AD, route maps, prefix lists & redistribution

What you will learn in this module. By the end of these 13 chapters you will be able to explain, configure, verify and troubleshoot everything in the first block of the CCNP ENARSI 300-410 v1.1 blueprint: administrative distance (1.1), route maps for any routing protocol (1.2), loop prevention with filtering, tagging, split horizon and route poisoning (1.3), and redistribution between any routing protocols or routing sources (1.4). Along the way you will master prefix lists, ACL-based route matching and distribute-lists, because every one of those blueprint items depends on them.

Prerequisites

• You can configure basic EIGRP and single-area OSPF and read show ip route (ENCOR routing modules).
• You know what an ACL, a wildcard mask and a subnet mask are (CCNA).
• You have seen the structured troubleshooting method from the ENARSI start module: define the problem, gather facts, test one hypothesis at a time.

We will not re-teach how EIGRP or OSPF form neighbours. Deep EIGRP, OSPF and BGP troubleshooting come in the next ENARSI modules; here we focus on what happens between routing sources.

An analogy: two countries and a border post

Imagine two countries that speak different languages and use different currencies. A company has offices in both, so goods must cross the border every day. At the border post an officer does four jobs:

1. Decides whom to believe. If two messengers bring different news about the same town, the officer trusts the more reliable source. In a router that ranking is administrative distance (AD).
2. Converts currency. A price in rupees means nothing across the border until it is converted. Routing metrics are the same: an OSPF cost of 3 means nothing to EIGRP, so the router assigns a seed metric when it redistributes.
3. Applies customs rules. Some goods may cross, others may not. Prefix lists, route maps and distribute-lists are the customs rulebook.
4. Stamps passports. A stamp says "this traveller came from country A". If the same traveller tries to re-enter country A through a second border post pretending to be foreign, the stamp gives him away. That stamp is a route tag, and it is the main tool against redistribution loops.

Keep this picture in mind. Every chapter in this module is one of these four jobs, done carefully.

Why it matters in real networks

Pure single-protocol networks are rare. Companies merge (one side runs EIGRP, the other OSPF), branches connect over BGP to a provider, static routes point at firewalls, and data centers inject routes into the campus. Wherever two routing sources meet, a router must redistribute: copy routes learned from one source into another protocol. Done carelessly, redistribution causes three classic failures: routes that silently never appear, traffic that takes a long detour (suboptimal routing), and routing loops or flapping routes. ENARSI loves these problems because they test whether you understand the rules, not just the commands.

The lab you will build and break

Both labs in this module use the topology above. E1 is the Delhi core (EIGRP 100, router ID 5.5.5.5). It has the Delhi users on 172.16.10.0/24 and a partner network 192.168.50.0/24 on Loopback1 that it injects with redistribute connected, so the rest of EIGRP sees it as an external route. O1 is the Bengaluru core (OSPF area 0, router ID 9.9.9.9) with the Bengaluru users on 10.200.10.0/24 and loopbacks 10.200.1.0/24 and 10.200.2.0/24. BR1 and BR2 are the two boundary routers. Because there are two of them, the lab contains every classic multi-point redistribution problem.

• Lab 1, Mutual redistribution with route tags: redistribute in both directions on both boundary routers, then use tags so nothing that left a domain comes back into it.
• Lab 2, Troubleshoot suboptimal routing and missing prefixes: BR1 sends Delhi-bound traffic through Bengaluru, and a prefix list hides the Bengaluru users from Delhi. You fix both without removing the tags.

How this module is organised

A newspaper editor receives the same story from three sources: a staff reporter, a news agency and an anonymous social media post. She does not compare how exciting each version is; she first asks which source she trusts more. A router does the same. When several routing sources offer the same prefix, it does not compare their metrics (an EIGRP metric and an OSPF cost are different currencies). It compares a trust score called administrative distance.

Three separate decisions

Beginners often mix up three decisions that happen at different stages. Keep them apart and most AD questions become easy.

1. Best path inside one protocol. EIGRP picks its successor by lowest composite metric; OSPF picks by lowest cost, with intra-area preferred over inter-area over E1 over E2. This happens inside the protocol's own database.
2. Which source installs the prefix in the routing table (RIB). If EIGRP, OSPF and a static route each offer exactly the same prefix and length, the router installs the one with the lowest AD. The losers stay in their own databases but are not used.
3. Which RIB entry forwards a packet. When a packet arrives, the router uses the longest prefix match among all installed routes, regardless of AD.

The default AD table (Cisco IOS and IOS-XE)

Two design ideas explain the odd-looking numbers. EIGRP gives its external routes (redistributed from somewhere else) a worse AD of 170 so that a real internal path is always preferred over a redistributed copy. BGP trusts eBGP (20) highly because external routes normally come only from the provider, but distrusts iBGP (200) so that an IGP path to an internal prefix wins over BGP.

Seeing AD in the output

In show ip route each entry shows [AD/metric]. The detailed view prints it in words.

BR1#show ip route 192.168.50.0
Routing entry for 192.168.50.0/24
  Known via "ospf 1", distance 110, metric 20
  Tag 90, type extern 2, forward metric 2
  Redistributing via eigrp 100
  Last update from 10.2.1.1 on GigabitEthernet0/1, 00:04:12 ago
  Routing Descriptor Blocks:
  * 10.2.1.1, from 2.2.2.2, 00:04:12 ago, via GigabitEthernet0/1
      Route metric is 20, traffic share count is 1
      Route tag 90

Longest match beats AD

AD only compares identical prefixes. If OSPF offers 10.200.10.0/25 and EIGRP offers 10.200.10.0/24, both are installed, because they are different routes. A packet to 10.200.10.20 follows the OSPF /25 even though EIGRP's AD is lower; a packet to 10.200.10.200 follows the EIGRP /24.

