How to Configure a Default Route on Cisco (Gateway of Last Resort)
A default route (0.0.0.0/0) is where a router sends any packet it has no specific route for — the gateway of last resort. It's how a stub site or edge router reaches the rest of the world through its ISP.
Part of the Static & Default Routing learning hub
Step 1 — Add a static default route
Point 0.0.0.0/0 at your upstream next-hop (usually the ISP). You can specify a next-hop IP (below), an exit interface, or both. On a multi-access/broadcast (Ethernet) link, prefer a next-hop IP over an interface-only route — an interface-only default makes the router treat every destination as directly connected and lean on proxy ARP, whereas naming the next-hop avoids that. (A next-hop-only route still performs a recursive lookup to resolve the next-hop; a fully-specified 'exit-interface next-hop' route is the most robust, skipping both recursion and proxy ARP.)
R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1Step 2 — Confirm the gateway of last resort
In the routing table the default shows as S* (static, candidate default), and the header names the gateway of last resort. If you don't see that line, the next-hop isn't reachable.
R1# show ip route
...
Gateway of last resort is 203.0.113.1 to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via 203.0.113.1Step 3 (optional) — Share it with the rest of the network
If other routers run OSPF and also need a way out, originate the default into OSPF from the edge router. Every OSPF router then learns a default pointing back at the edge.
R1(config)# router ospf 1
R1(config-router)# default-information originateStep 4 (optional) — A floating static backup
For a backup path, add a second default with a higher administrative distance (200 here). It stays out of the table until the primary next-hop fails, then floats in.
R1(config)# ip route 0.0.0.0 0.0.0.0 198.51.100.1 200Worked example: dual-homed stub with a tracked primary and a floating backup
Consider edge router R1 at a stub site with two ISP uplinks. Gi0/0 faces ISP-A on 203.0.113.0/30 (R1 is .2, ISP-A is .1) and is the primary path; Gi0/1 faces ISP-B on 198.51.100.0/30 (R1 is .2, ISP-B is .1) and is the backup. The inside LAN is 10.10.0.0/24. A naive setup is one default via ISP-A and a floating default via ISP-B at AD 210 — but that alone only protects against a dead local link.
The gap is a 'gray failure': ISP-A's handoff link stays up while their upstream is broken. The Gi0/0 line protocol remains up/up, so the primary default is never withdrawn and R1 keeps forwarding into a black hole while the AD-210 backup sits idle. The fix is an IP SLA ICMP echo to a target whose loss genuinely means the primary is unusable — the ISP's next hop or a stable public anchor — bound to a track object that the primary static references. When the probe fails, the track goes down, the primary is pulled, and the floating backup installs.
Verify the behavior before trusting it: 'show track 1' should read Reachability Up while healthy, 'show ip sla statistics' should show successful probes, and 'show ip route' should list the ISP-A default with the ISP-B route absent. Shut ISP-A's upstream (or the probe target) and confirm the table swaps to 198.51.100.1 within a few probe intervals, then restores when the primary recovers.
R1(config)# ip sla 1
R1(config-ip-sla)# icmp-echo 203.0.113.1 source-interface GigabitEthernet0/0
R1(config-ip-sla-echo)# frequency 5
R1(config)# ip sla schedule 1 life forever start-time now
R1(config)# track 1 ip sla 1 reachability
R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1 track 1
R1(config)# ip route 0.0.0.0 0.0.0.0 198.51.100.1 210
R1# show ip route static
S* 0.0.0.0/0 [1/0] via 203.0.113.1
R1# show track 1
Track 1
IP SLA 1 reachability
Reachability is Up
1 change, last change 00:04:12Why the next-hop choice matters: recursion, proxy ARP, and CEF
When you write a next-hop-only default like 'ip route 0.0.0.0 0.0.0.0 203.0.113.1', the router knows an IP but not an outgoing interface or a Layer 2 rewrite, so it can't forward directly. It performs a recursive lookup: resolve 203.0.113.1 against a connected route, learn the exit interface, then ARP for that next hop. CEF pre-computes this chain into the FIB and adjacency table so the recursion is resolved once at programming time, not per packet.
