Skip to content
Log in Sign up My account

1.1 Administrative Distance

Blueprint 1.1: Troubleshoot administrative distance (all routing protocols)

  • Default AD values for every route source, including EIGRP summary, EIGRP external, eBGP, iBGP and BGP local routes
  • How the router chooses between sources: longest match first, then AD, then the protocol's own metric
  • Changing AD per protocol, per route type, per source and per prefix (distance commands, floating static routes)
  • Fault symptoms caused by AD: suboptimal paths, a backup route that never installs, a backup route that always installs, BGP RIB failures
  • Verification: show ip route <prefix>, show ip protocols, show ip bgp rib-failure

Where AD fits in route selection

A router can hear about the same destination from several routing sources at once. Each protocol picks its own best path using its own metric, then offers that path to the routing table (the RIB). The RIB only installs one source per prefix, and administrative distance is how it chooses. Lower is more trusted.

The order of decisions matters, and most AD troubleshooting questions test it:

  1. Longest prefix match. A /25 and a /24 are different routes. Both can be in the RIB at the same time, and forwarding uses the longest match. AD never compares routes with different prefix lengths.
  2. Administrative distance. For the same prefix and mask from different sources, the lowest AD is installed.
  3. Metric. Only inside one source. An OSPF cost of 2 is never compared with an EIGRP metric of 3072.
graph TB
  A["Same prefix offered by several sources"] --> B{"Same prefix length?"}
  B -->|"No"| C["Different routes. Both installed. Longest match forwards."]
  B -->|"Yes"| D{"Compare AD"}
  D --> E["Lowest AD installed in RIB"]
  E --> F["Inside that protocol, metric chose the path already"]
  D --> G["Losers stay in their own database as backups"]

The losing sources do not throw the route away. EIGRP keeps it in the topology table, OSPF keeps the LSA, BGP keeps the path and flags it as a RIB failure. If the winning source withdraws the route, the RIB asks the next best source to install its copy. That is the mechanism behind a floating static route.

Default administrative distances

Route source Default AD Notes
Connected interface 0 Includes the local /32 host route
Static route 1 Also 1 when pointed at an interface only
EIGRP summary 5 The local discard route to Null0 on the summarizing router
eBGP 20
EIGRP internal 90 Routes from network statements inside the AS
OSPF 110 Intra-area, inter-area and external all default to 110
IS-IS 115
RIP 120
EIGRP external 170 Routes redistributed into EIGRP
iBGP 200
BGP local 200 Locally originated aggregates, and network backdoor routes
Unknown / unusable 255 Never installed

Exam trap

OSPF uses one AD of 110 for intra-area, inter-area and external routes unless you change it. EIGRP and BGP are the protocols with different internal and external defaults. A question that assumes OSPF externals are less trusted than OSPF internals by AD is wrong: OSPF prefers internal routes through its own path-type rules (intra, inter, E1, E2), not through AD.

Exam trap

The BGP numbers look backwards to many candidates. eBGP is 20, which beats every IGP. iBGP is 200, which loses to every IGP. That is deliberate: a route learned from another AS by eBGP is trusted, but an iBGP route usually also exists in the IGP, and the IGP path should win.

Changing AD

Every protocol lets you change AD. The scope differs, and choosing the wrong scope is a common fault.

! Floating static: only installs when every dynamic source with AD below 250 is gone
ip route 0.0.0.0 0.0.0.0 198.51.100.1 250
ip route 10.50.0.0 255.255.255.0 10.1.3.2 130
ipv6 route 2001:db8:50::/64 2001:db8:1:3::2 130

router eigrp 100
 distance eigrp 90 175          ! internal external
 distance 95 10.1.2.2 0.0.0.0   ! routes from this neighbor

router eigrp CORP
 address-family ipv4 unicast autonomous-system 100
  topology base
   distance eigrp 90 175

router ospf 1
 distance ospf intra-area 110 inter-area 110 external 175
 ! Source form: the address is the ROUTER ID of the router that originated the LSA
 distance 120 10.255.255.4 0.0.0.0 PREFIXES-FROM-R4
!
ip access-list standard PREFIXES-FROM-R4
 permit 10.4.0.0 0.0.255.255

router bgp 65001
 address-family ipv4 unicast
  distance bgp 20 200 200       ! external internal local
  network 172.16.50.0 mask 255.255.255.0 backdoor

router rip
 version 2
 distance 125                   ! all RIP routes
 distance 130 10.1.5.5 0.0.0.0  ! routes from one neighbor