Why AD matters for redistribution

Redistribution takes routes from the routing table, not from the protocol database. A router running redistribute eigrp 100 under OSPF only exports prefixes that are currently installed as EIGRP routes (plus connected networks covered by EIGRP). If AD made a prefix install from OSPF instead, that prefix is silently not redistributed from EIGRP. Many "missing route" tickets are really AD tickets.

Floating static routes

A floating static route uses AD deliberately. Giving a backup static route an AD higher than the dynamic protocol keeps it out of the RIB until the dynamic route disappears.

! backup to Bengaluru users, used only if OSPF loses the route
ip route 10.200.10.0 255.255.255.0 192.0.2.1 250

Back to our newspaper editor. Usually the staff reporter is trusted more than the agency. But for one topic, say cricket, the agency has a specialist on the ground, so she decides: "for cricket stories from that agency, trust them more than usual." Routers allow exactly this. You can change the trust score for a whole protocol, for one route type, for routes from one source, or for one prefix from one source. The distance command is your tool, and every form of it is exam material.

Rule zero: AD is local

Changing AD on BR1 changes only which route BR1 installs. Neighbours never learn the new value. That is powerful (you can fix one router without touching others) and dangerous (two routers can now disagree about the best path and forward traffic to each other).

EIGRP

! classic mode: internal and external separately
router eigrp 100
 distance eigrp 90 175
! per source: internal routes learned from neighbour 10.1.1.1 get AD 95
 distance 95 10.1.1.1 0.0.0.0
! named mode: the same idea under the topology
router eigrp NK
 address-family ipv4 unicast autonomous-system 100
  topology base
   distance eigrp 90 175

In EIGRP the source address in the per-source form is the neighbour's interface address, and that form applies to internal routes. To change external routes, use distance eigrp.

OSPF

router ospf 1
! by route type
 distance ospf intra-area 110 inter-area 110 external 171
! everything from this process
 distance 115
! per source: routes whose LSA was originated by router ID 2.2.2.2
 distance 171 2.2.2.2 0.0.0.0

This is the classic trap: in OSPF the per-source address is the router ID of the router that originated the LSA (the Advertising Router), not the neighbour's interface address. OSPF routes are computed from the LSDB, so the "source" of an external route is the ASBR that created the type-5 LSA.

BGP, RIP and static

router bgp 65001
 distance bgp 20 200 200        ! external internal local
router rip
 distance 120
ip route 10.200.10.0 255.255.255.0 192.0.2.1 250   ! per static route

Per prefix: add an ACL

Every per-source form accepts an optional standard ACL that selects which prefixes get the new AD. A wildcard of 255.255.255.255 on the source means "from any source".

access-list 50 permit 192.168.50.0 0.0.0.255
router ospf 1
! only 192.168.50.0/24 from the two boundary routers gets AD 171
 distance 171 1.1.1.1 0.0.0.0 50
 distance 171 2.2.2.2 0.0.0.0 50

Verification

BR1#show ip protocols | section ospf
Routing Protocol is "ospf 1"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Router ID 1.1.1.1
  It is an autonomous system boundary router
 Redistributing External Routes from,
    eigrp 100, includes subnets in redistribution, route-map EIGRP-TO-OSPF
  ...
  Distance: intra-area 110 inter-area 110 external 171

BR1#show ip route 192.168.50.0
Routing entry for 192.168.50.0/24
  Known via "eigrp 100", distance 170, metric 130816, type external
  Redistributing via ospf 1
  Advertised by ospf 1 subnets route-map EIGRP-TO-OSPF

If the table does not change straight away, clear ip route 192.168.50.0 (or clear ip route *) re-installs routes from the protocol databases without resetting any neighbours.

Think of a courier company that sorts parcels with two questions. First: "is the address inside PIN area 5600xx?" Second: "is it a whole building, a floor, or a single flat?" A prefix list asks the same two questions about a route. The first is about the network bits (which area), the second is about the prefix length (how specific). Every route map, distribute-list and BGP filter you write in this module will lean on prefix lists, so we practise them until they are automatic.

Syntax

ip prefix-list NAME [seq N] {permit | deny} PREFIX/LEN [ge G] [le L]
ipv6 prefix-list NAME [seq N] {permit | deny} PREFIX/LEN [ge G] [le L]

A route matches an entry only if both tests pass:

1. Network test: the first LEN bits of the route equal the first LEN bits of PREFIX.
2. Length test: the route's own prefix length is inside the allowed range.

The values must satisfy LEN < G ≤ L ≤ 32; IOS rejects an entry that breaks this rule. The list is read in sequence order (default steps of 5), the first matching entry decides, and every list ends with an implicit deny for anything not matched.

Drills: match or not?

Lab 2: the list that was too exact

In the troubleshooting lab, route map OSPF-TO-EIGRP permits only routes matching prefix list OSPF-LANS, which contains a single entry.

BR1#show ip prefix-list detail OSPF-LANS
Prefix-list with the last deletion/insertion: OSPF-LANS
ip prefix-list OSPF-LANS:
   count: 1, range entries: 0, sequences: 5 - 5, refcount: 2
   seq 5 permit 10.200.1.0/24 (hit count: 14, refcount: 1)

With no ge or le, only 10.200.1.0/24 passes. 10.200.2.0/24 and the users' LAN 10.200.10.0/24 fail the network test and fall to the implicit deny, so E1 never learns them. The fix adds a range entry; nothing needs to be removed.

ip prefix-list OSPF-LANS seq 10 permit 10.200.0.0/16 le 24
! the transit links 10.2.1.0/24 and 10.2.2.0/24 still do not match, by design

BR1#show ip prefix-list detail OSPF-LANS
ip prefix-list OSPF-LANS:
   count: 2, range entries: 1, sequences: 5 - 10, refcount: 3
   seq 5 permit 10.200.1.0/24 (hit count: 16, refcount: 1)
   seq 10 permit 10.200.0.0/16 le 24 (hit count: 4, refcount: 1)

The hit count column is the best live evidence that an entry is matching routes. You can reset it with clear ip prefix-list OSPF-LANS.

