IPv4 takes a dotted-decimal mask; IPv6 takes a prefix length. no shutdown removes the administrative shutdown. ipv6 unicast-routing enables IPv6 forwarding and Router Advertisements: assigning IPv6 addresses alone does not enable those functions. An IPv6-enabled interface has a link-local address; assigning one explicitly makes the neighbor easier to recognize.

Read interface status

show ip interface brief lists the address and two status columns. up/up means both layers are working. administratively down/down needs no shutdown. down/down suggests a physical fault, such as an unplugged cable or powered-off neighbor. up/down points to a data-link issue, such as mismatched serial encapsulation. Use show interfaces for detail and show ipv6 interface brief for IPv6 addresses and status.

Avoid overlapping subnets on two routed interfaces. Also check for an address on the wrong port or mismatched masks at opposite ends of a link.

Route between VLANs on one link

Router-on-a-stick uses a switch trunk and one router subinterface per VLAN:

interface GigabitEthernet0/0/1
 no shutdown
interface GigabitEthernet0/0/1.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/0/1.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0

The switch port must carry VLANs 10 and 20 as an 802.1Q trunk. Hosts use their own VLAN's subinterface address as gateway. The dot1Q number selects the VLAN; the matching subinterface suffix is a naming convention.

Changes affect the running configuration in RAM immediately. copy running-config startup-config saves them to the startup configuration loaded at boot. Test with show commands, ping, and traceroute before saving the intended working settings.

A static route is an administrator's instruction for reaching a prefix. Its default Cisco administrative distance is 1. It needs no routing updates and suits a small network or a network with one exit. Maintaining many individual routes becomes harder as paths change; a static route does not learn a replacement path by itself.

Configure both directions

R1 reaches R2 over 10.0.12.0/30, using .1 on R1 and .2 on R2. R1's LAN is 192.168.1.0/24; R2's LAN is 192.168.2.0/24.

On R1:

ip route 192.168.2.0 255.255.255.0 10.0.12.2

On R2:

ip route 192.168.1.0 255.255.255.0 10.0.12.1

The first address must be the destination network address. The last address is the next-hop neighbor, not the local interface. The second route is essential for replies to the first LAN.

Choose the route form

A next-hop route names the neighbor. The router performs a recursive lookup to find the interface that reaches that neighbor. A directly attached route names only an exit interface. This works well on a point-to-point serial link, where there is only one possible neighbor.

On Ethernet, an interface-only route can make the router ARP separately for each destination and rely on proxy ARP from the neighbor. A fully specified route names both interface and next hop:

ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0/0 10.0.12.2

The next hop must resolve to a usable outgoing path. An interface-based route also depends on that interface being up. Check installation with show ip route static; an installed entry can read S 192.168.2.0/24 [1/0] via 10.0.12.2.

Change the destination scope

A host route selects one IPv4 address with mask 255.255.255.255:

ip route 192.168.2.20 255.255.255.255 10.0.12.2

It wins over matching network routes because /32 is more specific. A summary route does the opposite: it covers several networks. 10.2.0.0 255.255.252.0 represents 10.2.0.0/22, covering the four /24 networks from 10.2.0.0 through 10.2.3.0. Its last address is 10.2.3.255; 10.2.4.0/24 lies outside it. Summarize only ranges reached through the intended next hop.

Configure IPv6 and verify failures

Enable ipv6 unicast-routing, then use a prefix length:

ipv6 route 2001:db8:acad:2::/64 2001:db8:acad:12::2

For a link-local next hop, include its link:

ipv6 route 2001:db8:acad:2::/64 GigabitEthernet0/0/0 fe80::2

A link-local address can recur on other interfaces, so the address alone is insufficient. IPv6 host routes use /128. Verify with show ipv6 route static.

If a route is absent, check the next-hop spelling, its reachability, the exit interface, and a preferred source for that prefix. If it is present but ping fails, check destination coverage, the return route, and filters. An Ethernet interface can stay up through a switch even when the far router fails. The static route may remain installed; probe-based object tracking can detect a failure beyond the local link and remove it.

