Back to blog

Cisco / IOS  ·  Tutorial  ·  July 2026

Cisco IOS
Static Routing & OSPF

A router only knows the networks on its own interfaces — everything else has to be taught or learned. Read the routing table like a native, write static and default routes, build failover with floating statics, then let single-area OSPF maintain the map for you.

Cisco IOS Routing Static Routes OSPF Failover CCNA

HOW A ROUTE WINS — three filters, in order 1 · LONGEST PREFIX /28 beats /24 beats /16 beats /0 most specific match to the destination wins, always 2 · ADMIN DISTANCE same prefix from two sources? connected 0 · static 1 · OSPF 110 lower AD = more trusted source 3 · METRIC same prefix, same protocol? lowest cost wins; equal cost = load-balanced (ECMP) Every routing mystery resolves by walking these three questions against show ip route.

Out of the box, a router knows exactly the subnets configured on its own interfaces — the connected routes — and nothing else. Every other destination needs a route from one of two sources: you (static routes — precise, silent, and dumb: they never notice a dead path) or a routing protocol (OSPF — the routers exchange topology and recompute around failures on their own).

Small sites live happily on statics. The moment you have three routers or a redundant path, hand the map to OSPF and keep statics for the edges — the default route toward the ISP, and a floating static as the failover of last resort. This post builds exactly that progression, and teaches the one skill underneath it all: reading show ip route and knowing why each line is there.

Prerequisites

01

Reading the Routing Table Safe to Run

Everything the router will ever do with a packet is written in show ip route. Learn the codes, the [AD/metric] pair, and longest-prefix-wins, and the table stops being noise.

IOS — the routing table, annotated
R1# show ip route
Codes: L - local, C - connected, S - static, O - OSPF, * - candidate default

Gateway of last resort is 203.0.113.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 203.0.113.1
      ↑ the default route — "everything I don't know goes to the ISP"
C     192.168.10.0/24 is directly connected, GigabitEthernet0/1
      ↑ connected — this subnet lives on my own interface
L     192.168.10.1/32 is directly connected, GigabitEthernet0/1
      ↑ local — my own address on that interface (always /32)
S     10.20.0.0/16 [1/0] via 192.168.90.2
      ↑ static — a human wrote this; [AD 1 / metric 0]
O     10.30.1.0/24 [110/2] via 192.168.90.2, 00:41:07, GigabitEthernet0/2
      ↑ OSPF — learned automatically; [AD 110 / cost 2], age, exit interface

The bracket pair is the key: [administrative distance / metric]. AD ranks the source of the route (connected 0, static 1, OSPF 110 — lower is more believable). The metric ranks paths within a protocol. And before either of those, longest prefix always wins: a packet to 10.30.1.7 takes the /24 route above, never the /16, never the default. Route selection is those three questions, asked in that order — exactly as in the diagram.

02

Static Routes & the Default Route

A static route is one line: destination, mask, and where to send it. The most important static in every network is the default route — the packet's last resort.

IOS — static routes: specific, default, and host
# "To reach the branch LAN 10.20.0.0/16, hand packets to 192.168.90.2"
R1(config)# ip route 10.20.0.0 255.255.0.0 192.168.90.2
# NOTE: a real subnet mask this time — statics use masks, ACLs use wildcards.

# The default route — 0.0.0.0/0 matches everything not known better
R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1

# A host route (/32) — pin one destination to a specific path
R1(config)# ip route 10.99.0.5 255.255.255.255 192.168.90.6

# Remove any of them with "no" + the exact same line
R1(config)# no ip route 10.99.0.5 255.255.255.255 192.168.90.6
⚠ Gotcha — Next-Hop IP, Not Interface (on Ethernet)

IOS lets you write ip route 10.20.0.0 255.255.0.0 GigabitEthernet0/2 — no next-hop, just an exit interface. On point-to-point links that's fine; on Ethernet it's a trap. The router must then ARP for every destination host through that interface, bloating the ARP table and breaking entirely if the neighbour has proxy-ARP disabled. On Ethernet, always give the next-hop IP address.

💡 Remember — Routing Must Work in Both Directions

A classic dead-end: you add the route to the branch, pings still fail — because the branch router has no route back. Every path needs a route on both ends (or a default that covers it). When a static route "doesn't work," check the return path first; it's the culprit more often than the route you just typed.

03

Floating Statics — Failover Without a Protocol

Give a backup route a worse administrative distance and it stays out of the table until the primary dies. This is the classic two-WAN failover on a Cisco edge — the same problem our Starlink failover post solves on MikroTik.

IOS — primary fibre, backup LTE, automatic failover
# Primary default route via fibre (AD 1 — normal static)
R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1

# Backup default via LTE with AD 10 — "floating": installed only
# when the primary route disappears
R1(config)# ip route 0.0.0.0 0.0.0.0 198.51.100.1 10

# While fibre is up, only the AD-1 route is in the table:
R1# show ip route static
S*    0.0.0.0/0 [1/0] via 203.0.113.1
# Pull the fibre → interface down → AD-1 route withdrawn → AD-10 takes over.
⚠ Gotcha — A Floating Static Only Floats if the Primary Actually Leaves

The AD-1 route is withdrawn when its next-hop becomes unreachable — which IOS detects by the interface going down. If your fibre dies upstream but the local port stays up/up (very common with an ONT or media converter in between), the primary route never leaves the table and the backup never installs. The fix is to tie the static to a reachability probe: an IP SLA ping with a track object (ip route 0.0.0.0 0.0.0.0 203.0.113.1 track 1). That's the Cisco equivalent of MikroTik's netwatch/recursive-route trick from our Starlink failover writeup — worth its own post.

