Cisco 350-401: Unicast Routing and Route Control — Study Guide

By Laurynas Brazys · 15 August 2026 · #cisco #350-401 #certification #exam-prep #study-guide

Part of the Cisco CCNP Enterprise 350-401 ENCOR — Study Guide. Practice with verified answers in the Cisco exam hub, or take timed practice tests on ExamRoll.io.

Overview

Unicast routing and route control determine how IPv4 and IPv6 packets traverse an enterprise network reliably, efficiently, and predictably. Devices compute reachability in the Routing Information Base (RIB), then program the forwarding plane. Two key facts guide operations:

• Longest prefix match (LPM) always wins for both IPv4 and IPv6. Among candidate routes, the most specific prefix is selected first, regardless of metric or administrative distance (AD).
• The RIB can hold multiple routes to the same prefix and belongs to the control plane; the Forwarding Information Base (FIB) is built from the RIB and installs only the best forwarding entries with egress information in the data plane.

If two or more routes have identical prefix length, AD decides which protocol’s route is preferred (lower is better). Typical defaults: connected 0, static 1, eBGP 20, EIGRP internal 90, OSPF 110, iBGP 200, EIGRP external 170. Within a single protocol and same prefix length, the protocol’s metric and tie-breakers apply. Always remember: LPM first, then AD, then metric.

Route Selection and Foundational Routes

Static and default routes are deterministic tools that complement dynamic protocols:

• Static routes: Manually configured next hops or egress interfaces for specific prefixes. Use cases include small edge stubs, security control, and as a backup path.
  • Example: ip route 192.0.2.0 255.255.255.0 203.0.113.1
• Floating static routes: A static with elevated AD so it floats below a learned route and activates only on failure of the primary:
  • Example: ip route 192.0.2.0 255.255.255.0 203.0.113.2 200
• Default routes: Provide a catch-all when no more specific entry exists. In IPv4, ip route 0.0.0.0 0.0.0.0 ; in IPv6, ipv6 route ::/0 . Consider controlled propagation of defaults (for example, only at the edge) to avoid suboptimal egress.
• Summary routes: Reduce control-plane state, bound failure domains, and improve convergence. Summaries should point to Null0 to prevent loops if specifics disappear.
  • Example: ip route 10.10.0.0 255.255.0.0 Null0
  • Example: ipv6 route 2001:db8:100::/48 Null0

Trade-offs and failure modes:

• Overly broad summaries or defaults can black-hole traffic. Protect with Null0 and ensure contributing specifics exist.
• Misusing AD (for example, lowering AD for an external route) can hide better paths and complicate troubleshooting.
• Recursive next-hop resolution must terminate on a connected interface. A GRE tunnel that resolves its destination through itself triggers “recursive routing” and interface shutdown.

IGP Design and Operation: OSPFv2/OSPFv3 and EIGRP

OSPF (link-state):

• Areas and LSAs:
  • Area 0 is the backbone; ABRs connect areas; ASBRs inject external routes.
  • LSA types: 1 (Router), 2 (Network), 3 (Summary), 4 (ASBR Summary), 5 (External), 7 (NSSA External). OSPFv3 retains concepts for IPv6 with per-link instantiation and address semantics separated from topology.
• Neighbor states:
  • Down, Init, 2-Way (adjacency formed only with DR/BDR on broadcast), ExStart, Exchange, Loading, Full.
  • Common failure: neighbors stuck in EXSTART/EXCHANGE due to MTU mismatch; ensure MTUs align or use ip ospf mtu-ignore as a last resort.
• DR/BDR:
  • Elected on multi-access (broadcast/NBMA) segments to reduce LSA flooding. Priority drives election; preemption does not occur automatically (must clear adjacency to change).
• Optimization:
  • Area design to bound SPF scope; use stub/totally stubby/NSSA to reduce external LSAs.
  • Summarize at ABR/ASBR; throttle LSAs and SPF (timers throttle spf, timers lsa-group-pacing).
  • Use cost tuning, passive interfaces for security/noise reduction, and fast hellos only where link quality is stable.

OSPFv3 configuration is interface-centric:

• Example:
  • router ospfv3 10
  • address-family ipv6 unicast
  • exit-address-family
  • interface GigabitEthernet0/0
  • ospfv3 10 ipv6 area 0

EIGRP (advanced distance vector with DUAL):