The source-based distance form

distance <ad> <source> <wildcard> [acl] sets the AD for routes learned from a matching source. If an ACL is added, only prefixes permitted by the ACL get the new AD. This is the precise tool for fixing one or two prefixes without changing a whole protocol.

What counts as the source depends on the protocol:

Protocol Source address in the distance command
RIP, EIGRP The neighbor's interface address (the update source)
OSPF The router ID of the router that originated the LSA, not the neighbor's interface address
BGP The peer address (distance <ad> <peer> <wildcard> [acl])

Exam trap

In OSPF the source in the distance command is matched against the originating router's ID, which is what show ip route prints after the word from. If an exhibit shows distance 115 10.1.12.2 0.0.0.0 under router ospf and the neighbor's router ID is 10.255.255.2, the command never matches and nothing changes. Look for the router ID in the from field of the routing descriptor block.

Verifying AD

show ip route <prefix> tells you which source won and with what AD:

R1# show ip route 10.4.10.0
Routing entry for 10.4.10.0/24
  Known via "eigrp 100", distance 90, metric 131072, type internal
  Redistributing via eigrp 100
  Last update from 10.1.2.2 on GigabitEthernet0/0, 00:12:31 ago
  Routing Descriptor Blocks:
  * 10.1.2.2, from 10.1.2.2, 00:12:31 ago, via GigabitEthernet0/0
      Route metric is 131072, traffic share count is 1
      Total delay is 5020 microseconds, minimum bandwidth is 1000000 Kbit
      Reliability 255/255, minimum MTU 1500 bytes
      Loading 1/255, Hops 2

The bracket in the summary table shows the same thing: D 10.4.10.0/24 [90/131072] means AD 90, metric 130816.

show ip protocols shows the distance settings currently in force, including source-based entries:

R1# show ip protocols | section ospf
Routing Protocol is "ospf 1"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Router ID 10.255.255.1
  Number of areas in this router is 1. 1 normal 0 stub 0 nssa
  Routing for Networks:
    10.1.3.0 0.0.0.3 area 0
  Routing Information Sources:
    Gateway         Distance      Last Update
    10.255.255.4         110      00:14:02
    10.255.255.3         110      00:14:02
  Distance: (default is 110)
    Address         Wild mask       Distance  List
    10.255.255.4    0.0.0.0              120  PREFIXES-FROM-R4

To see the losing sources, ask each protocol directly:

Protocol Where the losing copy still lives
EIGRP show ip eigrp topology <prefix>
OSPF show ip ospf database (LSA present, route not in RIB)
BGP show ip bgp with r (RIB-failure) status, and show ip bgp rib-failure
Static show running-config \| include ip route (static routes are not listed when they lose)

BGP RIB failure

When BGP's best path loses to a route with a lower AD, the path is marked r and is not installed:

R2# show ip bgp rib-failure
  Network            Next Hop                      RIB-failure   RIB-NH Matches
10.4.10.0/24       10.255.255.4        Higher admin distance              n/a

A RIB-failure route is still advertised to BGP peers by default. That surprises people who expect BGP to only advertise what it uses.