Editing safely

• Insert between entries by choosing a free sequence number, for example seq 7.
• Remove one entry with no ip prefix-list OSPF-LANS seq 5. no ip prefix-list OSPF-LANS removes the entire list, and every route map referencing it then matches nothing.
• A prefix list that is referenced but does not exist behaves differently per feature; never rely on it. Create the list first, then reference it.

Imagine a wedding guest list that contains only first names. "Rahul" is on the list, so every Rahul at the gate walks in: the uncle, the cousin and the neighbour's son. That is a standard ACL used to match routes: it sees the network address and nothing about the mask. A prefix list is the guest list with first name and age, so it can tell the uncle from the son. Both tools still appear everywhere in real configs and in exam output, so you must read both fluently.

Packets versus routes

You learned ACLs for filtering packets: source, destination, protocol, ports. When an ACL is referenced by a routing feature (a distribute-list, a route map's match ip address, a distance command) it filters routes instead, and the fields take on new meanings.

• Standard ACL: the address and wildcard are compared with the route's network address only. The prefix length is ignored.
• permit means "this route matches"; deny means "this route does not match". Inside a route map, "does not match" sends the route to the next sequence; it does not necessarily drop it.
• The implicit deny at the end still exists: anything not permitted does not match.

Standard ACL examples

! matches every route whose network address starts with 10.200
access-list 10 permit 10.200.0.0 0.0.255.255
! matches any route whose network address is exactly 192.168.50.0, any mask
access-list 20 permit 192.168.50.0 0.0.0.0
! "permit any" for routes
access-list 30 permit any

ACL 10 matches 10.200.0.0/16, 10.200.10.0/24 and 10.200.10.128/25 alike. ACL 20 matches 192.168.50.0/24 but also a summary 192.168.50.0/23 or a host route 192.168.50.0/32 if one appeared.

Extended ACLs: two different meanings

Extended ACLs add a second address field, and Cisco uses it differently depending on the feature. This is a favourite trap.

• In BGP filtering and in route maps used by BGP, the source field matches the route's network and the destination field matches its mask. So an extended ACL can match length, just awkwardly.
• In an IGP distribute-list (EIGRP, RIP), the source field matches the router that sent the update and the destination field matches the network.

! BGP style: exactly 10.200.10.0/24
access-list 101 permit ip host 10.200.10.0 host 255.255.255.0
! BGP style: every /24 inside 10.200.0.0/16
access-list 102 permit ip 10.200.0.0 0.0.255.255 host 255.255.255.0
! EIGRP distribute-list style: 192.168.50.0 only when learned from 10.1.1.1
access-list 103 permit ip host 10.1.1.1 host 192.168.50.0

Compare ACL 102 with the prefix list 10.200.0.0/16 ge 24 le 24. Same result, far less readable. That is why modern configs prefer prefix lists, and why the neighbour side of a filter is usually written with distribute-list prefix LIST gateway GW-LIST instead.

Side-by-side comparison

The distance command is the one place you still must use a standard ACL, as you saw in chapter 3. The other rare case is a wildcard that is not contiguous, such as "every odd /24", which a prefix list cannot express.

ip prefix-list BLR-LANS seq 10 permit 10.200.0.0/16 le 24
router eigrp 100
 no distribute-list 10 out ospf 1
 distribute-list prefix BLR-LANS out ospf 1

Other match clauses that take a list

• match ip address {ACL | prefix-list NAME}: the route's network (and length, with a prefix list).
• match ip next-hop {ACL | prefix-list NAME}: the route's next-hop address.
• match ip route-source {ACL | prefix-list NAME}: the router that advertised the route.

Picture a government office with numbered counters. You start at counter 10. The clerk checks your documents against a list of conditions. If everything is in order, he either stamps your form and sends you out (permit) or tears it up (deny). If your documents do not match his conditions, you walk to counter 20 and try again. If no counter accepts you, the guard at the exit turns you away. That office is a route map: an ordered list of entries, each with conditions (match) and actions (set), used to filter routes and change their attributes.

Anatomy

route-map NAME {permit | deny} SEQUENCE
 match ...        ! zero or more conditions
 set ...          ! zero or more actions, only used by permit entries

If you omit the action and sequence, IOS creates permit 10. Sequence numbers let you insert entries later (use gaps of 10).

The processing rules

1. Entries are checked in ascending sequence order. The first entry whose conditions all succeed decides; later entries are not checked (unless continue is used).
2. Different match commands in one entry are combined with AND: match tag 90 plus match ip address prefix-list OSPF-LANS means both must be true.
3. Several values in one match command are combined with OR: match tag 90 110 means tag 90 or tag 110. Typing the same match type twice makes IOS merge the values into one line, so it is still OR.
4. An entry with no match command matches every route. That is how you write "permit everything else".
5. permit entry matched: the route is accepted and every set is applied. deny entry matched: the route is rejected.
6. No entry matched: implicit deny.

Four combinations people confuse

The list only answers "does it match?". The route map entry's own permit or deny decides the fate.

Useful match and set clauses

• match: ip address prefix-list, ip address ACL, ip next-hop, ip route-source, tag, interface, metric, route-type internal | external type-1 | external type-2 | local | nssa-external, and in BGP as-path and community.
• set: metric (one value, or five EIGRP values), metric-type type-1 | type-2 for OSPF, tag, ip next-hop, and in BGP local-preference, weight, as-path prepend, community.

Route maps are called from redistribute ... route-map, distribute-list route-map, default-information originate route-map, BGP neighbor ... route-map in|out and policy-based routing (ip policy route-map, covered in the PBR module).

