Static Routing on Cisco: Next Hop vs Exit Interface

A static route is a destination an administrator types in rather than one a routing protocol discovers. The IPv4 command is ip route in global configuration mode, taking the destination network, a dotted-decimal mask, and a forwarding instruction: a next-hop address, an exit interface, or both. The IPv6 equivalent is ipv6 route, which takes a prefix in slash notation. Both default to administrative distance 1 and accept an optional trailing integer that changes it.

Command syntax

R2(config)# ip route 172.31.4.0 255.255.255.0 10.12.0.2

The mask is always dotted decimal here. ip route 172.31.4.0/24 10.12.0.2 is rejected, and the same restriction applies to ip address. IPv6 goes the other way and uses only slash notation.

The optional arguments that follow are the administrative distance (a bare integer), name for a description, tag for redistribution filters, track to bind the route to a tracked object, and permanent to hold the route in the table even when the exit interface goes down. A number with no keyword in front of it is always the distance.

The three forwarding forms

	Next hop only	Exit interface only	Fully specified
Command	ip route 172.31.4.0 255.255.255.0 10.12.0.2	ip route 172.31.5.0 255.255.255.0 serial0/0/1	ip route 172.31.6.0 255.255.255.0 gi0/1 10.12.0.2
Table display	S 172.31.4.0/24 [1/0] via 10.12.0.2	S 172.31.5.0/24 is directly connected, Serial0/0/1	S 172.31.6.0/24 [1/0] via 10.12.0.2, GigabitEthernet0/1
Recursive lookup	Yes	No	No
Tied to interface state	Indirectly	Directly	Directly
On multi-access Ethernet	Acceptable	No	Preferred

IOS prints each entry in the shape it was configured, so the three forms are distinguishable at a glance once you know what each field of a routing table line means. The phrase is directly connected on a line carrying the S code does not mean the route became a connected route: the code letter is still S and the distance is still 1. An address followed by a comma and an interface name describes one path, not two, because equal-cost paths appear on separate lines.

Recursive lookup

A next-hop-only route says where to send the packet but not how to get there, so the router performs a second lookup on the next-hop address to learn which interface reaches it. If that second lookup fails, the route is not installed at all, which is why a static aimed at an address the router has no route to appears to vanish silently. The other two forms skip the recursion, because the interface is stated outright.

Exit interface on Ethernet

On a point-to-point link such as a serial circuit, naming only the exit interface is unambiguous: anything sent out reaches exactly one device. On a multi-access Ethernet segment it is ambiguous, because the interface faces many potential neighbors and no address was given to aim at.

The router then treats the destination network as directly attached and sends an ARP request onto the segment for every individual remote host address. Those requests succeed only if a router on the segment runs proxy ARP and answers with its own MAC address on the remote host’s behalf. Three costs follow: forwarding depends on a feature disabled on many networks, the ARP table fills with one entry per remote host, and traffic stops silently if proxy ARP is turned off later. Use the fully specified form on Ethernet.

Interface state dependency

Any route naming an exit interface is installed only while that interface is up and up. Shut the port and the entry is withdrawn, so show ip route static comes back empty rather than showing a down route. no shutdown restores the entry without retyping anything. That explains a static route accepted at the command line whose interface reads administratively down.

R5(config)# interface gigabitethernet0/2
R5(config-if)# no shutdown

Default routes

A default route is a static route whose destination is all zeros, meaning it matches any address:

R6(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1
R6(config)# ipv6 route ::/0 2001:DB8:FFFF::1

The IPv4 default appears with the code S*, where the asterisk marks a candidate default, and the header line reports it as the gateway of last resort. Carrying zero mask bits, it loses to every other matching route under the most-specific-match rule, so it forwards only what nothing else claimed. A host route is the opposite extreme, a 32-bit mask (255.255.255.255) aimed at one address.

Distance and backup routes

The trailing integer sets administrative distance, replacing the default of 1:

R8(config)# ip route 10.44.0.0 255.255.0.0 172.16.9.2 210

Raised above the distance of whatever supplies the primary route, the static loses the comparison, stays out of the table while the primary exists, and is installed automatically when the primary prefix is withdrawn. No reload is involved, and the interface it uses must stay up so the route is installable the instant it is needed. Because the two candidates carry different distances they are never installed together, so a backup of this kind never shares load with the primary. The technique is developed further in the article on floating static routes.

The accepted range is 1 through 255. A route configured at 255 is never installed, even unopposed, because 255 marks a source unusable, and IOS stores the value as typed.

IPv6 static routes

Unicast routing is off by default on IPv6 and must be enabled first:

R9(config)# ipv6 unicast-routing
R9(config)# ipv6 route 2001:DB8:60::/48 2001:DB8:2::1
R9(config)# ipv6 route 2001:DB8:70::/48 2001:DB8:9::1 130

The distance table is shared between the two address families, so an IPv6 static route with no trailing value carries a distance of 1, the same as its IPv4 counterpart. The backup technique is therefore identical in both stacks: OSPFv3 uses the same value of 110 that OSPFv2 uses, so a static held in reserve behind it must be configured above 110, and 130 is a conventional choice. There is no backup keyword; the behavior comes entirely from the number.

A global unicast next-hop address works on its own, as above. A link-local next-hop address does not, and the exit interface must be supplied with it:

R9(config)# ipv6 route 2001:DB8:80::/48 gigabitethernet0/1 FE80::2

Link-local addresses are unique only within a single link, and the same FE80:: address can legitimately exist on every interface the router owns. Without an interface name the router cannot know which link to send the packet out of, so the fully specified form is required whenever the next hop is link-local.

Verification

show ip route static lists installed static entries in their configured shape, and show ipv6 route static does the same for IPv6. show ip route <address> resolves one address and names the prefix that won, with the source in quotes and its distance and metric. show running-config | include ip route shows what is configured regardless of what is installed, the right tool for a route held in reserve by a raised administrative distance.

How the 200-301 exam tests this

• Identify the form from the output. Three static entries appear in different display shapes and you state how each was configured. Bracket plus via is next-hop-only, is directly connected is exit-interface-only, address plus interface is fully specified.
• A route configured but missing. The exit interface is down, the distance was raised above a competing source, or the next hop is unreachable. The stem points at one of the three.
• Reading the trailing number. A bare integer at the end of ip route is the administrative distance, not a metric, a tag, or a tracked object number, each of which needs its own keyword.
• Picking the IPv6 command. A backup behind OSPFv3 requires a value above 110. Choices that omit the number, use 90, or invent a keyword are the wrong answers.

All four patterns are fast points once the display shapes are familiar, and practice questions that show the output forms repeatedly make them so.

Quick reference

• ip route <network> <dotted-decimal-mask> <next-hop | interface | interface next-hop> [distance].
• IPv4 masks are dotted decimal; IPv6 prefixes use slash notation.
• Next-hop-only requires a recursive lookup; the other two forms do not.
• Exit-interface-only on multi-access Ethernet relies on proxy ARP and bloats the ARP table.
• A route naming an interface is withdrawn while that interface is down.
• Default routes are 0.0.0.0 0.0.0.0 and ::/0, displayed as S* with the gateway of last resort header.
• Static routes default to administrative distance 1 in both address families; 255 means never installed.
• An IPv6 link-local next hop must be paired with an exit interface.