Chapter 3: IP Connectivity
Getting packets from one network to another is the core job of a router, and the heart of the CCNA exam. This chapter covers how routers learn routes, how to read the routing table, static routing, OSPF, first-hop redundancy, and applying subnetting to real designs. Work every calculation and exercise — Cisco tests this chapter heavily, and it is all configuration you will do on the job.
3.1 How Routers Learn Routes
A router only forwards a packet if it knows a path to the packet's destination network. It learns those paths from three sources, listed here from most trusted to least trusted.
Connected routes appear automatically when you address an interface and bring it up — no extra configuration, and the most trusted routes the router knows.
Static routes are typed in by hand with the ip route command. Simple and predictable, but they never adapt when the network changes.
Dynamic routes come from routing protocols (OSPF, EIGRP, RIP, BGP) that let routers share routes and reconverge automatically after failures — essential at scale.
A router can know about the same destination network from more than one source at the same time. It picks the winner using administrative distance first (lower is more trusted), and only compares the protocol's metric when the administrative distances tie.

3.2 Reading the Routing Table
The routing table is the router's decision map. Display it with show ip route. Here is a typical output:
Gateway of last resort is 203.0.113.1 to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via 203.0.113.1
10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 10.1.1.0/24 is directly connected, GigabitEthernet0/0
L 10.1.1.1/32 is directly connected, GigabitEthernet0/0
S 192.168.20.0/24 [1/0] via 192.168.10.2
O 192.168.20.128/25 [110/3] via 192.168.10.2, 00:14:22, GigabitEthernet0/1
The letter at the start of each line is the route code, telling you how the router learned the route:
| Code | Meaning |
|---|---|
| C | Connected — a network on one of the router's own interfaces |
| L | Local — the router's own interface IP address, always a /32 |
| S | Static — hand-configured with ip route |
| S* | Static candidate default route |
| O | OSPF-learned route |
| D | EIGRP-learned route |
| R | RIP-learned route |
| B | BGP-learned route |
The numbers in brackets are [administrative distance/metric]. Administrative distance (AD) measures how trustworthy the source is; metric measures how good this particular path is. The exam expects you to know these AD values cold:
| Route source | Administrative distance |
|---|---|
| Connected interface | 0 |
| Static route | 1 |
| EIGRP summary route | 5 |
| External BGP | 20 |
| Internal EIGRP | 90 |
| OSPF | 110 |
| IS-IS | 115 |
| RIP | 120 |
| External EIGRP | 170 |
| Internal BGP | 200 |
The router's selection process for each destination runs in this exact order:
- Longest prefix match wins. The route whose subnet mask matches the most bits of the destination address is used, regardless of AD or metric.
- Lowest administrative distance wins (only compared among routes with the same prefix length).
- Lowest metric wins (only compared among routes from the same source).
Cisco loves the trap where a static /24 and an OSPF /25 both cover a destination. The /25 wins because of the longest prefix match — AD is never even compared. Always check mask length before AD.
Route selection: a router learns 172.16.0.0/16 from two sources. - Source A: OSPF, AD 110, cost 50 - Source B: static route, AD 1 Which route enters the routing table, and why? Step 1: Both routes have the same prefix length (/16), so longest-prefix-match does not decide. Step 2: Compare administrative distance: static AD 1 vs OSPF AD 110. Step 3: Lower AD wins. 1 < 110. Final answer: the static route is installed. The metric (cost 50) is never compared because the ADs differ.
Using the routing table shown at the start of this section, a packet arrives destined for 192.168.20.200. Which route does the router use — the static 192.168.20.0/24 or the OSPF 192.168.20.128/25?
Show solution
The OSPF route 192.168.20.128/25. The destination 192.168.20.200 falls inside both 192.168.20.0/24 and 192.168.20.128/25, but the /25 matches 25 bits of the destination address versus 24 bits for the /24 — it is the longest prefix match, so it wins even though OSPF's AD (110) is worse than the static route's AD (1). AD is only compared between routes of equal prefix length.