A default route covers every destination: 0.0.0.0/0 in IPv4 and ::/0 in IPv6. Its prefix length is zero, so any matching network or host route wins over it. A default is useful at the edge of a network, where many remote destinations share one next hop.

Give a stub network one way out

A stub network has a single path to other networks. An office router can keep connected routes for its LANs and use these defaults toward its provider:

ip route 0.0.0.0 0.0.0.0 203.0.113.1
ipv6 route ::/0 2001:db8:ffff::1

The next hop must be reachable. New remote networks can use the same exit without requiring a separate static entry. The installed default supplies the gateway of last resort.

A host's default gateway and a router's default route operate at different points in the path. The host sends off-subnet traffic to its local gateway. That router consults its own table and uses its default only if no more specific route matches. On Cisco devices, ip default-gateway serves devices that are not routing, such as a Layer 2 switch sending management traffic. A routing router uses ip route for its default.

Keep a backup out of the table

A floating static route has a higher AD than the primary route to the same prefix. Consider two usable provider links:

ip route 0.0.0.0 0.0.0.0 203.0.113.1
ip route 0.0.0.0 0.0.0.0 198.51.100.1 5

The first uses default AD 1; the second uses AD 5. While both are usable, only the first is installed. Once the primary is removed, the backup becomes the best available default. When the primary returns, its lower AD restores it to use.

To back up OSPF's 10.5.0.0/16, whose Cisco AD is 110, use a larger distance:

ip route 10.5.0.0 255.255.0.0 172.16.9.2 130

Leaving out 130 would give the static route AD 1 and make it the primary. Also keep the prefix identical. A backup /24 inside a primary /16 would win immediately for its smaller range through longest prefix match, even with a higher AD.

Test the event that causes failover

A backup waits for the primary route to leave the table. A shutdown of a directly connected primary link can remove it, but a remote failure beyond an Ethernet switch may leave the local interface and route up. Tracking can remove a static primary after a failed probe. A dynamic protocol can withdraw a learned primary after detecting the failed neighbor or path.

show running-config | include ip route shows configured routes, including a waiting backup. show ip route shows what is installed. In a lab, record the original table, shut down the primary interface, and check the replacement route and traceroute path. Restore the interface and confirm that the primary returns.

An edge router can distribute its installed default through OSPF with default-information originate. Internal routers can then learn their exit dynamically instead of each needing a hand-entered default.

A dynamic routing protocol lets routers learn remote prefixes and respond to changes automatically. Routers exchange information, select paths, and update their choices after a failure. This uses bandwidth, CPU, and memory, and routing exchanges need protection against false information.

Recover a consistent view

After a link fails, routers may temporarily disagree about reachable paths. Some have received the new information while others still use the old routes. Convergence is the return to a consistent, correct network view. Convergence time measures the delay; dropped packets or short-lived loops can occur while it completes.

Suppose a branch has two routed links. A static route continues to name its chosen next hop until its usability changes or tracking removes it. A dynamic protocol can detect a lost neighbor, distribute the change, and calculate another available path. It still needs time to detect the failure and propagate the update.

Inside or between autonomous systems

An autonomous system (AS) is a set of networks under one administration and routing policy. Internet ASes have AS numbers. An interior gateway protocol (IGP), such as RIP, EIGRP, OSPF, or IS-IS, routes within an AS. BGP is the exterior gateway protocol used between ASes on the internet. Internal BGP also exists; it carries BGP information within an AS.

Compare the information exchanged

A distance-vector router relies on what its neighbors report. RIP is the simple example; EIGRP is an advanced distance-vector design with faster recovery features.

Link-state routers flood advertisements throughout an area. Each builds a link-state database (LSDB) and runs shortest path first (SPF), also called Dijkstra's algorithm, from its own position. Shared topology information lets each router calculate paths independently. Keeping and processing that map requires more resources than a simple distance-vector protocol.

BGP attaches an AS path to a route. Seeing its own AS in that path lets a router reject a loop. Other attributes support decisions based on each network's routing policy.