The continue clause

Normally the first matching entry ends processing. continue [SEQ] inside a matched permit entry tells the router to keep going to the next entry, or to a specific later sequence, so several entries can each add attributes to the same route. It is a BGP policy tool on IOS (for example set a community in one entry and local preference in another). Do not build redistribution or PBR designs on it.

route-map FROM-ISP permit 10
 match ip address prefix-list CUSTOMERS
 set community 65001:100
 continue 20
route-map FROM-ISP permit 20
 match as-path 10
 set local-preference 200
route-map FROM-ISP permit 30

Verification

BR1#show route-map OSPF-TO-EIGRP
route-map OSPF-TO-EIGRP, deny, sequence 10
  Match clauses:
    tag 90
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes
route-map OSPF-TO-EIGRP, permit, sequence 20
  Match clauses:
    ip address prefix-lists: OSPF-LANS
  Set clauses:
    tag 110
  Policy routing matches: 0 packets, 0 bytes

The "Policy routing matches" counters count packets forwarded by PBR, so they stay at zero for redistribution. To prove what a redistribution route map did, check prefix-list hit counts and look for the tag in the destination protocol (show ip route on E1 shows "Tag 110").

Two ways to share travel information. In an office, news about a road closure passes from desk to desk, and anyone can decide not to pass a story on: that is distance vector, like EIGRP and RIP. In a city, every driver carries the same printed map book: that is link state, like OSPF. You can refuse to repeat a rumour, but you cannot tear a page out of everyone's map book; at most you can decide not to drive down a road yourself. That single idea explains almost everything about distribute-lists.

What a distribute-list is

A distribute-list attaches a filter (ACL, prefix list or route map) to a routing process, in one direction:

distribute-list {ACL | prefix NAME | route-map NAME} in  [interface]
distribute-list {ACL | prefix NAME | route-map NAME} out [interface | protocol process]
! EIGRP and RIP extra: match the advertising neighbour too
distribute-list prefix NAME gateway GW-NAME in [interface]

In EIGRP: real control over advertisements

EIGRP routers only know what neighbours tell them, so filters change what others learn.

• out [interface]: the router does not advertise matching routes (on that interface or all). Downstream routers never hear them.
• in [interface]: the router ignores matching routes received (from that interface or all). It will not install them and will not advertise them onward.
• out ospf 1 (a protocol name): filters which routes are redistributed from that source into EIGRP. It is an alternative to a route map on the redistribute command.

router eigrp 100
 distribute-list prefix BRANCH-ONLY out GigabitEthernet0/1
 distribute-list prefix BLR-LANS out ospf 1
 distribute-list route-map NO-OSPF-BORN in GigabitEthernet0/0

In OSPF: only the local routing table

Every router in an area must hold an identical LSDB, so OSPF cannot simply drop LSAs.

• distribute-list ... in filters between the LSDB and the RIB on this router only. The LSA stays in the database and is still flooded to neighbours.
• distribute-list ... out is valid only with a protocol name on an ASBR, for example distribute-list prefix EXPORT out eigrp 100. It controls which routes become type-5 LSAs.
• Real OSPF filtering of what other routers see is done elsewhere: area X filter-list prefix NAME in|out and area X range ... not-advertise on an ABR (type 3), and summary-address ... not-advertise on an ASBR (type 5). The ENARSI OSPF module covers these.

route-map NO-OSPF-BORN deny 10
 match tag 110
route-map NO-OSPF-BORN permit 20
router eigrp 100
 distribute-list route-map NO-OSPF-BORN in GigabitEthernet0/0

Verification

BR1#show ip protocols | section eigrp
Routing Protocol is "eigrp 100"
  Outgoing update filter list for all interfaces is not set
    Redistributed ospf 1 filtered by BLR-LANS
  Incoming update filter list for all interfaces is not set
  Default networks flagged in outgoing updates
  Default networks accepted from incoming updates
  Redistributing: ospf 1
  EIGRP-IPv4 Protocol for AS(100)
    Metric weight K1=1, K2=0, K3=1, K4=0, K5=0
    Router-ID: 1.1.1.1

O1#show ip protocols | include filter
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is (prefix-list) NO-TEST

After adding or changing an EIGRP distribute-list, EIGRP resynchronises with neighbours (graceful restart of the affected peers on recent releases). For an OSPF inbound filter, compare show ip ospf database (the LSA is still there) with show ip route (the route is gone).

At an airport currency desk, every country has its own rules. Some currencies convert automatically at a fixed rate, some need you to fill a form first, and some cannot be converted at all unless you insist. Redistribution works the same way. Each routing protocol has its own rule for the seed metric (the starting metric given to a redistributed route) and its own quirks about what it will take. This chapter is the rulebook; chapter 9 puts it to work.

Five rules that apply to every protocol

1. Redistribution reads the routing table. redistribute X takes routes that are installed in the RIB by source X, plus the connected networks of interfaces on which X is enabled. A route that lost the AD contest to another source is not taken.
2. It is per router and per direction. redistribute ospf 1 under EIGRP on BR1 moves routes one way on one router. The other direction and the other boundary router need their own commands.
3. It is not transitive on one router. If BR1 redistributes RIP into OSPF and OSPF into EIGRP, the RIP routes do not reach EIGRP, because they are not installed as OSPF routes on BR1.
4. The router must run both sources and have routes from the source installed.
5. Redistributed routes are external in the target. EIGRP marks them D EX (AD 170) and records the origin; OSPF creates type-5 LSAs (type-7 in an NSSA) seen as O E1 or O E2; BGP gives them origin "incomplete" (?).

Seed metrics, protocol by protocol

Two more defaults: redistribute ospf into EIGRP or RIP takes internal and external OSPF routes; redistribute bgp into an IGP takes only eBGP routes unless bgp redistribute-internal is configured. That second default protects IGPs from a full iBGP table.