3.3 Static Routing
Static routes are configured with the ip route command:
R1(config)# ip route 192.168.20.0 255.255.255.0 192.168.10.2
The three parts are the destination network, its subnet mask, and the next hop — either the next-hop IP address or the local exit interface. On a point-to-point serial link you can safely point at the exit interface (ip route 192.168.20.0 255.255.255.0 Serial0/0/0), but on a multi-access network like Ethernet you should use the next-hop IP address; otherwise the router must ARP for every destination address, which hurts performance.
When the next hop is an IP address, the router performs a recursive lookup: it searches the routing table a second time to find how to reach the next-hop address itself. If the next hop is unreachable, the static route is not installed.
A default route — the "gateway of last resort" — matches everything not matched by a more specific route. It uses the quad-zero address:
R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1
A floating static route is a backup path that only enters the table when the primary route disappears — create it by raising the static route's AD above the primary's:
R1(config)# ip route 10.0.0.0 255.0.0.0 172.16.1.2 120
With AD 120, this loses to OSPF's 110 under normal conditions and floats unused. If the OSPF route fails, the floating static installs and traffic keeps flowing.
A floating static route is simply a static route with a manually raised administrative distance, so it loses the AD contest under normal conditions and only takes over when the better route fails.
A branch router learns 10.0.0.0/8 via OSPF (AD 110). You want a backup path through a second ISP using next-hop 198.51.100.1, active only if OSPF fails. Write the configuration command.
Show solution
ip route 10.0.0.0 255.0.0.0 198.51.100.1 120
The AD of 120 is higher than OSPF's 110, so under normal conditions the OSPF route wins and this static route stays out of the routing table. If the OSPF route disappears, the router installs this floating static route and traffic fails over to the second ISP. Any AD above 110 works; 120 is the common convention.
3.4 OSPF Concepts
Open Shortest Path First (OSPF) is the dynamic routing protocol Cisco expects you to know best. OSPFv2 carries IPv4 routes (OSPFv3 handles IPv6). It is a link-state protocol: every router builds a complete map of the network and independently calculates the shortest path to each destination using the Dijkstra algorithm. Its metric is cost, and the lowest-cost path wins.
Areas. OSPF splits large networks into areas so no router must map the entire topology. Every design has a backbone area, Area 0, and all other areas must connect to it. A router with interfaces in multiple areas is an Area Border Router (ABR). All routers in Area 0 only = single-area OSPF; anything more = multi-area.
Router ID (RID). Each OSPF router needs a unique 32-bit ID, chosen as: (1) the address from the router-id command, (2) the highest IP among up loopback interfaces, (3) the highest IP among active physical interfaces. Duplicate RIDs break adjacency, so set them manually.
Neighbor adjacency. OSPF routers become neighbors by exchanging Hello packets on multicast 224.0.0.5. To reach the Full adjacency state, neighbors must agree on: the area ID, the Hello and Dead timers, the subnet they share, authentication settings, the stub-area flag, and the MTU. The adjacency progresses through these states:
| State | Meaning |
|---|---|
| Down | No Hellos received |
| Init | Hello received, but this router not listed in it |
| 2-Way | Bidirectional Hellos — neighborship established |
| ExStart | Routers negotiate who leads the database exchange (higher RID wins) |
| Exchange | Database Description packets exchanged |
| Loading | Link-state requests and updates sent |
| Full | Databases synchronized — adjacency complete |
Hello and Dead timers. On broadcast and point-to-point networks, Hellos go out every 10 seconds and a neighbor is declared dead after 40 seconds of silence (the Dead interval defaults to four times the Hello). On NBMA networks the defaults are 30 and 120 seconds. Mismatched timers prevent adjacency.
DR and BDR election. On multi-access networks (broadcast, NBMA), OSPF elects a Designated Router (DR) and Backup (BDR) so routers form full adjacencies only with the DR/BDR instead of every neighbor. Highest OSPF priority (0–255, default 1) wins; ties break on highest router ID. Priority 0 = never DR/BDR. The election is not preemptive: a higher-priority newcomer does not displace an elected DR. Updates go to the DR/BDR on 224.0.0.6. Point-to-point links have no DR/BDR.
