Routing Theory and Interior Gateway Protocols

Introduction

Routing is the process by which a network device selects a path for forwarding packets between different IP networks. Switching usually concerns forwarding within a local network, whereas routing concerns reachability between networks and the control mechanisms used to learn, compare, install, and withdraw routes. In enterprise, service-provider, cloud, and industrial environments, routing determines performance, resilience, security boundaries, and operational cost.

A router does not normally calculate an entire end-to-end path for every packet. Instead, it maintains a routing information base (RIB), selects the best route for each destination prefix, and installs selected entries in a forwarding information base (FIB). The FIB is consulted for individual packets. This separation allows a control plane to perform complex computation while the data plane forwards traffic efficiently.

This chapter examines route selection, static routing, interior gateway protocols (IGPs), OSPF, IS-IS, redistribution, filtering, summarization, policy-based routing (PBR), and virtual routing and forwarding (VRF). The emphasis is on reasoning about design choices rather than memorizing commands for one vendor.

Learning Objectives

By the end of this chapter, students should be able to:

• Explain how routers select, install, and forward routes.
• Distinguish administrative distance, protocol preference, and routing metrics.
• Design and evaluate static routes and default routes.
• Describe the operation and design implications of OSPF and IS-IS.
• Analyze convergence, failure recovery, and scalability.
• Explain route redistribution, filtering, and summarization.
• Apply policy-based routing and VRF concepts to realistic network designs.
• Identify operational, security, governance, and troubleshooting risks.

1. The Routing Decision Process

A route is generally represented as a destination prefix, prefix length, next hop, outgoing interface, source protocol, metric, and administrative distance. For example, a route to 192.0.2.0/24 may be reachable through next hop 198.51.100.2 on interface G0/1.

When several routes match a destination address, routers apply a hierarchy. First, they choose the most specific matching prefix, known as longest-prefix match. A /28 route is preferred over a /24 route for an address that falls within both prefixes. This rule is applied independently of how the routes were learned.

If multiple routes have the same most-specific prefix, the router compares their administrative distance (AD), or an equivalent protocol-preference value. AD expresses how trustworthy the source of a route is relative to other sources on the same device. It is not a measure of bandwidth, delay, or path quality. A connected route is normally preferred over a static route, and an internal OSPF route is normally preferred over an external route learned through another protocol, although exact default values are vendor-specific.

If routes have the same prefix and source preference, the router compares the routing protocol metric. The metric is meaningful only within the protocol or route-selection context that defines it. OSPF uses a cost derived from reference bandwidth and interface bandwidth; IS-IS commonly uses additive interface costs; RIP uses hop count. A lower metric is usually preferred, but the meaning must be verified for the relevant protocol.

Finally, if equal-cost paths remain, the device may install multiple routes and perform equal-cost multipath (ECMP) forwarding. ECMP commonly balances flows rather than individual packets, reducing packet reordering. Hardware and software limits determine how many paths can be installed.

A useful conceptual ordering is:

1. Most specific destination prefix.
2. Lowest administrative distance among competing sources.
3. Best metric within the selected source.
4. Equal-cost multipath, if supported and enabled.
5. Forwarding using the resulting FIB entry.

The exact implementation may include additional rules, such as route tags, internal-versus-external distinctions, or vendor-specific tie breakers.

Administrative Distance and Metrics

Administrative distance is locally significant. Changing it on one router does not change the protocol's metric or the preferences of neighboring routers. It should therefore be used carefully: manipulating AD can provide backup behavior, but excessive changes create hidden dependencies and troubleshooting difficulty.

A metric is an algorithm-specific value. OSPF cost, for example, is conceptually calculated as:

Bandwidth must be expressed in the same units, commonly megabits per second. The formula is applicable only where the implementation uses this reference-bandwidth model. Modern networks must explicitly set a reference bandwidth high enough to distinguish faster links; otherwise, many high-speed interfaces may receive the same cost. OSPF cost is not a direct measurement of current congestion.

2. Static and Default Routing

Static routing uses administrator-configured routes. A static route may specify an outgoing interface, a next-hop address, or both. It has no dynamic control-plane exchange and therefore low protocol overhead. Static routes are appropriate for stub networks, simple point-to-point links, carefully controlled default paths, and explicit backup routes.