A metric changes the meaning of best

RIP chooses fewer router hops. It can prefer one 10 Mbps hop to two 1 Gbps hops. OSPF uses the sum of bandwidth-based costs; with a reference bandwidth that distinguishes those speeds, it can prefer the faster two-hop path. EIGRP normally combines the lowest path bandwidth with total delay. BGP uses policy and attributes, so its preferred path need not be fastest.

Current protocol versions carry prefix lengths and support VLSM and summarization; this is classless routing. RIPv1 omitted masks and was classful. IPv6 uses RIPng, EIGRP for IPv6, OSPFv3, IS-IS extensions, or multiprotocol BGP, preserving each protocol's basic approach.

Choose a routing protocol for the network's size, equipment, and routing job. A protocol's administrative distance is a local preference for its routes, not a rating of how quickly it converges.

Compare the main choices

RIP permits at most 15 hops; 16 means unreachable. RIPv2 sends periodic routing updates every 30 seconds to 224.0.0.9. Its small maximum and slow convergence make it an uncommon choice for a new enterprise network. The hop limit counts router hops, not hosts connected to a LAN.

EIGRP was developed by Cisco and published in the informational RFC 7868 in 2016. It sends partial updates after changes. A qualifying loop-free backup is called a feasible successor; when one exists, the router can use it quickly. A network is not guaranteed to have such a backup for every destination.

OSPF is an open standard. OSPFv2 carries IPv4 routes, while OSPFv3 supports IPv6. Areas organize larger OSPF networks around backbone area 0. IS-IS is also an open-standard link-state protocol and is common in provider networks. It carries its protocol messages directly over the data-link layer, unlike OSPF's use of IP.

BGP peers use TCP port 179. External BGP connects different ASes; internal BGP distributes BGP routes inside one AS. BGP can choose a policy-preferred path even when another path has fewer hops or higher link speed. Its AS-path loop check and policy controls suit exchanges between separately administered networks.

Neighbor discovery and updates

OSPF, EIGRP, and IS-IS use neighbor relationships, while BGP forms peerings. Missing hellos or keepalives allow these protocols to detect lost neighbors. RIP forms no adjacency: it receives periodic updates and ages out routes that stop being refreshed. A missing RIP route therefore calls for different checks from an OSPF neighbor stuck during database exchange.

Match the approach to the job

A small office with one provider link can use a static default: there is no alternative internal path to discover. A multi-site enterprise with several equipment vendors can use OSPF. An all-Cisco enterprise can choose OSPF or EIGRP. An organization with its own public address space and two providers can use BGP toward those providers and an IGP for internal routes.

Keep source preference separate from protocol operation. Cisco's EIGRP AD 90 beats OSPF AD 110 only when both offer the same prefix. That comparison says nothing about which protocol has the faster physical path or which design is best for the whole organization.

OSPF is an open-standard link-state IGP. OSPFv2 carries IPv4 routes; OSPFv3 supports IPv6. It runs over IP protocol 89. IPv4 multicast 224.0.0.5 reaches all OSPF routers and 224.0.0.6 reaches the designated routers; IPv6 uses FF02::5 and FF02::6.

Build the routes in stages

A router discovers neighbors with Hellos, synchronizes its link-state database, runs SPF, and installs the best routes. The neighbor table records who is communicating; the LSDB records topology; the routing table records selected paths. Routers in the same area share that area's topology view once synchronized, but calculate routes from their own locations.

Single-area OSPF puts participating interfaces in one area. Any valid area ID can serve a single-area network. Area 0 is common because it can later act as the backbone of a multi-area design.

The router ID is a unique 32-bit identifier written like an IPv4 address. Cisco selects an explicitly configured ID first, then the highest active loopback IPv4 address, then the highest active physical-interface IPv4 address. Selection occurs when the process starts. A later ID change requires a process restart or reload; clear ip ospf process interrupts adjacencies.

Reach Full adjacency

Broadcast and point-to-point defaults are Hello every 10 seconds and Dead after 40 seconds without a Hello. Neighbors need matching area, Hello/Dead intervals, and authentication settings, unique IDs, and participating nonpassive interfaces. On OSPFv2 broadcast networks, both ends also need the same subnet and mask. Point-to-point OSPFv2 does not check the mask during Hello processing. OSPFv3 uses link-local addresses and does not compare global prefixes.