Cost calculation. Interface cost = reference bandwidth ÷ interface bandwidth. The default reference bandwidth is 100 Mbps (100,000,000 bps), which you can raise with auto-cost reference-bandwidth (value in Mbps) so fast modern links get distinct costs.
Calculate the OSPF cost of a T1 serial interface (bandwidth 1.544 Mbps) with default settings. Step 1: Reference bandwidth = 100,000,000 bps. Step 2: Interface bandwidth = 1.544 Mbps = 1,544,000 bps. Step 3: Cost = 100,000,000 ÷ 1,544,000 = 64.77. Step 4: OSPF truncates to an integer (it rounds down, never up). Final answer: cost 64. Bonus: a GigabitEthernet interface gives 100,000,000 ÷ 1,000,000,000 = 0.1, but OSPF cost can never be below 1, so it becomes cost 1 — the same as FastEthernet. This is exactly why Cisco recommends raising the reference bandwidth on modern networks.
The exam tests DR/BDR election with a small table of priorities and router IDs. Remember the order: highest priority first, then highest router ID — and priority 0 is disqualified entirely. Also remember the election is not preemptive, so the question may ask what happens when a higher-priority router boots after the DR is already elected (answer: nothing changes).

3.5 Configuring Single-Area OSPFv2
Basic OSPF configuration needs a process ID (locally significant — it does not have to match between neighbors) and network statements that use wildcard masks to select which interfaces participate:
R1(config)# router ospf 1
R1(config-router)# router-id 1.1.1.1
R1(config-router)# network 192.168.10.0 0.0.0.255 area 0
R1(config-router)# network 10.0.0.1 0.0.0.0 area 0
R1(config-router)# passive-interface GigabitEthernet0/1
R1(config-router)# auto-cost reference-bandwidth 1000
Notes: the wildcard mask is the inverse of a subnet mask (0s = must match, 1s = ignore), so 0.0.0.0 selects one exact address. passive-interface stops Hellos on LANs with no OSPF neighbor. Verify with show ip ospf neighbor (Full state) and show ip ospf interface (timers, DR/BDR, cost).
An OSPF router has priority 0, and its neighbor has priority 100. An election takes place on their shared broadcast segment. Which router becomes DR, and can the priority-0 router ever become BDR?
Show solution
The neighbor with priority 100 becomes DR (assuming no other router has higher priority). The priority-0 router can never become DR or BDR — priority 0 disqualifies a router from the election entirely, regardless of its router ID. It will remain in DROTHER state, forming adjacencies only with the DR and BDR.
3.6 First-Hop Redundancy Protocols
Hosts send off-network traffic to their default gateway — but one gateway router is a single point of failure. First-hop redundancy protocols (FHRPs) let two or more routers share a virtual IP address that hosts use as their gateway; if the active router fails, a standby takes over the virtual IP within seconds, and hosts never change their configuration.
| Feature | HSRP | VRRP | GLBP |
|---|---|---|---|
| Standard | Cisco proprietary | Open standard (RFC 5798) | Cisco proprietary |
| Roles | Active / Standby | Master / Backup | AVG + up to 4 AVFs |
| Load balancing | No (standby is idle) | No (backup is idle) | Yes — across AVFs |
| Default timers | Hello 3 s, hold 10 s | Advertise 1 s, down ~3.6 s | Hello 3 s, hold 10 s |
| Preemption | Off by default | On by default | AVG preemption configurable |
| Multicast | 224.0.0.2 (v1) / 224.0.0.102 (v2) | 224.0.0.18 | 224.0.0.102 |
| Virtual MAC | 0000.0c07.acXX | 0000.5e00.01XX | 0007.b400.XXYY |
HSRP elects one Active router to own the virtual IP and MAC; the Standby takes over if Hellos stop. VRRP works the same way but is vendor-neutral. GLBP differs: the Active Virtual Gateway answers ARP requests with a different virtual MAC per forwarder, spreading client traffic across up to four routers while still providing failover.