The EIGRP seed metric in numbers

The five values are bandwidth in kbit/s, delay in tens of microseconds, reliability out of 255, load out of 255, and MTU. With the classic formula (K1 = K3 = 1) only bandwidth and delay count: metric = 256 x (10,000,000 / min bandwidth + total delay / 10).

E1#show ip eigrp topology 10.200.10.0/24
EIGRP-IPv4 Topology Entry for AS(100)/ID(5.5.5.5) for 10.200.10.0/24
  State is Passive, Query origin flag is 1, 2 Successor(s), FD is 51456
  Descriptor Blocks:
  10.1.1.2 (GigabitEthernet0/0), from 10.1.1.2, Send flag is 0x0
      Composite metric is (51456/51200), route is External
      Vector metric:
        Minimum bandwidth is 100000 Kbit
        Total delay is 1010 microseconds
        Reliability is 255/255
        Load is 1/255
        Minimum MTU is 1500
        Hop count is 1
        Originating router is 1.1.1.1
      External data:
        AS number of route is 1
        External protocol is OSPF, external metric is 2
        Administrator tag is 110 (0x0000006E)

The External data block is gold for troubleshooting: it tells you which router redistributed the route, from which protocol and process, the original metric, and the tag.

The subnets keyword: a little history

On older IOS releases, redistribute eigrp 100 under OSPF without subnets redistributed only classful networks and printed "% Only classful networks will be redistributed". Networks like 172.16.10.0/24 silently stayed out. On recent IOS and IOS-XE releases subnets behaviour is the default and the keyword is added to the running configuration automatically. Always type it anyway: it documents intent and protects you on older code. OSPFv3 has no subnets keyword.

Connected, static and default routes

• redistribute connected [route-map] injects interface networks. E1 uses this for Loopback1 (192.168.50.0/24), which is why that network is D EX everywhere else. Use match interface in a route map to pick interfaces.
• redistribute static injects static routes; into EIGRP they keep the outgoing interface metric.
• A default route is special. OSPF will not advertise 0.0.0.0/0 through redistribute; use default-information originate [always]. BGP needs default-information originate or neighbor ... default-originate.

A small village joined to a highway by a single one-way slip road is easy to manage: cars can enter the highway, and for the way back the village simply follows a sign that says "everything else, this way". Connect a big city to the highway with two two-way junctions and you need traffic police, signs and rules, or cars will circle forever. Redistribution designs grow the same way, from one-way at one point to mutual (two-way) at several points.

Four designs, four risk levels

• One-way, one point. Example: a small OSPF branch domain behind BR1. BR1 redistributes OSPF into EIGRP, and instead of redistributing EIGRP back, it sends a default route into OSPF with default-information originate. No feedback is possible.
• Mutual, one point. Both directions on one router. A route cannot come back through a second boundary, so feedback is impossible, but the single router is a single point of failure.
• One-way, two points. Redundant, but a route redistributed at one point can still be seen by the other point in the destination protocol and win on AD.
• Mutual, two or more points. Redundant and realistic, and home to every problem in chapter 10. You need tags, filters and AD planning.

Lab 1, step by step

Starting point: EIGRP 100 is up between E1, BR1 and BR2; OSPF area 0 is up between O1, BR1 and BR2; no redistribution yet.

Step 1: OSPF into EIGRP on both boundary routers.

! BR1 and BR2
router eigrp 100
 redistribute ospf 1 metric 100000 100 255 1 1500
! alternative: default-metric 100000 100 255 1 1500, then redistribute ospf 1

E1#show ip route eigrp | include EX
D EX     10.200.10.0/24 [170/51456] via 10.1.2.2, 00:00:41, GigabitEthernet0/1
                        [170/51456] via 10.1.1.2, 00:00:41, GigabitEthernet0/0
D EX     10.200.1.0/24 [170/51456] via 10.1.2.2, 00:00:41, GigabitEthernet0/1
                       [170/51456] via 10.1.1.2, 00:00:41, GigabitEthernet0/0

Two equal next hops: both boundary routers redistribute with the same seed, so E1 load-shares.

Step 2: EIGRP into OSPF on both boundary routers.

router ospf 1
 redistribute eigrp 100 subnets

O1#show ip route ospf | include E2
O E2     172.16.10.0/24 [110/20] via 10.2.2.2, 00:01:02, GigabitEthernet0/1
                        [110/20] via 10.2.1.2, 00:01:02, GigabitEthernet0/0
O E2     192.168.50.0/24 [110/20] via 10.2.2.2, 00:01:02, GigabitEthernet0/1

Notice the difference. 172.16.10.0/24 is an EIGRP internal route (AD 90) on both boundary routers, so both redistribute it. 192.168.50.0/24 is EIGRP external (AD 170). Whichever boundary router redistributed it first (here BR2) created an O E2 route; the other one (BR1) then preferred that O E2 copy (AD 110) over its own D EX route (AD 170), so BR1 has nothing to redistribute. You have just reproduced the suboptimal-routing problem that lab 2 fixes.

Step 3: feedback appears. BR1 now holds 192.168.50.0/24 as an OSPF route, and it redistributes OSPF into EIGRP, so it injects E1's own network back into EIGRP with the lab seed metric.

E1#show ip eigrp topology all-links | section 192.168.50.0
P 192.168.50.0/24, 1 successors, FD is 128256, serno 7
        via Rconnected (128256/0)
        via 10.1.1.2 (51456/51200), GigabitEthernet0/0

E1 still forwards with its connected route (AD 0), but EIGRP now holds a second path for this network pointing back through BR1, and that fake path even has the better metric. If Loopback1 went down, the fake path could keep the network alive in EIGRP and pull traffic into a loop.