The main state sequence is Down → Init → 2-Way → ExStart → Exchange → Loading → Full. At Init, a Hello has arrived. At 2-Way, both routers see themselves in the other's Hellos. ExStart and Exchange begin database synchronization; Loading obtains missing advertisements; Full means synchronization is complete. An MTU mismatch commonly stalls ExStart or Exchange. Two DROTHERs on a broadcast segment normally remain 2-Way.

The five packet types are Hello, Database Description, Link-State Request, Link-State Update, and Link-State Acknowledgment. Every router originates a Type 1 router LSA; a designated router originates a Type 2 network LSA for its shared segment.

Calculate the full path cost

Interface cost is reference bandwidth divided by interface bandwidth, with a minimum of 1. Use the same units. Cisco's default 100 Mbps reference makes 10 Mbps cost 10, while 100 Mbps, 1 Gbps, and 10 Gbps all cost 1.

R1 can reach R3's 1 Gbps destination LAN through two 1 Gbps transit links, or through one direct 100 Mbps link. With the default reference:

OSPF chooses the direct link. Set auto-cost reference-bandwidth 10000 on all routers to use a 10 Gbps reference. Each 1 Gbps interface now costs 10; the 100 Mbps interface costs 100:

The two-hop path now wins. Include the final interface onto the destination LAN in both totals.

OSPF's network type controls how neighbors organize a link. Ethernet defaults to broadcast multiaccess, even when only two routers are attached. A point-to-point network has two routers and no designated-router election.

Why elect a DR and BDR?

If every router on a shared segment became fully adjacent to every other, the number of adjacencies would grow quickly:

With five routers, that would be 10 pairs; with ten, 45. A designated router (DR) and backup designated router (BDR) reduce the exchange work. Every DROTHER becomes fully adjacent to those two, while DROTHER pairs remain 2-Way. Five routers then need seven full adjacencies, and ten need 17.

DROTHERs send updates to 224.0.0.6, reaching the DR and BDR. The DR floods updates to all routers at 224.0.0.5 and originates the segment's Type 2 network LSA. The BDR is ready to take over if the DR fails. These roles organize OSPF database exchange; they do not force user packets to travel through the DR.

Work through an election

At a fresh election, highest interface OSPF priority wins. Priorities range from 0 to 255 and default to 1. A tie goes to the highest router ID; priority 0 makes a router ineligible for both DR and BDR. Set priority per interface with ip ospf priority.

Four routers start together:

R3 becomes DR by priority. R2 becomes BDR because it wins the ID tie with R1. R1 and R4 are DROTHERs. R4's high ID cannot overcome priority 0.

The election is nonpreemptive. If a priority-200 router joins after these roles are established, it does not replace either incumbent. If R3 fails, R2 is promoted from BDR to DR and a new BDR is elected. In the original four-router group, that new BDR is R1.

Roles belong to segments, not to a router everywhere. R1 can be DR on one interface and DROTHER on another.

Read status and choose a network type

show ip ospf neighbor lists neighbor IDs, priorities, states, roles, dead times, addresses, and interfaces. FULL/DR identifies a fully adjacent designated router. 2WAY/DROTHER can be a healthy relationship between two DROTHERs. show ip ospf interface GigabitEthernet0/0/0 gives the network type, DR/BDR, timers, and cost.

On an Ethernet link used by exactly two routers, configure ip ospf network point-to-point at both ends to skip the election and its default 40-second wait. That link also needs no Type 2 network LSA. Match the type on both ends: a broadcast/point-to-point mismatch can reach Full yet fail to install expected routes because the routers describe the link differently.

Start OSPFv2 with a local process ID, set a unique router ID, and enable OSPF on the intended interfaces. Process IDs are local labels: R1 can use process 1 and its neighbor process 7.