A default route represents all destinations not covered by a more specific route. In IPv4 it is 0.0.0.0/0; in IPv6 it is ::/0. Because every IPv4 address matches /0, the default route is selected only when no more-specific route exists.

A floating static route is configured with a less-preferred administrative distance than the primary route. It remains inactive while the preferred route exists and becomes eligible after the preferred route disappears. This technique is useful, but it depends on reliable failure detection. If the physical interface remains up while the upstream path is broken, the static route may not withdraw. Object tracking, IP monitoring, or a dynamic protocol can improve detection.

Static routing advantages include predictability, low overhead, and strict control. Disadvantages include poor scalability, manual maintenance, and slow or error-prone recovery after topology changes. A static route should not be confused with a secure route: an incorrect static entry can cause a black hole or traffic interception.

3. Interior Gateway Protocols and Convergence

An interior gateway protocol operates within an autonomous system (AS), a network administered under a common routing policy. IGPs are designed to distribute internal reachability and respond to topology changes.

Convergence is the process by which routers detect a change, calculate new paths, and install consistent forwarding information. It includes failure detection, information propagation, route computation, and FIB programming. Fast convergence is desirable, but aggressive timers can cause false failures and control-plane load. Convergence should therefore be evaluated with respect to link technology, device capacity, topology, and application requirements.

Distance-vector protocols exchange reachability information and rely on neighbor-derived distance calculations. Link-state protocols distribute a representation of network topology and independently calculate shortest paths. Path-vector protocols, such as BGP, maintain path attributes and are primarily used between autonomous systems. OSPF and IS-IS are link-state IGPs.

The shortest-path-first calculation used by link-state protocols is commonly associated with Dijkstra's algorithm. Given a graph whose edges have non-negative costs, the algorithm identifies the least-cost path from a source to reachable destinations. The total path cost is additive:

where c_i is the cost of link i and the sum includes every link in the candidate path. The result is valid when the protocol defines path cost as an additive, non-negative metric. It does not necessarily identify the path with the lowest latency, highest available bandwidth, or lowest financial cost.

4. OSPF

Open Shortest Path First (OSPF) is a link-state IGP standardized for IP networks. Routers form adjacencies, exchange link-state advertisements (LSAs), construct a link-state database (LSDB), and run a shortest-path calculation. Each router then derives routes from its own perspective.

OSPF commonly uses areas to limit the scope of topology information and calculations. Area 0 is the backbone area, and other areas should connect to it directly or through carefully designed mechanisms. Area Border Routers (ABRs) connect areas and can summarize routes. An Autonomous System Boundary Router (ASBR) injects routes from another routing source.

Important OSPF concepts include:

• Hello packets: discover and maintain neighbors.
• Router ID: uniquely identifies an OSPF router within the routing domain.
• Neighbor adjacency: the relationship required for database exchange.
• LSDB: a synchronized topology representation within an area.
• LSA: a description of links, networks, and external reachability.
• Cost: the OSPF path-selection metric.
• DR and BDR: designated and backup designated routers on multiaccess networks, reducing adjacency and flooding overhead.

OSPF route categories commonly include intra-area routes, inter-area routes, and external routes. External routes may be classified as E1 or E2. An E1 route adds internal OSPF cost to the external metric, whereas an E2 route generally compares the external metric first and uses internal cost as a tie-breaker. Engineers must confirm implementation details before relying on a particular tie-break rule.

OSPF areas can improve scalability, but they also add design constraints. Poorly designed areas, excessive summarization, unstable links, or incorrect network types can produce suboptimal routing and difficult troubleshooting. Authentication, passive interfaces, strict area planning, and explicit reference bandwidth are best practices.

5. IS-IS

Intermediate System to Intermediate System (IS-IS) is a link-state IGP originally developed for OSI networking and widely used for IP routing. It operates directly over the data-link layer rather than depending on IP for neighbor communication. IS-IS carries IP reachability through extensions and is therefore considered a highly capable IP IGP.

IS-IS uses a two-level hierarchy. Level 1 routers know routes within an area; Level 2 routers provide inter-area connectivity; a router may perform both roles. This resembles OSPF's hierarchical design but uses different terminology and operational mechanisms. IS-IS packets are called PDUs, and topology information is carried in link-state PDUs (LSPs). TLVs make the protocol extensible and have supported features such as IPv6 and traffic-engineering extensions.