Step 4: tag and filter. On both boundary routers, stamp routes on the way out and refuse the stamp on the way back (chapter 11 explains the design in depth).

route-map EIGRP-TO-OSPF deny 10
 match tag 110
route-map EIGRP-TO-OSPF permit 20
 set tag 90
route-map OSPF-TO-EIGRP deny 10
 match tag 90
route-map OSPF-TO-EIGRP permit 20
 set tag 110
router ospf 1
 redistribute eigrp 100 subnets route-map EIGRP-TO-OSPF
router eigrp 100
 redistribute ospf 1 metric 100000 100 255 1 1500 route-map OSPF-TO-EIGRP

Step 5: verify.

E1#show ip eigrp topology all-links | section 192.168.50.0
P 192.168.50.0/24, 1 successors, FD is 128256, serno 9
        via Rconnected (128256/0)

O1#show ip route 172.16.10.0
Routing entry for 172.16.10.0/24
  Known via "ospf 1", distance 110, metric 20
  Tag 90, type extern 2, forward metric 1
  Routing Descriptor Blocks:
    10.2.2.2, from 2.2.2.2, 00:00:32 ago, via GigabitEthernet0/1
      Route metric is 20, traffic share count is 1
      Route tag 90
  * 10.2.1.2, from 1.1.1.1, 00:00:32 ago, via GigabitEthernet0/0
      Route metric is 20, traffic share count is 1
      Route tag 90

The lab asks you to read that tag: 90. Finally, ping 10.200.10.10 from PCE succeeds, and PCO reaches 192.168.50.1.

Two villages are joined by two bridges. A story leaves village A over the north bridge, is told in village B, and walks back over the south bridge. Now village A hears its own story, but told by strangers from B, and some people believe the stranger's version more than the original. That is route feedback. With two or more redistribution points it is not a rare accident; it is the default behaviour unless you stop it. This chapter dissects every failure it causes, using the module topology.

Problem 1: suboptimal routing caused by AD

Follow the Delhi partner network 192.168.50.0/24, an EIGRP external route (E1 redistributes it from Loopback1).

1. Both boundary routers learn it as D EX, AD 170 from E1.
2. BR2 redistributes it into OSPF first. O1 floods a type-5 LSA; BR1 receives it as O E2, AD 110.
3. BR1 compares AD: 110 beats 170. BR1 installs the OSPF copy and routes 192.168.50.0/24 via O1, BR2 and E1: three hops instead of one.
4. Because BR1's RIB entry is now OSPF, redistribute eigrp 100 on BR1 no longer exports it. Only BR2 advertises it into OSPF; the redundancy you built exists only on paper.

BR1#traceroute 192.168.50.1
Type escape sequence to abort.
Tracing the route to 192.168.50.1
VRF info: (vrf in name/id, vrf out name/id)
  1 10.2.1.1 1 msec 1 msec 1 msec
  2 10.2.2.2 1 msec 2 msec 1 msec
  3 10.1.2.1 2 msec *  2 msec

Hop 1 is O1 (10.2.1.1): the first answer in lab 2. Note that EIGRP internal routes such as 172.16.10.0/24 do not suffer, because AD 90 beats 110. The problem hits routes that are external in their home protocol: EIGRP externals, and in other designs RIP routes (120) versus OSPF or anything versus eBGP (20).

Problem 2: route feedback and a persistent loop

BR1 holds 192.168.50.0/24 as OSPF, and it redistributes OSPF into EIGRP. Without tags, it injects Delhi's own network back into Delhi. Now imagine Loopback1 on E1 goes down.

1. E1 loses the connected route. EIGRP still has the feedback path via BR1 (chapter 9, step 3), so E1 installs D EX 192.168.50.0/24 via BR1.
2. E1 advertises it to BR2 (split horizon only stops it towards BR1). BR2 keeps its D EX route and keeps redistributing it into OSPF.
3. O1 keeps the LSA and forwards to BR2; BR1 keeps its O E2 route via O1 and keeps feeding EIGRP.
4. Result: a network that no longer exists stays in both domains, and packets for it circle E1, BR1, O1, BR2, E1 until the TTL expires.

Problem 3: lost metrics and misleading seeds

A seed metric replaces the route's real cost. In lab 1 the feedback copy of 192.168.50.0/24 arrived at E1 with metric 51,456, better than the genuine connected route's 128,256. Any router that compares only EIGRP metrics could prefer a path through the other domain. Seed metrics should be worse than real internal paths; a common rule is to use a seed that looks like a slow link.

Problem 4: oscillation

Because a boundary router stops redistributing a prefix as soon as it installs the other protocol's copy, the two boundary routers can take turns: BR1 withdraws its type-5 LSA, BR2's copy wins everywhere, then a change on BR2 flips the preference again. debug ip routing shows the same prefix being added and deleted every few seconds. Stable AD and tag policy removes the cause.

The toolbox

Every culture has rules against gossip loops. You stamp a letter so it is not delivered twice. You do not repeat a story back to the person who told it to you. And when a road is really closed, you shout "closed!" loudly instead of just going quiet, so nobody keeps driving towards it. Routing has exactly these three rules: tags, split horizon and route poisoning. Blueprint item 1.3 asks you to troubleshoot all of them, plus filtering.

Route tags: the passport stamp

A route tag is a 32-bit number attached to a route. It does nothing by itself; it is metadata that a route map can later match. Where it lives:

• EIGRP external routes carry an administrator tag in the External data (named mode can also tag internal routes).
• OSPF type-5 and type-7 LSAs carry an External Route Tag, and every router in the domain sees it.
• RIPv2 has a route tag field. BGP has no tag field; it uses communities for the same purpose.

The key property: the tag survives the trip through the other protocol, because each redistribution can copy or set it. That lets the second boundary router recognise a route that originally came from the domain it is about to enter.

