How to Configure a Static Route on Cisco (Step by Step)

Step 1 — Pin down the destination, mask, and path

Before you type anything, you need three facts: the destination network address, its subnet mask, and how this router reaches it (the neighbor's next-hop IP, or the local interface that faces it). A static route is just an instruction: "for packets destined to network X/mask, forward them this way."

The network/mask pair is what makes the route match the intended range and nothing else, so confirm the destination's size now. In the topology below, R1 has a directly connected /30 to R2 and its own LAN; the network it cannot reach yet is R2's LAN, 10.2.2.0/24. Check what R1 already knows so you can see exactly what is missing.

! Topology (R1's view)
!   R1 Gi0/1: 192.168.12.1/30  <-> R2 Gi0/1: 192.168.12.2/30
!   R1 Gi0/2 LAN: 10.1.1.0/24
!   R2 LAN      : 10.2.2.0/24   <-- destination we need to reach

R1# show ip route connected
!   C   10.1.1.0/24     is directly connected, GigabitEthernet0/2
!   C   192.168.12.0/30 is directly connected, GigabitEthernet0/1
!   (no route to 10.2.2.0/24 yet)

Step 2 — Choose next-hop IP or exit interface

The last argument of `ip route` is the forwarding target, and you have three forms. A next-hop IP tells the router where to hand the packet, but the router must then perform a recursive lookup—it looks up that next-hop in its own table to learn which interface reaches it. An exit interface tells the router which port to send out directly, with no recursion.

The medium matters. On a multi-access/broadcast segment (Ethernet), an exit-interface-only route makes the router treat every host in the remote network as directly attached out that port, so it ARPs for each remote destination and relies on proxy ARP—fragile and slow. Prefer a next-hop IP there. On a true point-to-point link (a serial line, for example) there is exactly one far end, so an exit interface alone is fine and skips the recursive lookup.

The most robust form is the fully-specified route: give both the exit interface and the next-hop IP. It removes the recursive lookup and removes the ARP-for-everything problem, which is why it is the safe default on Ethernet links.

! Form A - next-hop IP (recursive lookup; preferred on Ethernet/multi-access)
R1(config)# ip route 10.2.2.0 255.255.255.0 192.168.12.2

! Form B - exit interface only (fine on a true point-to-point link)
R1(config)# ip route 10.2.2.0 255.255.255.0 Serial0/0/0

! Form C - fully specified: exit interface + next-hop (safest on multi-access)
R1(config)# ip route 10.2.2.0 255.255.255.0 GigabitEthernet0/1 192.168.12.2

Step 3 — Configure the route (and the return path)

Enter global configuration mode and apply the route. Routing is bidirectional: R1 now knows how to reach 10.2.2.0/24, but R2 still has no route back to 10.1.1.0/24, so replies would be dropped at R2. Configure the reverse static on R2 or a ping will fail even though R1's side is perfect.

A default route—the gateway of last resort—is nothing special: it is a static route to 0.0.0.0 0.0.0.0, used when no more specific entry matches. It is the right tool for a stub router with a single path to everything else. Save the configuration when you are done.

R1# configure terminal
R1(config)# ip route 10.2.2.0 255.255.255.0 192.168.12.2
R1(config)# end

! Return path on R2 - without this, replies never come back
R2# configure terminal
R2(config)# ip route 10.1.1.0 255.255.255.0 192.168.12.1
R2(config)# end

! Default route (gateway of last resort) is just a static to 0.0.0.0/0
R1(config)# ip route 0.0.0.0 0.0.0.0 192.168.12.2

R1# copy running-config startup-config

Step 4 — Know the administrative distance (why a route wins)

When more than one source offers a route to the same prefix, IOS installs the one with the lowest administrative distance (AD). Connected routes are AD 0, and a static route carries a default AD of 1—whether you wrote it with a next-hop or an exit interface. Dynamic protocols sit higher: EIGRP internal 90, OSPF 110, RIP 120.

The practical consequence is that a default static route (AD 1) beats any dynamic protocol for the same prefix. That is exactly what you want when a static should be authoritative—and exactly what you must override when you want the static to serve only as a backup. Confirm the installed route's distance and metric with a per-prefix lookup.

R1# show ip route 10.2.2.0
Routing entry for 10.2.2.0/24
  Known via "static", distance 1, metric 0
  Routing Descriptor Blocks:
  * 192.168.12.2
      Route metric is 0, traffic share count is 1
!            ^ distance 1 = default AD for a static route

Step 5 — Add a floating static route as a backup

A floating static is an ordinary static route with a raised AD, appended as a trailing number on the command. Because its AD is higher, it stays out of the routing table while a preferred source is present and only "floats in" when that preferred route disappears.