Common AD faults and how to spot them

Symptom Likely AD cause Proof
Backup static route always used, primary dynamic path ignored Static route configured without a floating AD (default 1) show ip route shows S with [1/0]
Backup static never takes over Floating AD set lower than nothing, or route points to a next hop that is unreachable when the primary fails show ip route after failure, show ip cef for the next hop
Traffic takes a long path through another domain Two-point redistribution: OSPF external (110) beats EIGRP external (170) or RIP (120) on a border router show ip route on the border router shows O E2 for a prefix native to the other domain
Route from one neighbor ignored although it is the only path distance 255 applied to that source show ip protocols distance list
iBGP route not in RIB, IGP route used instead iBGP 200 loses to any IGP. Usually correct behaviour. show ip bgp status r
eBGP-learned copy of an internal prefix overrides the IGP eBGP 20 beats IGP Fix with network ... backdoor or distance bgp

Exam trap

A floating static route with AD 120 is not a backup for a RIP route. RIP is also 120. With equal AD from two different sources, do not assume a predictable winner on the exam; the correct design answer is to make the backup AD clearly higher than every primary source it must lose to.

Backdoor routes

Two sites connected by both an internal fast link running EIGRP and by eBGP through a provider will see each other's prefixes as eBGP (20) and EIGRP (90). eBGP wins and traffic goes through the provider. network <prefix> mask <mask> backdoor under BGP changes the eBGP-learned copy of that prefix to AD 200, so the IGP wins. The router does not originate the prefix into BGP because of the backdoor keyword.

Lab: break and fix AD

Topology: four IOSv routers. R4 advertises 10.4.10.0/24 into both EIGRP and OSPF. The EIGRP path through R2 is the intended primary because it runs over the faster links. OSPF through R3 is the backup.

graph LR
  R1["R1"] -- "Gi0/0 10.1.2.0/30 EIGRP" --- R2["R2"]
  R1 -- "Gi0/1 10.1.3.0/30 OSPF area 0" --- R3["R3"]
  R2 -- "Gi0/1 10.2.4.0/30 EIGRP" --- R4["R4<br/>Lo10 10.4.10.1/24"]
  R3 -- "Gi0/1 10.3.4.0/30 OSPF area 0" --- R4

Addressing follows the course convention: the lower-numbered router takes .1 on each /30, and Loopback0 on router N is 10.255.255.N/32.

Step 1. Build the baseline.

! R1
interface GigabitEthernet0/0
 ip address 10.1.2.1 255.255.255.252
interface GigabitEthernet0/1
 ip address 10.1.3.1 255.255.255.252
router eigrp 100
 network 10.1.2.0 0.0.0.3
router ospf 1
 router-id 10.255.255.1
 network 10.1.3.0 0.0.0.3 area 0
!
! R2
interface GigabitEthernet0/0
 ip address 10.1.2.2 255.255.255.252
interface GigabitEthernet0/1
 ip address 10.2.4.1 255.255.255.252
router eigrp 100
 network 10.1.2.0 0.0.0.3
 network 10.2.4.0 0.0.0.3
!
! R3
interface GigabitEthernet0/0
 ip address 10.1.3.2 255.255.255.252
interface GigabitEthernet0/1
 ip address 10.3.4.1 255.255.255.252
router ospf 1
 router-id 10.255.255.3
 network 10.1.3.0 0.0.0.3 area 0
 network 10.3.4.0 0.0.0.3 area 0
!
! R4
interface Loopback10
 ip address 10.4.10.1 255.255.255.0
 ip ospf network point-to-point
interface GigabitEthernet0/0
 ip address 10.2.4.2 255.255.255.252
interface GigabitEthernet0/1
 ip address 10.3.4.2 255.255.255.252
router eigrp 100
 network 10.2.4.0 0.0.0.3
 network 10.4.10.0 0.0.0.255
router ospf 1
 router-id 10.255.255.4
 network 10.3.4.0 0.0.0.3 area 0
 network 10.4.10.0 0.0.0.255 area 0

Step 2. Verify and save. On R1, show ip route 10.4.10.0 must show Known via "eigrp 100", distance 90. Then copy running-config flash:baseline.cfg.

Step 3. Inject the faults (a partner applies these, or apply them and clear the screen):

! R1: an engineer adds a "backup" static route but forgets the AD
ip route 10.4.10.0 255.255.255.0 10.1.3.2
!
! R1: someone tried to prefer OSPF for a different prefix and scoped it too wide
router eigrp 100
 distance 255 10.1.2.2 0.0.0.0

Step 4. Ticket. "Traffic from R1 to 10.4.10.0/24 is going through R3. It must use R2 while R2 is up, and fail over to R3 automatically. Do not remove the static route; it is required by the change board as a last-resort backup."