The lab tag design, line by line

route-map EIGRP-TO-OSPF deny 10
 match tag 110          ! born in OSPF: never send it back to OSPF
route-map EIGRP-TO-OSPF permit 20
 set tag 90             ! everything else: stamp "born in EIGRP"
route-map OSPF-TO-EIGRP deny 10
 match tag 90           ! born in EIGRP: never send it back to EIGRP
route-map OSPF-TO-EIGRP permit 20
 set tag 110            ! everything else: stamp "born in OSPF"

The same four entries go on every boundary router. Each direction does two jobs: deny the other domain's stamp, and set its own stamp on everything it lets through.

O1#show ip ospf database external 172.16.10.0
            OSPF Router with ID (9.9.9.9) (Process ID 1)
                Type-5 AS External Link States
  LS age: 312
  Options: (No TOS-capability, DC, Upward)
  LS Type: AS External Link
  Link State ID: 172.16.10.0 (External Network Number )
  Advertising Router: 1.1.1.1
  LS Seq Number: 80000002
  Checksum: 0x5A2C
  Length: 36
  Network Mask: /24
        Metric Type: 2 (Larger than any link state path)
        MTID: 0
        Metric: 20
        Forward Address: 0.0.0.0
        External Route Tag: 90

Tags to protect path choice

Tags plus deny stop re-redistribution. To also stop a boundary router from installing a route that originally came from its own other side, filter by tag inbound, as in chapter 7: distribute-list route-map NO-OSPF-BORN in under EIGRP (deny tag 110). OSPF can do the same for its RIB with distribute-list route-map matching tag 90. Combining tags with this inbound filter is the most robust multi-point design.

Split horizon and poison reverse

Split horizon: a distance-vector router never advertises a route out of the interface it uses to reach that route. It prevents two-router loops. RIP and EIGRP enable it by default. The classic exception is a hub-and-spoke network such as a DMVPN hub, where all spokes sit behind one tunnel interface; the hub must use no ip split-horizon eigrp 100 on the tunnel so spokes learn each other's networks (DMVPN module). Poison reverse is the stronger form: advertise the route back to where it came from, but with an infinite metric.

Route poisoning

When a route fails, the router advertises it immediately with an infinite metric instead of silently dropping it: hop count 16 in RIP, maximum delay in EIGRP (EIGRP then queries neighbours for an alternative). Neighbours remove it at once instead of waiting for timers. RIP adds hold-down timers and triggered updates; EIGRP relies on DUAL's feasibility condition, which only accepts backup paths that are guaranteed loop-free.

Other built-in guards worth knowing

A good doctor does not start with surgery. She asks where it hurts, checks the pulse, orders one test, reads it, and only then treats. Redistribution problems deserve the same discipline, because the symptom (a missing route in Delhi) often appears far from the cause (one line in a prefix list in a boundary router). This chapter gives you a repeatable workflow and then walks the lab 2 tickets exactly as you would in the lab or the exam.

The workflow: follow the route from birth to destination

1. Define the symptom precisely. Which prefix, seen from which router, and which of three types: missing, wrong path, or looping/flapping. Use show ip route PREFIX, traceroute and ping with a source.
2. Birth: is the route installed from the intended source on the redistributing router? show ip route PREFIX and read "Known via". If AD made another source win, nothing will be exported from the intended one.
3. The redistribute command. show ip protocols and show running-config | section router: right process or AS number, seed metric into EIGRP or RIP, subnets into OSPF, the route-map name spelled exactly.
4. Policy. show route-map NAME, show ip prefix-list detail NAME (hit counts), ACLs. Walk the route through the entries by hand.
5. The target database. show ip eigrp topology PREFIX (External data, originating router, tag) or show ip ospf database external PREFIX (advertising router, tag, metric type).
6. Propagation. Distribute-lists, summarisation, EIGRP stub, OSPF stub or totally stubby areas (which block type-5 LSAs), filtering on ABRs.
7. Path choice. On each hop, compare AD and metric; check both boundary routers.
8. Loops. TTL-expired messages, debug ip routing showing add and delete churn, missing tags.

Lab 2, ticket 1: BR1 takes the long way to 192.168.50.0/24

Symptom. The lab asks for hop 1 of a traceroute from BR1.

BR1#traceroute 192.168.50.1
Tracing the route to 192.168.50.1
  1 10.2.1.1 1 msec 1 msec 1 msec
  2 10.2.2.2 1 msec 2 msec 1 msec
  3 10.1.2.1 2 msec *  2 msec

Hop 1 is 10.2.1.1, O1: BR1 is sending Delhi traffic into Bengaluru. Check the RIB.

BR1#show ip route 192.168.50.0
Routing entry for 192.168.50.0/24
  Known via "ospf 1", distance 110, metric 20
  Tag 90, type extern 2, forward metric 2
  Redistributing via eigrp 100
  Routing Descriptor Blocks:
  * 10.2.1.1, from 2.2.2.2, 00:12:40 ago, via GigabitEthernet0/1
      Route metric is 20, traffic share count is 1
      Route tag 90

The route is O E2, tag 90 (born in EIGRP), advertised by 2.2.2.2 (BR2). The tags already prevent it going back into EIGRP, so this is not feedback. It is AD: 110 beats the D EX 170 still visible in show ip eigrp topology 192.168.50.0/24. Fix on both boundary routers:

router ospf 1
 distance ospf external 171

BR1#show ip route 192.168.50.0 | include Known
  Known via "eigrp 100", distance 170, metric 130816, type external
O1#show ip route 192.168.50.0 | include via
  * 10.2.2.2, from 2.2.2.2, 00:00:18 ago, via GigabitEthernet0/1
    10.2.1.2, from 1.1.1.1, 00:00:18 ago, via GigabitEthernet0/0

BR1 now uses E1 directly, and because BR1's RIB entry is EIGRP again, it redistributes the prefix too: O1 load-shares across both boundary routers. Redundancy restored.

Lab 2, ticket 2: Delhi cannot reach the Bengaluru users

Symptom. E1 has only one Bengaluru prefix.