Enable OSPFv2 on a transit link and LAN

R1 has 10.0.12.1/30 toward R2 on G0/0/0 and 192.168.1.1/24 on its user LAN, G0/0/1:

router ospf 1
 router-id 1.1.1.1
 network 10.0.12.0 0.0.0.3 area 0
 network 192.168.1.0 0.0.0.255 area 0
 passive-interface GigabitEthernet0/0/1

A network statement selects local interfaces by their addresses. Its wildcard mask has zeros where bits must match and ones where bits may vary. Subtract a contiguous subnet mask from 255.255.255.255: /30 mask 255.255.255.252 gives wildcard 0.0.0.3; /24 gives 0.0.0.255. Wildcard 0.0.0.0 selects one exact interface address.

Alternatively, put ip ospf 1 area 0 under each participating interface. The LAN remains passive through the process command. A passive interface advertises its subnet but sends no Hellos. That suits host-facing LANs; making the transit interface passive prevents its neighbor from forming.

Share a default and set costs

An edge router with a usable default can advertise it:

ip route 0.0.0.0 0.0.0.0 203.0.113.1
router ospf 1
 default-information originate
 auto-cost reference-bandwidth 10000

Internal routers learn an O*E2 default. Without a default in the edge router's table, ordinary default-information originate advertises nothing; always changes that behavior. Use the same reference bandwidth everywhere, in Mbps. An interface command such as ip ospf cost 50 overrides its calculated cost. The interface bandwidth setting affects calculations, not the physical line speed.

Enable OSPFv3 for IPv6

With IPv6 addresses already on the interfaces:

ipv6 unicast-routing
ipv6 router ospf 1
 router-id 1.1.1.1
interface GigabitEthernet0/0/0
 ipv6 ospf 1 area 0
interface GigabitEthernet0/0/1
 ipv6 ospf 1 area 0

Set the host-facing interface passive under the IPv6 OSPF process as well. OSPFv3 still needs a 32-bit router ID; explicitly set it when there are no IPv4 addresses. Neighbors communicate using link-local addresses.

Verify one stage at a time

show ip protocols lists process settings and passive interfaces. show ip ospf neighbor checks synchronization. show ip ospf interface brief checks area, cost, state, and neighbor count. show ip route ospf shows installed O routes with [110/cost]. For IPv6, use show ipv6 ospf neighbor and show ipv6 route ospf.

For no adjacency, check up/up status, OSPF participation, wildcard coverage, passive settings, area, timers, unique IDs, and matching authentication settings. OSPFv2 broadcast links also need matching subnet and mask. ExStart/Exchange suggests checking MTU; filters must allow IP protocol 89. For Full neighbors with missing routes, check remote-prefix advertisement, matching network types, and a lower-AD source already supplying the same prefix.

Network address translation (NAT) rewrites addresses as packets cross between an inside and an outside network. A translation table records the mappings so replies can be translated back. This lets private IPv4 hosts communicate through globally routed addresses while conserving public IPv4 space.

The private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The middle range ends at 172.31.255.255; addresses beginning with 172 are not all private. Organizations can reuse these ranges internally, but the public internet does not route them.

Read the four address names

Inside/outside identifies the host's side. Local/global identifies the address view. With ordinary inside source NAT, the outside local and outside global values are the same.

Choose a mapping type

Static NAT gives one inside address a permanent one-to-one mapping. An inside server can then have a fixed outside address. Dynamic NAT assigns addresses from a pool on demand. A six-address pool without overload can serve six inside hosts at once; a seventh must wait until a mapping becomes free.

PAT, also called NAT overload, lets many hosts share one or a few public addresses. Ports distinguish TCP and UDP sessions; ICMP queries use query identifiers. The router can change a source port to prevent a collision. Port fields are 16 bits, but usable ports, destination reuse rules, and device resources determine actual session capacity.

Port forwarding, or static PAT, gives an inside service a fixed public address-and-port mapping. For example, public 203.0.113.2:443 can represent TCP 443 on 192.168.1.20. Other services can share the same public address through different port mappings.