04

Single-Area OSPF — The Self-Maintaining Map

Beyond a couple of routers, statics become a maintenance tax with no failover. OSPF routers introduce themselves, exchange the topology, and recompute when links die. Small networks need exactly one area: 0.

IOS — OSPF on two routers (repeat the pattern on each)
R1(config)# router ospf 1
# "1" is a local process ID — it does NOT need to match between routers.

R1(config-router)# router-id 1.1.1.1
# Explicit router-id: stable identity in every neighbor table and debug.

# Which interfaces join OSPF — matched by network + WILDCARD (like ACLs):
R1(config-router)# network 192.168.90.0 0.0.0.3 area 0    # the /30 link to R2
R1(config-router)# network 192.168.10.0 0.0.0.255 area 0  # the LAN we advertise

# Don't send hellos where no router lives (security + noise):
R1(config-router)# passive-interface default
R1(config-router)# no passive-interface GigabitEthernet0/2   # the R2 link only

# Edge router bonus: hand the default route to everyone via OSPF
R1(config-router)# default-information originate
R1(config-router)# end

Configure the mirror image on R2 (its own router-id, its own LAN network statement, same area 0), and within seconds the two are neighbors and each learns the other's LAN. Add a third router later and nobody types a route — the map updates itself. Two details worth pinning: the network statement uses wildcard masks (the ACL habit pays off), and it doesn't advertise a network so much as it enables OSPF on any interface whose address matches — the interface's actual prefix is what gets advertised.

05

Verify OSPF Safe to Run

Three commands tell the whole story: are we neighbors, what did I learn, and what is OSPF doing on my interfaces.

IOS — the OSPF health check
# 1. Neighbors — FULL means the relationship works
R1# show ip ospf neighbor
Neighbor ID   Pri   State      Dead Time   Address        Interface
2.2.2.2         1   FULL/DR    00:00:36    192.168.90.2   GigabitEthernet0/2

# 2. What OSPF put in the routing table
R1# show ip route ospf
O     10.30.1.0/24 [110/2] via 192.168.90.2, 00:04:11, GigabitEthernet0/2
O*E2  0.0.0.0/0 [110/1] via 192.168.90.2   ← the originated default

# 3. Which interfaces run OSPF, their cost and state
R1# show ip ospf interface brief
Interface    PID   Area   IP Address/Mask     Cost  State Nbrs F/C
Gi0/2        1     0      192.168.90.1/30     1     P2P   1/1
Gi0/1        1     0      192.168.10.1/24     1     DR    0/0
⚠ Gotcha — No Neighbor? Check These Four, In Order

OSPF adjacency is fussy on purpose. When show ip ospf neighbor is empty: (1) can the routers ping each other at all; (2) did passive-interface default silence the link that should be talking (the #1 self-inflicted cause — no passive-interface it); (3) do hello/dead timers and subnet masks match on both ends of the link (mismatched mask = no adjacency, and it looks fine in isolation); (4) are both sides in the same area. A neighbor stuck oscillating in EXSTART/EXCHANGE is its own beast: that's almost always an MTU mismatch — align the MTUs or the database exchange never completes.

06

Statics or OSPF? — An Honest Decision Table

Not a religious question. Count your routers and your redundant paths.

SituationUse
One router + ISPA default static. OSPF would add nothing.
Two routers, one linkStatics are fine; OSPF is also fine and self-documents.
3+ routers, or any redundant pathOSPF area 0. Static spaghetti with failover is where outages breed.
Dual WAN on one edgeFloating static + IP SLA tracking (or leave both defaults to OSPF if the ISPs speak it).
Path that must never moveA /32 or specific static — AD 1 beats OSPF 110, deliberately.

07

MikroTik ↔ Cisco — Routing Rosetta

Same concepts, same math, different spelling. RouterOS distance = IOS administrative distance.

MikroTik / RouterOSCisco IOS
/ip route add dst-address=0.0.0.0/0 gateway=…ip route 0.0.0.0 0.0.0.0 <next-hop>
distance=10 on a backup routeFloating static: trailing AD (… 198.51.100.1 10)
check-gateway=ping / netwatchIP SLA + track object on the static
/routing ospf instance + area area=backbonerouter ospf 1 + area 0
/routing ospf interface-template networks=…network <net> <wildcard> area 0
passive=yes on a templatepassive-interface
/ip route printshow ip route

Takeaways

  1. Route selection is three questions in fixed order: longest prefix, then administrative distance (connected 0 < static 1 < OSPF 110), then metric. Every "why did it go THAT way" resolves against this list.
  2. Statics use subnet masks; ACLs and OSPF network statements use wildcards. Keep the two mask families straight and half the classic typos disappear.
  3. The default route is the workhorse: ip route 0.0.0.0 0.0.0.0 <ISP>. On Ethernet, always point statics at a next-hop IP, not an exit interface.
  4. Routing must work in both directions. When a new route "doesn't work," the missing piece is usually the return route on the far router.
  5. Floating statics give failover for one extra digit — a trailing AD. But they only fail over when the primary leaves the table; if the port stays up while the ISP is dead, you need IP SLA tracking.
  6. OSPF earns its keep at three routers or any redundancy. One area (0), explicit router-ids, passive-interface default with exceptions, and default-information originate at the edge.
  7. Debug adjacencies with the fixed checklist: reachability → passive-interface → timers/mask match → same area; and EXSTART loops mean MTU. It's fussy, but it's fussy in predictable ways.

Multi-site or dual-WAN network in Crete?

NOCTIS designs routing that fails over by itself — OSPF backbones, tracked failover to Starlink or LTE, and clean documentation — on Cisco, MikroTik, or both. Tested by unplugging things, not by hoping.

Book a Discovery Call →