• Operation and tables:
  • Neighbor table (adjacencies), topology table (all feasible routes), and RIB (best route winners).
  • DUAL computes loop-free paths using feasibility condition: a neighbor is a feasible successor (FS) if its reported distance < local feasible distance to the destination.
• Feasible successors:
  • Provide immediate backup paths with no recomputation; design to maintain multiple FS by tuning metrics, avoiding overly low bandwidth settings on backups, and applying summarization to bound queries.
• Convergence resilience:
  • EIGRP stub on spokes limits queries and prevents SIA (stuck-in-active). Summaries and query boundaries improve stability.
• Unequal-cost load balancing:
  • variance N permits traffic over paths with metric <= N × best. Ensure traffic engineering aligns with application behavior and hashing policies.
• Named mode:
  • Consolidates IPv4 and IPv6 under one process with hierarchical configuration and address families.
  • Example:
    • router eigrp EDGE
    • address-family ipv4 autonomous-system 100
    • af-interface GigabitEthernet0/0
      • bandwidth-percent 50
    • topology base
      • variance 2
    • exit-af-topology
    • network 10.10.0.0 0.0.255.255
    • exit-address-family

Design trade-offs:

• OSPF scales predictably with careful area hierarchies; EIGRP offers fast convergence and unequal-cost load sharing but demands attention to query scoping.
• Both benefit from summarization, but ensure summaries reflect real reachability to avoid black holes.

BGP Fundamentals and Route Policy

BGP provides policy-rich interdomain control:

• Neighbor formation:
  • Uses TCP port 179. States: Idle, Connect, Active, OpenSent, OpenConfirm, Established.
  • If an eBGP neighbor is “Active,” the local router is attempting to open the TCP session; verify reachability, ACLs, TTL, and update-source.
  • iBGP requires full mesh or route reflectors; eBGP typically uses directly connected neighbors unless ebgp-multihop is configured.
• Path attributes and bestpath:
  • Key attributes in decision order (simplified): highest weight (Cisco, local), highest local preference (intra-AS), locally originated, shortest AS_PATH, lowest origin type, lowest MED (when from same neighbor AS), eBGP over iBGP, lowest IGP cost to next-hop, oldest path, lowest BGP router ID, etc.
  • Next-hop handling: eBGP rewrites next-hop by default; iBGP preserves, so use next-hop-self on iBGP speakers toward internal neighbors.
• Route policy and filtering:
  • Use route-maps, prefix-lists, AS-path access lists, and communities to shape routing.
  • Set local preference for outbound transit preference; set MED to influence inbound from the same neighboring AS; use communities for coarse-grained tagging and provider signaling.

Short BGP and policy example:

• route-map SET-LP permit 10
  • match ip address prefix-list CRITICAL
  • set local-preference 200
• router bgp 65001
  • neighbor 198.51.100.2 remote-as 65002
  • address-family ipv4 unicast
    • neighbor 198.51.100.2 route-map SET-LP in
    • maximum-paths 2

Trade-offs and safeguards:

• Prefer consistent policy across edge routers to avoid routing oscillations.
• Consider BGP multipath for ECMP when attributes permit; ensure equal IGP cost to next-hop if required by platform.
• Avoid accidental transit by filtering iBGP-learned prefixes from being advertised to eBGP unless intended.

Manipulation, Resiliency, and Troubleshooting

Route redistribution:

• One-way redistribution avoids loops and is ideal when one domain is authoritative. Dual redistribution requires tags to prevent reintroduction.
• Configure default metrics for protocols that need them (for example, EIGRP external metric components).
• Use tagging at injection points and filters to block re-import:
  • route-map TAG-OSPF permit 10
    • set tag 100
  • router ospf 1
    • redistribute eigrp 100 subnets route-map TAG-OSPF
  • router eigrp EDGE
    • route-map BLOCK-TAG deny 10
      • match tag 100
    • redistribute ospf 1 route-map BLOCK-TAG

Policy-Based Routing (PBR):

• Overrides RIB decisions for matched traffic. Apply with care to avoid asymmetric flows and stateful firewall issues.
  • Example:
    • route-map PBR-VOIP permit 10
      • match ip address ACL-VOIP
      • set ip next-hop 203.0.113.10
    • interface GigabitEthernet0/0
      • ip policy route-map PBR-VOIP

First-hop redundancy (FHRP):

• HSRP (Cisco), VRRP (open standard), GLBP (Cisco, load-shares default-gateway usage).
  • VRRPv3 supports IPv4 and IPv6 and multivendor deployments.
  • GLBP uses an Active Virtual Gateway (AVG) and Active Virtual Forwarders (AVFs) to balance ARP replies across routers.
  • Preempt allows higher-priority routers to resume active/master role upon recovery; add interface/object tracking to prefer healthier devices.
• Example VRRPv3:
  • interface GigabitEthernet0/0
    • vrrp 10 ip 172.16.13.254
    • vrrp 10 priority 110
    • vrrp 10 preempt
• Common failure: mismatched virtual IPs between peers (for example, HSRP misconfiguration). Align virtual addresses to form the same group.