OSPF and IS-IS both provide rapid, loop-free link-state routing, but they differ in packet operation, hierarchy, configuration model, and operational culture. IS-IS is common in large service-provider networks because of its extensibility and separation from IP addressing during neighbor formation. OSPF is widespread in enterprise networks and is often familiar to administrators. Neither is universally superior; the decision should reflect operational expertise, interoperability, topology, scale, and tooling.

6. Redistribution and Route Control

Redistribution imports routes learned from one source into another protocol. For example, an organization may redistribute connected or static routes into OSPF, or exchange routes between OSPF and IS-IS during migration.

Redistribution is a major source of routing loops. A route may leave protocol A, enter protocol B, and later be reintroduced into A. Because each protocol has different metrics and topology knowledge, the route may circulate or be preferred incorrectly. Safe redistribution requires a defined boundary, limited direction, explicit filtering, route tags, and a documented metric policy.

A practical redistribution design should answer:

• Which prefixes must cross the boundary?
• In which direction may they travel?
• What metric should be assigned?
• How will re-entry be prevented?
• What happens if the source route disappears?
• How will ownership and troubleshooting responsibility be defined?

Route filtering controls which routes are accepted, installed, advertised, or redistributed. Prefix lists express prefix and prefix-length conditions. Route maps, policy statements, or routing policies can combine matching conditions with actions such as permit, deny, metric modification, tagging, or next-hop modification. Filtering should be least-privilege: advertise only what is required.

Route summarization combines contiguous prefixes into a larger aggregate. For example, four /24 networks that occupy a complete /22 range may be represented by one /22 route, provided the address boundaries are correctly aligned. Summarization reduces routing-table size, limits update propagation, and hides internal topology changes. Its principal danger is blackholing: if the summary remains advertised while all component routes are unavailable, traffic may be sent toward a destination that no longer exists. A discard or null route, combined with accurate summary ownership, can prevent loops but must be monitored.

7. Policy-Based Routing

Destination-based routing selects a path primarily from the destination prefix. Policy-based routing allows additional conditions, such as source address, protocol, application classification, or ingress interface, to influence forwarding. A PBR policy may direct selected traffic to a particular next hop while ordinary traffic uses the routing table.

PBR is useful for service chaining, controlled Internet exits, asymmetric service requirements, and temporary migration. It can also create asymmetry, bypass security controls, defeat expected failover, and complicate troubleshooting. Policies should include explicit fallback behavior, tracking where available, and logging or telemetry. PBR should not replace sound addressing and routing architecture.

8. Virtual Routing and Forwarding

VRF creates separate logical routing and forwarding instances on the same physical device. Each VRF has its own routing table, interfaces, policies, and often a separate default route. This permits overlapping address spaces and traffic isolation for departments, tenants, customers, or services.

A standard VRF provides separation but not automatic communication between VRFs. Inter-VRF connectivity must be deliberately implemented through a firewall, route leaking, a shared-services design, or a virtualized service. In provider networks, Multiprotocol Label Switching (MPLS) VPNs commonly use VPN-specific route information and labels to maintain tenant separation across a shared backbone.

VRF is a control and forwarding-plane isolation mechanism, not a complete security architecture. Misconfigured route leaking, management-plane exposure, or shared services can undermine isolation. Each VRF should have documented ownership, permitted leaks, monitoring, and failure procedures.

9. Worked Route-Selection Example

Assume a router receives these routes for destination 10.20.30.40:

The destination 10.20.30.40 lies within all four prefixes. Route D is selected because /28 is more specific than /24 and /16. Administrative distance is not compared between routes with different prefix lengths. If route D disappears, routes B and C both match /24; the static route B is selected because its AD is lower. If B also disappears, route C is selected. This example demonstrates why longest-prefix match must be considered before administrative distance.

10. Applied Case: University Multi-Service Network

Background

This illustrative case concerns a university with a main campus, two remote campuses, research laboratories, guest Wi-Fi, voice services, and an Internet connection. The main campus uses OSPF, while a research partner uses IS-IS. Some older laboratories contain static routes. Guest and administrative users have overlapping private address ranges because they were acquired through separate projects.

