Floating Static Routes: Backup Paths Using Administrative Distance

A floating static route is an ordinary static route configured with an administrative distance (AD) higher than the distance of whatever normally supplies that prefix. A router installs only the lowest-distance candidate for a given prefix, so the floating route stays in the configuration and out of the routing table while the primary path is healthy. The moment the primary route is withdrawn, the floating static becomes the best remaining candidate, gets installed, and carries the traffic until the primary comes back.

Administrative distance and route selection

Administrative distance is a trustworthiness rating that IOS applies when two different sources offer the same prefix with the same prefix length. It is Cisco’s own construct, not a standards-body value, and it never leaves the local router. Lower is preferred.

Route source	Default administrative distance
Connected interface	0
Static route	1
eBGP	20
EIGRP (internal)	90
OSPF	110
IS-IS	115
RIP	120
EIGRP (external)	170
iBGP	200

Two things happen before distance is consulted. Longest prefix match runs first, so a /24 always beats a /16 for an address inside it no matter what learned each one. Metric runs last, and only inside a single protocol. Distance is the middle step, and it is the only one a floating static manipulates. The mechanics of that comparison are covered in administrative distance.

Syntax

The distance is an optional trailing value on the ip route command, positioned after the next hop:

R1(config)#ip route 10.60.0.0 255.255.0.0 192.0.2.9 130

The 130 is the administrative distance, not a metric and not a bandwidth. Omit it and the route takes the static default of 1, which outranks every dynamic protocol and turns an intended backup into a permanent override. Static routes are written with a dotted-decimal mask, never with slash notation, and the rest of the syntax including the next hop versus exit interface choice is unchanged by the added distance. The IPv6 form places the distance in the same position:

R1(config)#ipv6 route 2001:DB8:60::/48 2001:DB8:FF::9 130

Distance value selection

The value has to exceed the distance of the protocol that supplies the primary path, and nothing more clever than that is required. If OSPF (distance 110) feeds the prefix, anything from 111 upward keeps the static idle; 130 and 200 behave identically here. If the primary is an EIGRP internal route at 90, a static at 130 floats correctly, but a static at 100 also floats, and a static left at the default 1 would take over immediately and blackhole traffic through a circuit nobody intended to use.

Backing up one static route with another follows the same rule with smaller numbers. The primary static keeps the default distance of 1 and the backup is configured at 5 or 10. Sizing it deliberately matters when the same prefix might later be learned dynamically, because a backup static at 5 would still beat an OSPF route at 110.

Two floating statics can be stacked to build an ordered preference list: primary at distance 1 through the MPLS circuit, second at 5 through a broadband tunnel, third at 10 through cellular. IOS installs exactly one of them at a time, the survivor with the lowest distance.

Failover and failback

Failover is a routing-table event, not a timer. When OSPF ages out or explicitly withdraws the prefix, the route processor removes that entry and re-evaluates the remaining candidates for the same prefix. The floating static is installed at that instant, and the routing table changes its code letter from O to S and its distance from [110/3] to [130/0]:

R1# show ip route 10.60.0.0
Routing entry for 10.60.0.0/16
  Known via "static", distance 130, metric 0

Failback is automatic and immediate. As soon as the dynamic protocol re-advertises the prefix, its lower distance wins, the static is pulled back out of the table, and traffic returns to the primary. There is no hold-down and no preemption setting to configure. A primary circuit that flaps therefore drags the data path back and forth with it, which is one argument for dampening the underlying protocol rather than the static route.

Object tracking and IP SLA

A static route with a next-hop IP address is considered valid as long as the router has a route to that next hop and the local exit interface is up. That is a very local test. If the cellular modem stays up but the carrier drops the far side, or the primary circuit’s remote end fails while the local Ethernet link to the CPE (customer premises equipment) stays lit, the router keeps believing the path it is using is fine. Traffic is forwarded into a black hole, and the routing table looks completely healthy.

The remedy is to bind the route to a reachability test rather than to link state. IP SLA (IP Service Level Agreement) sends periodic probes, typically ICMP echoes, to an address on the far side of the path. A tracked object watches that probe, and the static route references the object:

R1(config)#ip sla 1
R1(config-ip-sla)#icmp-echo 203.0.113.10 source-interface GigabitEthernet0/0
R1(config-ip-sla)#frequency 5
R1(config)#ip sla schedule 1 life forever start-time now
R1(config)#track 1 ip sla 1 reachability
R1(config)#ip route 0.0.0.0 0.0.0.0 203.0.113.1 track 1

When the probes stop returning, the tracked object goes down, the primary static is withdrawn from the table even though its interface is still up, and the floating backup installs. This is the same tracking machinery that first hop redundancy protocols use to hand off a gateway role, described in HSRP vs VRRP vs GLBP.

Verification

show ip route shows only what is installed, so a correctly configured floating static is invisible there during normal operation, and its absence is not evidence of a mistake. Reading the code letters and the AD/metric brackets is what tells you which source is currently winning the prefix. show running-config | include ^ip route confirms the route exists and shows the distance you configured. show ip route static lists installed static routes only. To prove the failover works, shut the primary interface or clear the dynamic adjacency and watch the entry appear.

How the 200-301 exam tests this

• Value selection. A stem names the protocol that supplies the primary route and asks which ip route line produces backup behavior. The distractors are the same command with no distance (defaults to 1, wrong), with a distance below the protocol’s (wrong), and with a plausible-looking distance above it (correct). Compare the trailing number against the protocol’s default distance and nothing else.
• Distance versus metric. An item asks what the trailing number on ip route does. It sets administrative distance. It does not set cost, bandwidth, or preference within a protocol.
• The silent failure. A scenario describes a backup path that installed correctly but still drops traffic, or a primary that never fails over even though the far end is dead. The answer names IP SLA with object tracking, because link state alone cannot see past the local interface.
• Reading the aftermath. Given show ip route output where a prefix appears as S with a bracketed distance well above 1, you are asked what state the network is in. The primary source has withdrawn the prefix and the backup is carrying traffic.

Every one of these hinges on comparing one trailing number against one default, and 200-301 practice questions make that comparison reflexive.

Quick reference

• A floating static is a static route whose administrative distance is set higher than the primary source’s distance.
• The distance is the optional trailing value: ip route 10.60.0.0 255.255.0.0 192.0.2.9 130.
• Omitting it gives distance 1, which beats every dynamic protocol and defeats the design.
• Behind OSPF use 111 or more, behind EIGRP internal 91 or more, behind RIP 121 or more, behind another static 2 or more.
• Longest prefix match is evaluated before administrative distance; distance only breaks ties between equal-length prefixes.
• Failover happens when the primary prefix leaves the routing table, and failback is automatic with no delay.
• A static route with a next-hop address only tests the local interface and the route to that next hop.
• IP SLA probes plus track plus ip route ... track 1 detect failures beyond the local link.
• A floating static route does not appear in show ip route while the primary is up; confirm it in the running configuration.