E1#show ip route | include 10.200
D EX     10.200.1.0/24 [170/51456] via 10.1.2.2, 00:14:02, GigabitEthernet0/1
                       [170/51456] via 10.1.1.2, 00:14:02, GigabitEthernet0/0

Source RIB: BR1 has O 10.200.10.0/24 and O 10.200.2.0/24, so birth is fine. Redistribute command: show ip protocols shows "Redistributing: ospf 1" and the running config shows route-map OSPF-TO-EIGRP with the seed metric. Policy:

BR1#show route-map OSPF-TO-EIGRP
route-map OSPF-TO-EIGRP, deny, sequence 10
  Match clauses:
    tag 90
route-map OSPF-TO-EIGRP, permit, sequence 20
  Match clauses:
    ip address prefix-lists: OSPF-LANS
  Set clauses:
    tag 110
BR1#show ip prefix-list detail OSPF-LANS
   seq 5 permit 10.200.1.0/24 (hit count: 14, refcount: 1)

Walk 10.200.10.0/24 through the map: not tag 90, then no prefix-list entry matches, so implicit deny. Fix on both boundary routers, without touching the tagging:

ip prefix-list OSPF-LANS seq 10 permit 10.200.0.0/16 le 24

E1#show ip route 10.200.10.0
Routing entry for 10.200.10.0/24
  Known via "eigrp 100", distance 170, metric 51456, type external
  Routing Descriptor Blocks:
  * 10.1.2.2, from 10.1.2.2, 00:00:25 ago, via GigabitEthernet0/1
      Route metric is 51456, traffic share count is 1
      Route tag 110
    10.1.1.2, from 10.1.1.2, 00:00:25 ago, via GigabitEthernet0/0

Final check: PCE pings 10.200.10.10 and PCO pings 192.168.50.1. A ping sourced from O1 itself may still fail, because O1 sources it from a transit link (10.2.x.x) that the prefix list deliberately does not redistribute. That is expected, not a new fault.

Debugging, carefully

debug ip routing prints every RIB add and delete, and reveals AD fights and oscillation.

RT: add 192.168.50.0/24 via 10.1.1.1, eigrp metric [170/130816]
RT: closer admin distance for 192.168.50.0, flushing 1 routes
RT: add 192.168.50.0/24 via 10.2.1.1, ospf metric [110/20]

Use it on a lab router or with logging to the buffer and a short capture window, then undebug all.

Back at the border post from chapter 1. The officer now knows whom to trust (AD), how to convert currency (seed metrics), which goods may cross (prefix lists, route maps, distribute-lists) and how to stamp passports so nobody sneaks back in (tags). This chapter is your revision sheet: what you must be able to do, the words you must know, the facts the exam loves, and the commands in one place.

Can-do checklist

• State the default AD of every source and explain why EIGRP external is 170 and iBGP 200.
• Separate metric (inside a protocol), AD (between sources for the same prefix) and longest match (per packet).
• Change AD with distance eigrp, distance ospf, distance bgp, per source and per prefix with an ACL; know that OSPF per-source uses originating router IDs.
• Write and read prefix lists with ge and le without hesitation, including permit-any and default-only entries.
• Explain how standard and extended ACLs match routes and why prefix lists are preferred.
• Trace any route through a route map: sequence order, AND/OR, implicit deny, set actions, continue.
• Apply distribute-lists in EIGRP and OSPF and predict exactly what neighbours see.
• Redistribute between EIGRP, OSPF, BGP, RIP, connected and static with the correct seed metrics and keywords.
• Build lab 1 (mutual redistribution with tags) and fix lab 2 (AD and prefix-list tickets) from memory.
• Recognise feedback, suboptimal routing, lost metrics and oscillation, and choose the right fix for each.
• Explain split horizon, poison reverse, route poisoning and the EIGRP originating router ID check.

Mini glossary

Administrative distance

Local trust value (0 to 255) used to choose between sources offering the same prefix; lower wins; never advertised.

Seed metric

The starting metric a redistributed route receives in the target protocol.

Redistribution

Copying routes installed by one source into another protocol on one router, in one direction.

Mutual redistribution

Redistribution in both directions between two domains.

Route feedback

A route re-entering the domain it came from through another redistribution point.

Route tag

32-bit label on EIGRP external and OSPF external routes, used by route maps to recognise origin.

Prefix list

Ordered filter matching network bits and prefix length (ge, le).

Route map

Ordered permit/deny entries with match conditions and set actions.

Distribute-list

Filter applied to a routing process inbound or outbound, per interface or per redistributed protocol.

Split horizon

Never advertise a route out of the interface used to reach it.

Route poisoning

Advertising a failed route with an infinite metric so neighbours drop it at once.

Most tested facts

Command cheat sheet

router eigrp 100
 redistribute ospf 1 metric 100000 100 255 1 1500 route-map OSPF-TO-EIGRP
 distance eigrp 90 170
 distribute-list prefix NAME {in | out} [interface]
router ospf 1
 redistribute eigrp 100 subnets route-map EIGRP-TO-OSPF
 distance ospf intra-area 110 inter-area 110 external 171
 distance 171 2.2.2.2 0.0.0.0 50
 default-information originate
ip prefix-list OSPF-LANS seq 10 permit 10.200.0.0/16 le 24
route-map OSPF-TO-EIGRP deny 10
 match tag 90
route-map OSPF-TO-EIGRP permit 20
 match ip address prefix-list OSPF-LANS
 set tag 110

show ip route PREFIX                      ! Known via, distance, Tag, Advertised by
show ip protocols                         ! Redistributing, filters, Distance
show ip eigrp topology PREFIX             ! External data: protocol, originator, tag
show ip ospf database external PREFIX     ! Advertising Router, Metric Type, Tag
show route-map NAME
show ip prefix-list detail NAME           ! hit counts
debug ip routing                          ! RIB add/delete, AD fights