ECMP and resilient path selection:

• ECMP installs multiple equal-cost routes in the RIB/FIB. CEF performs per-flow hashing to avoid reordering; per-packet load sharing is generally discouraged.
• Avoid hash polarization by ensuring diverse hashing inputs (for example, include L4 ports) and by balancing bundle member characteristics.
• EIGRP enables unequal-cost multipath via variance; BGP and OSPF typically support equal-cost multipath with platform-specific controls.

Control-plane verification and troubleshooting:

• End-to-end: ping, traceroute (IPv4/IPv6), validate symmetric return paths when firewalls/NAT exist.
• RIB vs FIB: show ip route, show ipv6 route, show ip cef, show adjacency detail.
• OSPF: show ip ospf neighbor, show ip ospf database, show ip ospf interface; check area membership, network type, timers, MTU.
• EIGRP: show ip eigrp neighbors, show ip eigrp topology, show ip protocols; watch for SIA, missing stubs, and improper metrics.
• BGP: show ip bgp summary, show ip bgp neighbors, show ip bgp ; verify TCP 179 reachability and attribute manipulation.
• FHRP: show standby, show vrrp, show glbp; verify virtual MAC, priority, preempt, tracking.
• Tunnels: diagnose recursive routing with logs and show interfaces tunnel; correct next-hop resolution with a static route pointing to a physical underlay.

Practical Problem Scenario

Northwind Manufacturing operates a dual-datacenter campus with two WAN ISPs, OSPF internally, and mixed vendor access switches. Users report intermittent SaaS slowness and occasional default-gateway failover delays. The network team must harden path selection, share WAN utilization, and ensure fast, predictable gateway failover for both IPv4 and IPv6.

Approach:

1. Normalize route selection and defaults

• Action: Advertise a single default from each WAN edge into OSPF area 0 via OSPF default-information originate with proper metrics; suppress other external prefixes internally.
• Rationale: Keeps the IGP small, uses LPM + AD consistently, and ensures deterministic egress selection without propagating volatile Internet routes.

2. Enable ECMP across ISPs

• Action: In BGP toward both ISPs, accept default (and a small set of business-critical more specifics if available). Configure maximum-paths 2 and tune IGP costs so next-hops are equal. On OSPF ABRs, align interface costs.
• Rationale: ECMP allows balanced utilization and resilience; consistent IGP cost to BGP next-hops is required for multipath installation.

3. Apply route policy for business-critical apps

• Action: Implement a route-map to set higher local preference on inbound BGP for SaaS provider prefixes from ISP-A; optionally use PBR at the WAN edge only for specific VoIP subnets, pointing to ISP-B as a protected path.
• Rationale: Local preference influences egress within the AS for targeted prefixes without affecting all traffic; PBR is reserved for narrow, deterministic overrides to avoid widespread asymmetry.

4. Harden redistribution boundaries with tags

• Action: If mutual redistribution exists (for example, OSPF–EIGRP at remote plants), add route tagging on injection and filters to block re-import of tagged routes.
• Rationale: Prevents loops and route oscillations when routes circulate between domains; tags provide unambiguous policy enforcement.

5. Optimize OSPF areas and timers

• Action: Convert high-churn access areas to stub or NSSA as appropriate; summarize at ABRs; enable LSA and SPF throttling aligned with link stability.
• Rationale: Reduces LSA floods, bounds SPF recomputation, and improves convergence under link flaps, directly improving SaaS reachability consistency.

6. Deploy VRRPv3 at distribution for IPv4 and IPv6

• Action: On each VLAN SVI, configure VRRPv3 with preempt and interface tracking; match virtual IPs across peers and tune priorities so the router with the better WAN path for that VLAN is master.
• Rationale: Standards-based FHRP supports multivendor gear and dual-stack; preempt with tracking ensures the most capable router answers as default gateway, reducing failover time and suboptimal paths. For VLANs requiring gateway bandwidth sharing, consider GLBP where supported.

7. Validate control-plane and data-plane alignment

• Action: Use show ip route/cef and show ipv6 route/cef to confirm ECMP FIB entries; verify OSPF neighbors and LSAs; confirm BGP established state and multipath; test failover by withdrawing one ISP and checking VRRP role changes and traceroutes.
• Rationale: Ensures the RIB and FIB reflect intended design, neighbors are healthy, and operational behavior matches policy under steady-state and failure.

8. Mitigate hashing polarization

• Action: Enable per-flow CEF hashing with L4 ports where feasible and distribute link members across line cards; validate with sampling tools.
• Rationale: Better entropy across flows yields more even ECMP utilization and reduces hotspots that can mimic application slowness.

This plan establishes deterministic defaults, controlled policy injection, resilient multipath egress, and robust first-hop redundancy, while containing failure domains and simplifying troubleshooting.

← Campus Layer 2 Switching and Segmentation · All domains · IP Services →

Practice these questions → · Timed practice on ExamRoll.io →