Problem

The university experiences intermittent reachability after a WAN failure. Guest traffic occasionally follows an administrative path, and route tables contain duplicate external routes. During maintenance, a redistributed laboratory route is reintroduced into OSPF and causes a suboptimal path.

Analysis

The network has three interacting problems: unclear route ownership, uncontrolled redistribution, and insufficient separation of forwarding tables. The WAN failure is detected physically at one router but not at a neighboring layer-2 device, so a static route remains active. The guest and administrative address overlap cannot be resolved by ordinary destination-based routing in one global table.

Approach and Solution

The university establishes OSPF as the enterprise IGP and confines IS-IS redistribution to two controlled boundary routers. Only approved research prefixes are imported, and route tags identify their origin. Reverse redistribution is denied unless a documented exception exists. Laboratory static routes are replaced where practical with OSPF, and remaining static routes use tracked next hops.

Guest and administrative traffic are placed in separate VRFs. Shared services are reached through a firewall, and only DNS, authentication, and approved management flows are permitted between VRFs. OSPF summarization is applied at campus boundaries after validating prefix alignment and failure behavior. PBR is limited to guest Internet exit selection and includes a tracked fallback.

Outcome

The design reduces unnecessary route propagation, prevents accidental route re-entry, and makes guest-to-administration traffic subject to explicit security policy. Failure testing confirms that tracked static routes withdraw when the upstream service becomes unreachable. Monitoring records adjacency state, route changes, summary presence, redistribution counts, and PBR hit rates.

Learning Points

A routing problem is often a design-governance problem rather than a protocol problem. Clear ownership, bounded redistribution, accurate failure detection, and separation of routing tables are more reliable than adding increasingly complex route preferences.

11. Operations, Security, and Governance

Routing changes can affect availability, confidentiality, and regulatory boundaries. Engineers should use change control, peer review, configuration versioning, pre-change validation, and rollback plans. Routing updates may expose sensitive infrastructure information, so management access and routing-protocol authentication should be protected.

Operational monitoring should include neighbor and adjacency state, LSDB or LSP health, route counts, prefix changes, convergence time, CPU and memory utilization, and forwarding drops. Automated tools and AI-assisted anomaly detection can identify unusual route advertisements or topology changes, but automation must be constrained by authorization, validation, audit logs, and human review. An incorrect automated route policy can propagate an outage faster than a manual change.

Common troubleshooting steps are:

1. Verify the destination address and VRF.
2. Check the longest matching route in the relevant RIB and FIB.
3. Identify the route source, AD, metric, next hop, and outgoing interface.
4. Inspect neighbor or adjacency state.
5. Check filtering, redistribution, summarization, and policy rules.
6. Test return-path routing and security devices.
7. Compare control-plane information with actual forwarding behavior.

Challenges and Limitations

No routing protocol optimizes every desirable property simultaneously. A low metric may represent neither low latency nor high capacity. Fast timers may increase false positives. Summarization improves stability but can hide useful detail. Redistribution provides interoperability but introduces policy and loop risks. PBR solves selected forwarding requirements but can undermine simplicity. VRF improves isolation but increases operational complexity.

Routing design must therefore balance convergence, scalability, resilience, simplicity, observability, security, and organizational capability. The best design is not necessarily the one with the most features; it is the one whose behavior is predictable under normal operation and failure.

Chapter Summary

Routing selects paths to destination prefixes and installs forwarding information for packet delivery. Longest-prefix match is considered before administrative distance, and protocol metrics are compared only within the relevant selection context. Static routes provide control and simplicity but scale poorly; dynamic IGPs provide automatic adaptation and convergence.

OSPF and IS-IS are link-state IGPs that distribute topology information and calculate least-cost paths. OSPF uses areas and LSAs, while IS-IS uses Level 1/Level 2 hierarchy and LSPs. Redistribution, filtering, and summarization are powerful but must be governed to avoid loops, leaks, and black holes. PBR applies forwarding policy beyond destination lookup, while VRF separates routing and forwarding instances for isolation and overlapping address spaces. Effective routing practice combines protocol knowledge with careful architecture, monitoring, security, and change governance.

Key Terms

Administrative distance: Local preference assigned to the source of a route.

Autonomous system: A network under a common administrative and routing policy.

Convergence: The process of reaching a consistent routing state after a change.

ECMP: Forwarding across multiple equal-cost paths.