Follow two connections

Hosts 192.168.1.10 and 192.168.1.11 both connect from TCP source port 51000 to 198.51.100.80:443. PAT uses outside address 203.0.113.2:

The second mapping avoids a collision. A reply to public port 51001 returns to 192.168.1.11:51000. The external server stays 198.51.100.80:443 in both outside-address columns.

Translation and protection do different jobs

NAT is not a firewall. It changes addressing; a firewall applies security rules. Translation also breaks direct end-to-end addressing. Applications that place addresses inside their data, such as SIP or active-mode FTP, may need helpers or NAT traversal. Translation logs help trace a shared public connection to an inside host.

IPv6 hosts normally use global addresses without NAT, with firewalls providing traffic control. Providers may apply carrier-grade NAT to IPv4 customers, often using shared range 100.64.0.0/10. That range is separate from RFC 1918 private space, and a customer's outside address can therefore still be behind another translator.

A working NAT configuration needs correct interface roles, a selection of inside addresses, a mapping rule, and routes. NAT cannot repair a missing path to the provider or a missing return route to the public mapping.

Mark the two sides

Suppose G0/0/0 faces 192.168.1.0/24 and G0/0/1 faces the provider:

interface GigabitEthernet0/0/0
 ip nat inside
interface GigabitEthernet0/0/1
 ip nat outside

The roles describe packet traversal. Reversing them prevents the intended inside-source translation.

Select a translation type

For a fixed one-to-one server mapping:

ip nat inside source static 192.168.1.20 203.0.113.5

For only the server's TCP 443 service:

ip nat inside source static tcp 192.168.1.20 443 203.0.113.2 443

Dynamic translation first selects sources and defines a pool:

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 203.0.113.9 203.0.113.14 netmask 255.255.255.248
ip nat inside source list 1 pool PUBLIC

The pool contains six host addresses, .9 through .14, in 203.0.113.8/29. Without overload, six inside hosts can hold mappings simultaneously. For PAT using that pool, add overload to the final command.

A common alternative uses the outside interface address:

ip nat inside source list 1 interface GigabitEthernet0/0/1 overload

These dynamic rules are alternatives for the intended design. The ACL here selects traffic for translation: permit means translate this source. It is not an interface filtering rule. A source that does not match may leave untranslated and fail to receive internet replies.

Decode a translation

show ip nat translations can display:

Pro Inside global        Inside local           Outside local        Outside global
tcp 203.0.113.2:51001     192.168.1.11:51000      198.51.100.80:443     198.51.100.80:443

Inside host .11 uses local port 51000, but appears outside on port 51001. Replies to that public endpoint map back to .11. The outside server's address and port are unchanged. Permanent static entries can show --- for fields that the mapping does not use.

show ip nat statistics lists active translations, hits, misses, interface roles, and pool usage. Generate traffic before expecting dynamic entries. Pool usage combined with failed new mappings helps identify exhaustion; a miss by itself does not establish the cause.

Find the broken dependency

Check roles, ACL source range, mapping rule, and whether overload was intended. Then check the router's default route and the provider's route back to the inside-global address or pool. A published server's clients must use the public address and mapped port.

In a lab, debug ip nat shows translation events. clear ip nat translation * clears dynamic entries after a change but interrupts those sessions; use it only when that interruption is acceptable. Static mappings remain configured.

An IPv4 host normally receives one default gateway through configuration or DHCP. If that router fails, another router on the same LAN does not automatically inherit the host's gateway setting. A first-hop redundancy protocol (FHRP) lets routers share a gateway identity that can survive one router's failure.

Keep the host's gateway unchanged

The group shares a virtual IP address (VIP) and a virtual MAC address. Hosts use the VIP as their default gateway. The active forwarding router answers ARP for that VIP with the virtual MAC. A standby or backup watches the active router's messages and takes over after failure detection.

On VLAN 10, R1 has 192.168.10.2/24 and R2 has 192.168.10.3/24. Their HSRP VIP is unused address 192.168.10.1. DHCP supplies .1 as the host gateway, not .2 or .3.

R1 is active at priority 110; R2 is standby at priority 100. If R1 stops sending Hellos, R2 takes over within the configured hold behavior. It uses the same virtual MAC and announces the move with gratuitous ARP. Switches learn the MAC on R2's port. The hosts can keep the VIP-to-virtual-MAC mapping already in their ARP caches, although some packets may be lost during detection and switchover.

