Memory hook: Specific route first; preference next; metric within the protocol.
Must remember
Routers select the longest matching prefix for a destination. For competing routes to the same prefix, route-source preference/administrative distance and the protocol's metric determine which route is installed/used. A lower metric in one protocol cannot be compared directly to another protocol's metric as though they were the same units.
Static routes are explicit; a default route (0.0.0.0/0 or ::/0) handles destinations lacking a more specific match. A floating static route has a less-preferred administrative distance so another route wins while available. Dynamic protocols exchange reachability: OSPF is link-state, BGP policy-driven path-vector between routing domains, and EIGRP an advanced distance-vector protocol.
NAT rewrites addresses; PAT/NAT overload also distinguishes flows by ports so many internal clients share an external address. Static NAT fixes a mapping; dynamic pools allocate mappings. Translation is not a substitute for firewall policy or end-to-end authorization. Return traffic must traverse a path with the needed translation/session state.
First-hop redundancy provides a virtual gateway shared by routers. It protects gateway availability, not every upstream link or application. Route convergence, asymmetric paths, health tracking and failover capacity affect actual resilience.
Subinterfaces can route tagged VLANs over a trunk (router-on-a-stick). Switch virtual interfaces on a multilayer switch provide another inter-VLAN routing design. Both require the right VLAN/trunk and routing configuration.
Worked choice: routes 10.0.0.0/8, 10.4.0.0/16 and 10.4.8.0/24 all match 10.4.8.9; /24 wins even if its metric is numerically larger than another protocol's broader route.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| Backup route only when primary disappears | A suitable floating static route with reachable next hop. |
| Many private clients share one public IPv4 | PAT/NAT overload. |
| Gateway device fails | First-hop redundancy plus healthy upstream paths. |
Traps
- Default routes do not beat a more specific route.
- NAT does not automatically permit unsolicited inbound access.
Active recall
1. Which route wins for 10.4.8.9 among /8, /16 and matching /24?
The /24 because it is the longest match.
2. What makes a static route float?
Its less-preferred administrative distance relative to the primary route.
3. NAT versus PAT?
PAT distinguishes translated flows with ports, commonly allowing many clients to share an address.
4. Does a virtual gateway protect the Internet circuit too?
Not necessarily; upstream path and health design must also provide resilience.
5. Why can asymmetric return traffic fail through a firewall?
The return path may lack the expected session or translation state.