3.1.2. Route Selection and Address Translation
When multiple routes exist to the same destination, routers select based on this hierarchy:
- Longest prefix match (most specific): /26 beats /24, regardless of anything else
- Administrative distance (AD): Lower = more trusted (used when prefixes are equal)
- Metric: Lower = better (used when AD is equal)
Administrative Distance Values:
| Source | AD | Trust Level |
|---|---|---|
| Connected | 0 | Directly attached—absolute trust |
| Static | 1 | Administrator configured—high trust |
| EIGRP | 90 | Cisco dynamic routing |
| OSPF | 110 | Standard dynamic routing |
| RIP | 120 | Legacy protocol—low trust |
⚠️ Exam Trap: Prefix length always wins. A /26 route is used over a /24 route even if the /24 has lower AD. The exam tests whether you understand this hierarchy—don't be fooled by attractive-looking AD values when prefix lengths differ.
Floating static route: A static route deliberately given a higher AD than the dynamic route it backs up (for example 200, above OSPF's 110). It stays out of the routing table while the dynamic route exists and "floats" in only if that route disappears.
Recursive lookup: If a route's next hop is not on a directly connected network, the router looks up the next-hop address itself in the routing table to find which interface to send out of.
Address Translation:
| Type | Function | Use Case |
|---|---|---|
| Static NAT | Permanently maps one private IP to one public IP (1:1) | Internet-facing server that needs a consistent public IP |
| Dynamic NAT | Assigns a public IP from a pool to each internal host while it is in use (1:1, temporary) | Outbound access for a group of hosts—but only as many at once as the pool has addresses |
| PAT | Maps many internal IPs to one external IP using ports | Home routers, office internet access |
PAT (Port Address Translation), also called NAT overload, is what most home and office routers use. Internal devices share one public IP, differentiated by source port numbers.
Troubleshooting published servers: If an internal server works from inside but not from the internet, the server is fine—check the edge: the static NAT/port forward, the perimeter firewall rule, and the ISP link.