Decide who forwards after recovery

Priority ranks candidates; a higher number is preferred. Preemption allows a router with higher priority to take the active role from a working lower-priority router. Without preemption, the established active router can remain active after the preferred router returns.

Now suppose R1's LAN interface still works but its provider uplink fails. R1 can keep sending gateway Hellos despite having no useful onward path. Tracking connects the uplink's health to R1's priority. With decrement 20:

R2's 100 is higher than 90. If R2 has preemption enabled, it can take the active role. A decrement of only 10 would leave both at 100; that equality does not force the current active router to give up its role. Choose the decrement to make the backup strictly better after the failure.

Know what the shared gateway protects

An FHRP exchanges gateway-role messages, not routing information. Each forwarding router still needs usable routes. HSRP and VRRP have one forwarding router per group; adding a second member does not double that group's forwarding capacity. Separate groups can distribute different VLANs across different active routers.

For HSRP, use a separate unused VIP in the LAN subnet. VRRP has an address-owner case in which the VIP is a router's real interface address, so that HSRP address rule does not apply to every FHRP.

IPv6 hosts can learn multiple default routers through Neighbor Discovery and switch when one becomes unreachable. That native process can take many seconds with default detection settings. HSRPv2 and VRRPv3 can also supply IPv6 virtual gateways with controlled, faster failover.

Gateway protocols share a purpose but differ in ownership, defaults, and load sharing. Use those differences when reading status: a higher-priority standby is normal in HSRP if it cannot preempt.

Compare roles and defaults

HSRP sends Hellos every 3 seconds with a 10-second hold time. Priority ranges from 0 to 255; a fresh-election tie goes to the highest interface IP. Version 1 supports groups 0–255, uses multicast 224.0.0.2, and virtual MAC 0000.0c07.acXX, with the group in hexadecimal. Group 10 therefore ends in 0a. Version 2 supports groups 0–4095, uses 224.0.0.102, and virtual MAC 0000.0c9f.fXXX; it also supports IPv6.

VRRPv3 is defined in RFC 9568. Its forwarding role is active router; older commands and documentation may call it master. Priority 255 is reserved for the VIP's address owner. A priority tie uses the highest primary IP. IPv4 advertisements go to 224.0.0.18 using IP protocol 112, with a default interval of 1 second. The virtual MAC is 0000.5e00.01XX, with the virtual router ID in hexadecimal.

VRRP's active-down interval is three advertisement intervals plus skew time. With priority 100 and a 1-second advertisement interval:

A higher-priority backup has a smaller skew and waits slightly less.

GLBP's active virtual gateway (AVG) answers ARP for one VIP with different virtual MACs. Up to four active virtual forwarders (AVFs) share the hosts' traffic. HSRP and VRRP can distribute traffic across multiple groups, but do not share forwarding within one group this way.

Configure one HSRP group

Under R1's LAN interface:

ip address 192.168.10.2 255.255.255.0
standby version 2
standby 10 ip 192.168.10.1
standby 10 priority 110
standby 10 preempt

R2 uses .3, the same version, group, and VIP, and standby 10 preempt; it keeps default priority 100. Both LAN interfaces must be enabled.

Read the current roles

show standby brief can show R1 as:

Interface Grp Pri P State  Active Standby      Virtual IP
Gi0/0/0   10  110 P Active local  192.168.10.3 192.168.10.1

P means preemption is configured; local identifies this router's role. On R2, State is Standby, Active is 192.168.10.2, and Standby is local. HSRP's states include Initial, Learn, Listen, Speak, Standby, and Active.

Both routers reporting Active calls for checks of hello delivery, VLAN, group, version, filters, and links. A higher-priority standby may lack preemption. If roles look healthy but hosts fail, check that their gateway is the VIP. show vrrp brief gives VRRP's equivalent overview. Choose VRRP for multivendor support, HSRP for a Cisco design, or GLBP when one Cisco group must share forwarding.