A typical HSRP configuration on a Layer 3 switch:
SW1(config)# interface Vlan10
SW1(config-if)# ip address 192.168.10.2 255.255.255.0
SW1(config-if)# standby 10 ip 192.168.10.1
SW1(config-if)# standby 10 priority 110
SW1(config-if)# standby 10 preempt
The group number (10) must match on both routers, the virtual IP (192.168.10.1) is the hosts' gateway, and preempt lets the higher-priority router reclaim the Active role after recovering.
HSRP and VRRP provide redundancy with one router forwarding at a time; GLBP adds load balancing on top of redundancy. If the question mentions using all uplinks at once, the answer is GLBP.
A company has two routers from different vendors and needs gateway redundancy for a VLAN. Which FHRP must they choose, and why are the other two unsuitable?
Show solution
VRRP. It is the open standard (RFC 5798), so it works between Cisco and non-Cisco routers. HSRP and GLBP are Cisco-proprietary and require Cisco devices on both (all) routers, so they cannot be used in this mixed-vendor design.
3.7 Applying Subnetting to Network Design
Subnetting is not just an exam exercise — it drives real designs. Two rules of thumb cover most cases:
Point-to-point links get /30s. A serial or routed point-to-point link has exactly two endpoints, so a /30 (2 usable host addresses, 4 addresses total) is the perfect fit with zero waste. (A /31 is also valid per RFC 3021, but /30 remains the CCNA convention and the safe exam answer.)
Size VLANs for hosts plus growth. Count the hosts the VLAN needs today, add room for growth (20–30% is typical), then pick the smallest subnet that fits using 2^n − 2 ≥ required hosts.
Design subnets from 10.10.0.0/16 for a branch office: VLAN 10 needs 380 hosts, VLAN 20 needs 90 hosts, and there are 2 point-to-point WAN links. Step 1 — VLAN 10: 380 hosts. 2^8 − 2 = 254 (too small); 2^9 − 2 = 510 (fits). 9 host bits → prefix /23. Step 2 — VLAN 20: 90 hosts. 2^6 − 2 = 62 (too small); 2^7 − 2 = 126 (fits). 7 host bits → prefix /25. Step 3 — WAN links: one /30 each (2 usable addresses, no waste). Step 4 — Allocate without overlap: VLAN 10 = 10.10.0.0/23 (covers 10.10.0.0–10.10.1.255), VLAN 20 = 10.10.2.0/25, WAN1 = 10.10.2.128/30, WAN2 = 10.10.2.132/30. Final answer: /23 for VLAN 10, /25 for VLAN 20, two /30s for the WAN links.
Design questions test whether you waste address space. Giving a point-to-point link a /24, or a 12-host VLAN a /24, is always the wrong answer when a tighter mask fits. Show your work with 2^n − 2.
A new VLAN needs 60 hosts today with expected growth to 100 hosts within two years. What is the smallest suitable subnet mask, and how many usable addresses does it provide?
Show solution
Size for growth: 100 hosts needed. 2^6 − 2 = 62 (too small for 100); 2^7 − 2 = 126 (fits). 7 host bits → /25 mask (255.255.255.128), providing 126 usable addresses. Sizing only for today's 60 hosts (/26, 62 usable) would force a painful re-addressing within two years — always design for growth.

End-of-Chapter Test
ip route 172.16.0.0 255.255.0.0 192.0.2.1 B. ip route 172.16.0.0 255.255.0.0 192.0.2.1 120 C. ip route 172.16.0.0 255.255.0.0 192.0.2.1 90 D. ip route 0.0.0.0 0.0.0.0 192.0.2.1 120
ip route 0.0.0.0 255.255.255.255 203.0.113.1 B. ip route 0.0.0.0 0.0.0.0 203.0.113.1 C. ip default-route 203.0.113.1 D. ip route * 203.0.113.1