An interface-only default such as 'ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0' instead tells the router that the entire internet is directly connected out that port. On a multi-access Ethernet segment the router then ARPs for every distant destination and depends on the upstream device answering with proxy ARP — chatty, slow to converge, and completely broken if proxy ARP is disabled on the ISP side. On a genuine point-to-point link (a serial circuit or a /31) there is exactly one possible receiver, so an interface-only default is safe there.
The fully-specified form, 'ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 203.0.113.1', supplies both the exit interface and the next-hop, so CEF builds the adjacency with no recursion and no proxy-ARP dependence — the most deterministic option and the one to prefer on Ethernet. Confirm what the router actually programmed rather than what you typed with 'show ip route 0.0.0.0' for the control-plane view and 'show ip cef 0.0.0.0/0 detail' for the forwarding-plane result.
R1# show ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
Known via "static", distance 1, metric 0, candidate default path
Routing Descriptor Blocks:
* 203.0.113.1
Route metric is 0, traffic share count is 1
R1# show ip cef 0.0.0.0/0
0.0.0.0/0
nexthop 203.0.113.1 GigabitEthernet0/0Frequently asked questions
What's the difference between a default route and the gateway of last resort?
The default route is the 0.0.0.0/0 entry you install in the routing table, while the gateway of last resort is the specific next-hop the router has actually selected to forward all unmatched traffic. A router can hold several candidate default routes but promotes only one gateway of last resort at a time, chosen by administrative distance and then metric. If the table says 'gateway of last resort is not set,' the router drops unmatched packets even when a 0.0.0.0/0 line looks present but its next-hop never resolved.
Why isn't my default route showing up in the routing table?
A next-hop-only default is only installed if that next-hop IP is resolvable through another route, and an interface-based default requires the exit interface to be up/up. Because a next-hop-only static does a recursive lookup, an unreachable or wrong-subnet next-hop keeps the whole route out of the table. Verify with 'show ip route 203.0.113.1' to confirm the next-hop resolves and check that the connecting interface's line protocol is actually up.
How is 'ip route 0.0.0.0 0.0.0.0' different from 'ip default-gateway' and 'ip default-network'?
'ip route 0.0.0.0 0.0.0.0' is a true routed static default used when IP routing is enabled, which is the normal case on a router. 'ip default-gateway' only takes effect when IP routing is disabled, such as on a Layer 2 switch's management plane or a router in boot/setup mode, and tells that box where to send its own traffic. 'ip default-network' is a legacy classful/EIGRP method that flags a known major network as the candidate default, and on modern IOS a quad-zero static is preferred.
Do I need the 'always' keyword on 'default-information originate' in OSPF?
By default 'default-information originate' advertises a default into OSPF only if the originating router already has a default route in its own routing table. Adding 'always' makes OSPF advertise 0.0.0.0/0 unconditionally, which is useful for stability but can black-hole traffic if the edge later loses its real upstream and keeps advertising anyway. EIGRP handles this differently, typically by redistributing a static default or using 'ip default-network' rather than an originate command.
When does a floating static backup fail to kick in, and how does IP SLA tracking help?
A floating static with a higher administrative distance only withdraws the primary when that primary's next-hop becomes unresolvable or its exit interface goes down. If the primary link stays up through an intermediate switch but the path beyond it is broken, the interface still shows up/up, the primary default stays installed, and the backup never floats in. Binding the primary static to an IP SLA probe through a track object solves this by watching end-to-end reachability and withdrawing the route when the probe fails.
Practice this on graded Cisco labs
Reading is step one — build Static & Default Routing on real Cisco IOS and grade your own config, or try a free sample lab first.