Step 5. Diagnose.

R1# show ip route 10.4.10.0
Routing entry for 10.4.10.0/24
  Known via "static", distance 1, metric 0
  Routing Descriptor Blocks:
  * 10.1.3.2
      Route metric is 0, traffic share count is 1

The static route with AD 1 beats both dynamic sources. Fix it by making it float above OSPF:

R1(config)# no ip route 10.4.10.0 255.255.255.0 10.1.3.2
R1(config)# ip route 10.4.10.0 255.255.255.0 10.1.3.2 250

Now check again. The route is O with [110/3], still not EIGRP. Look at what EIGRP thinks:

R1# show ip eigrp topology 10.4.10.0/24
EIGRP-IPv4 Topology Entry for AS(100)/ID(10.1.3.1) for 10.4.10.0/24
  State is Passive, Query origin flag is 1, 1 Successor(s), FD is 131072
  Descriptor Blocks:
  10.1.2.2 (GigabitEthernet0/0), from 10.1.2.2, Send flag is 0x0
      Composite metric is (131072/130816), route is Internal

EIGRP has a successor but it is not in the RIB. show ip protocols | section eigrp reveals the distance list:

  Distance: internal 90 external 170
    Address         Wild mask       Distance  List
    10.1.2.2        0.0.0.0              255

AD 255 means "never install". Remove it:

R1(config)# router eigrp 100
R1(config-router)# no distance 255 10.1.2.2 0.0.0.0

Step 6. Verify the requirement end to end.

R1# show ip route 10.4.10.0 255.255.255.0
Routing entry for 10.4.10.0/24
  Known via "eigrp 100", distance 90, metric 131072, type internal
  ...
R1# configure terminal
R1(config)# interface GigabitEthernet0/0
R1(config-if)# shutdown
R1(config-if)# do show ip route 10.4.10.0
Routing entry for 10.4.10.0/24
  Known via "ospf 1", distance 110, metric 3, type intra area

With R2's link down, OSPF takes over. Shut the R3 link too and the floating static (AD 250) appears only if its next hop 10.1.3.2 is still resolvable; with Gi0/1 down it is not, which is a useful reminder that a floating static needs a next hop that survives the failure it protects against. Restore both interfaces when finished.

Step 7 (stretch). Use the source-based OSPF form to make only R4's prefixes less preferred than RIP-style backup routes: distance 125 10.255.255.4 0.0.0.0 R4-NETS under router ospf 1 with a standard ACL. Then try distance 125 10.3.4.2 0.0.0.0 and note that it changes nothing, because OSPF matches the originating router ID, not the neighbor interface address.

Quick check

R1 has 10.9.0.0/16 from OSPF and 10.9.1.0/24 from RIP. A packet arrives for 10.9.1.20. Which route forwards it?

The RIP /24. AD only decides between routes with the same prefix length. Both routes are installed, and longest match chooses the /24 even though RIP has the higher AD.

Why might distance 150 10.1.34.4 0.0.0.0 under router ospf 1 have no effect?

For OSPF the source address in the distance command is the router ID of the originating router. If 10.1.34.4 is the neighbor's interface address and its router ID is different, nothing matches.

A route shows r>i in show ip bgp. Is it being used for forwarding, and is it being advertised?

It is not installed in the RIB because another source with a lower AD holds the same prefix, so BGP is not used to forward it. It is still BGP's best path and, by default, is still advertised to peers.

References

  • IP Routing configuration guides for Cisco IOS XE: "What Is Administrative Distance" technote and the EIGRP, OSPF, BGP and RIP distance command references (search on cisco.com)
  • IP Routing: EIGRP, OSPF and BGP Configuration Guides, Cisco IOS XE 17 (search on cisco.com)
  • Cisco Live On-Demand Library: search "routing protocol redistribution" and "troubleshooting routing"
  • Related: Diagram N01, administrative distance, Sim 05