The rule that makes this work: the floating static's AD must be higher than the AD of whatever you want to win normally. If your primary is another static (AD 1), a small raised value like 5 is enough—5 is greater than 1, so the backup installs only when the primary path drops. If your primary is a dynamic protocol, the AD must exceed that protocol's AD; a value below it (5, say) would beat OSPF's 110 or EIGRP's 90 and defeat the purpose. To back up a dynamic protocol, pick an AD above it—values in the 200s are common because they clear every dynamic protocol. Check your current AD values against Cisco's default administrative distance table if you are unsure.

! The trailing number IS the administrative distance:
!   ip route <net> <mask> <next-hop> <AD>

! Backup behind a PRIMARY STATIC (AD 1): a small raised AD like 5 works,
! because 5 > 1, so this floats in only if the primary path is gone.
R1(config)# ip route 10.2.2.0 255.255.255.0 192.168.12.2      ! primary, AD 1
R1(config)# ip route 10.2.2.0 255.255.255.0 192.168.13.3 5    ! floating backup

! Backup behind a DYNAMIC PROTOCOL: the AD must be HIGHER than that
! protocol's AD (EIGRP 90, OSPF 110, RIP 120), or the static wins instead.
R1(config)# ip route 10.2.2.0 255.255.255.0 192.168.13.3 250  ! floats behind OSPF/EIGRP

Step 6 — Verify the route installed and forwards

Start with `show ip route static`, which filters the table to your static entries only—look for the S code (and S* for a default candidate) plus the [AD/metric] bracket. Then use `show ip route` for the full picture, or a per-prefix lookup to confirm which path won and at what AD. A correctly configured floating backup should NOT appear while the primary is up; that absence is the proof it is floating.

For a next-hop route, `show ip cef` confirms the recursive lookup resolved to a real outgoing interface—if it shows the next-hop as unresolved, the route will not forward. Finish with an end-to-end test, sourcing the ping from the LAN so you exercise the return path too, not just the router's connected interface.

R1# show ip route static
!   S    10.2.2.0/24 [1/0] via 192.168.12.2
!   S*   0.0.0.0/0 [1/0] via 192.168.12.2

R1# show ip route 10.2.2.0     ! which path installed, plus AD/metric
R1# show ip cef 10.2.2.0       ! confirm recursive next-hop resolved to an interface

! Test end-to-end using the LAN as the source (exercises the return route)
R1# ping 10.2.2.1 source 10.1.1.1

Common problems (and the fix)

Wrong subnet mask. A mask that is too broad makes the route match traffic you never intended (255.255.0.0 matches all of 10.2.0.0/16, not just 10.2.2.0/24); too narrow and it misses hosts. Fix: remove the bad entry with `no ip route ...` and re-enter it with the mask that matches the destination network exactly.

Next-hop not reachable / recursive lookup fails. A next-hop-only static will not install if the router has no route to that next-hop, or if the only way to reach it is the very route you are defining. Fix: confirm the next-hop resolves with `show ip route <next-hop>`; if it is on a connected subnet it should. When recursion is the problem, fully-specify the route (exit interface + next-hop) or use an exit interface on a point-to-point link.

Route not installed because a better source wins on AD. If a dynamic protocol or a lower-AD static already owns the prefix, your higher-AD route is hidden—this is expected for a floating backup, but it also bites when an unintended AD is in play. Fix: run `show ip route <prefix>` to see the installed source and its distance, then raise or lower your static's AD to get the precedence you want.

Exit interface on a multi-access link. An exit-interface-only static on Ethernet makes the router ARP for every remote host, causing intermittent or failed forwarding. Fix: use a next-hop IP, or fully-specify the route with both the interface and the next-hop.

Missing return route. One-way reachability—your pings leave but nothing comes back—almost always means the far router has no route to your source network. Fix: configure the reverse static (or a matching default) on the other device so replies have a path home.

! Wrong mask: meant /24, but this matches all of 10.2.0.0/16
R1(config)# no ip route 10.2.2.0 255.255.0.0 192.168.12.2
R1(config)#    ip route 10.2.2.0 255.255.255.0 192.168.12.2

! Next-hop unreachable -> route won't install; verify it first
R1# show ip route 192.168.12.2       ! must resolve to a connected/known route
R1(config)# ip route 10.2.2.0 255.255.255.0 GigabitEthernet0/1 192.168.12.2  ! fully specify to avoid recursion

! See which source owns the prefix and at what AD
R1# show ip route 10.2.2.0