FIB: Forwarding information base used by the data plane.

IGP: Routing protocol used within an autonomous system.

IS-IS: Link-state IGP using Level 1 and Level 2 hierarchy.

L longest-prefix match: Selection of the matching route with the greatest prefix length.

LSDB: Link-state database describing topology within a routing scope.

Metric: Protocol-defined value used to compare paths.

OSPF: Open Shortest Path First link-state IGP.

PBR: Policy-based routing using conditions beyond destination lookup.

Prefix: Network address and its length defining a set of addresses.

Redistribution: Importing routes from one routing source into another.

RIB: Routing information base containing control-plane routes.

Route summarization: Representing multiple prefixes with an aggregate prefix.

Static route: Manually configured route.

VRF: Virtual routing and forwarding instance with a separate routing table.

Review Questions

Short Answer Questions

1. What is longest-prefix match, and why is it evaluated before administrative distance?
2. Distinguish a routing information base from a forwarding information base.
3. What is the purpose of an OSPF area?
4. Why can route redistribution create routing loops?
5. What problem does VRF solve?

Long Answer Questions

1. Explain the complete route-selection hierarchy, including prefix length, administrative distance, metric, and ECMP.
2. Compare OSPF and IS-IS in terms of hierarchy, operation, scalability, and operational considerations.
3. Evaluate the advantages and risks of static routing in a multi-site organization.
4. Explain how filtering and summarization improve routing stability and identify their failure modes.
5. Describe a governance framework for safely implementing redistribution and PBR.

Analytical / Application Questions

1. A router has a /16 OSPF route, a /24 static route, and a /28 connected route that all match a destination. Determine which route is selected and justify the decision.
2. Design a redistribution policy for a network migrating from IS-IS to OSPF. Specify direction, permitted prefixes, metrics, tags, and loop-prevention controls.
3. A company has overlapping private addresses for two tenants and requires shared DNS but no general tenant communication. Propose a VRF and security design, including how shared services should be reached.

Multiple Choice Questions with Answers

Question 1

Which route-selection rule is applied before administrative distance?

A. Lowest metric

B. Longest-prefix match

C. Highest bandwidth

D. Oldest route

Correct Answer: B. Longest-prefix match

Question 2

What is the primary purpose of a FIB?

A. Store historical topology changes

B. Authenticate routing neighbors

C. Support data-plane packet forwarding

D. Calculate administrative distance

Correct Answer: C. Support data-plane packet forwarding

Question 3

Which protocol is a link-state IGP?

A. OSPF

B. FTP

C. DHCP

D. ARP

Correct Answer: A. OSPF

Question 4

In OSPF, what does an ABR connect?

A. Different autonomous systems only

B. Different OSPF areas

C. Only wireless networks

D. VRFs on one interface

Correct Answer: B. Different OSPF areas

Question 5

What is a major risk of uncontrolled route redistribution?

A. Elimination of all metrics

B. Routing loops and unintended route re-entry

C. Automatic encryption failure

D. Removal of Ethernet frames

Correct Answer: B. Routing loops and unintended route re-entry

Question 6

What is the main benefit of route summarization?

A. It increases the number of detailed updates

B. It reduces routing-table and update-propagation complexity

C. It guarantees the lowest-latency path

D. It replaces all security controls

Correct Answer: B. It reduces routing-table and update-propagation complexity

Question 7

Which technology allows different logical routing tables on one device?

A. VRF

B. ECMP

C. ARP

D. NAT only

Correct Answer: A. VRF

Question 8

What distinguishes PBR from ordinary destination-based routing?

A. PBR can use conditions such as source or ingress interface

B. PBR never uses a next hop

C. PBR operates only between autonomous systems

D. PBR disables the forwarding plane

Correct Answer: A. PBR can use conditions such as source or ingress interface

Question 9

A destination matches both 192.0.2.0/24 and 192.0.2.128/25. Which prefix is more specific?

A. 192.0.2.0/24

B. 192.0.2.128/25

C. Both are equally specific

D. Neither can be selected

Correct Answer: B. 192.0.2.128/25

Question 10

In a link-state protocol with additive costs, a path using links of costs 10, 20, and 5 has what total cost?

A. 15

B. 20

C. 25

D. 35

Correct Answer: C. 25