Advanced Routing and VLANs — Static, OSPF, EIGRP, and Where Trust Boundaries Actually Live

Last updated: May 1, 2026

Most “the network is broken” tickets are routing tickets. A bad static route, a redistribution loop, an OSPF metric mismatch, an asymmetric path through a stateful firewall — every one of them ends with a packet that reaches its destination but cannot find its way back. This module gives you the mental model for routing decisions, the protocols (static, OSPF, EIGRP, RIP for completeness), and how VLANs slice a single switch into separate Layer-2 domains for segmentation.

The forwarding table — what every router actually does

A router’s job is short: receive packet, look up destination IP in forwarding table, send to next-hop, repeat. Lookup uses

longest-prefix matchamong all matching prefixes, the most specific wins. If your table has 0.0.0.0/0 via 1.1.1.1 (default route), 10.0.0.0/8 via 10.0.0.1, and 10.10.10.0/24 via 10.10.0.1, then a packet for 10.10.10.5 matches all three but the /24 wins because /24 is more specific than /8 which is more specific than /0. The Linux command ip route get 10.10.10.5 performs exactly this lookup.

Cisco IOSshow ip route 10.10.10.5.

Juniper Junosshow route 10.10.10.5. Memorise these — they are the first thing you type when something is broken.

Static routes — boring, predictable, and where pros start

A static route is an entry the operator typed in. It does not change unless someone changes it. Cisco syntax: ip route 10.0.0.0 255.0.0.0 10.0.0.1. That is it.

Prosdeterministic, low CPU, no protocol bugs to worry about.

Consdoes not adapt to failure, every change is manual. For small networks (<10 routers, simple topology) static routes beat dynamic protocols on simplicity. For two-router HA, you can use floating static routes (with administrative distance) so the backup route only kicks in if the primary goes down. Most "I just need this one network reachable" problems are solved with two static routes (one each way) and verifying both ends. Bidirectional reachability — never assume the return path works just because the forward path does. Asymmetric routes through stateful firewalls are the #1 source of "it pings, but the application fails" tickets.

OSPF — the link-state protocol most enterprises run

Open Shortest Path First is a link-state IGP standardised by the IETF (RFC 2328). Each router floods its local link state to every other router; each router builds the same map and computes Dijkstra’s shortest path. Areas reduce flooding: Area 0 is the backbone; non-zero areas connect through it.

LSA typesType 1 (Router), Type 2 (Network), Type 3 (Summary), Type 5 (External).

OSPF securityby default, OSPF authenticates with MD5 if you enable it (area 0 authentication message-digest); without auth, anyone on the link can inject LSAs and redirect traffic. Almost every enterprise OSPF deployment we audit forgets auth — and there are real-world cases of lateral movement via injected LSA. Always enable authentication. Always enable passive interfaces on user-facing ports so OSPF hellos do not leak to the LAN.

EIGRP, RIP, and when you might still see them

EIGRP (Cisco-proprietary, now an open standard via RFC 7868) is a hybrid distance-vector + link-state protocol. Faster convergence than OSPF in many topologies, simpler config, but Cisco-only in practice. RIP (Routing Information Protocol, distance-vector) is mostly historical — slow convergence, max 15 hops, broadcast updates every 30 seconds — but you still find it in lab environments and small branch routers. Both EIGRP and RIP support authentication (RIPv2 with MD5; EIGRP with HMAC-SHA). For new builds, the choice is OSPF (multi-vendor, well-understood) or BGP (Module 8, internet edge and large fabrics). If you inherit RIP, plan a migration; the operational risk is too high.

Redistribution — where loops are born

“Redistribution” means taking routes from one routing protocol and announcing them in another (e.g., OSPF learns about a network from EIGRP). Redistribution is necessary when you have heterogeneous protocols, and it is also where almost every routing outage starts. The classic failure: redistribute OSPF into EIGRP, then EIGRP back into OSPF, and the same prefix oscillates. Always use route maps with explicit prefix lists to filter what is redistributed; never blanket-redistribute “all”. Set distinct tag values on redistributed routes so you can identify and filter them downstream. And always test failover before you ship — redistribution loops only show up under failure conditions.

VLANs — slicing a switch into multiple broadcast domains

A switch by default is one big broadcast domain. VLANs (802.1Q) tag frames with a 12-bit VLAN ID, allowing the same physical switch to behave like multiple isolated switches. Access ports belong to a single VLAN and pass untagged frames to/from the host. Trunk ports carry tagged traffic for multiple VLANs between switches. Native VLAN is the untagged VLAN on a trunk — historically VLAN 1, but never use VLAN 1 in production: it is the default for management protocols (CDP, LLDP, VTP) and an attacker on an unconfigured port lands directly in your management plane.

VLAN hoppingdouble-tagging (an attacker on VLAN 10 sends a frame with two 802.1Q headers, the outer matching the trunk’s native VLAN, the inner targeting VLAN 20 — the first switch strips the outer tag and forwards by the inner) and switch-spoofing (DTP negotiation lets an attacker make the switch treat their port as a trunk). Defence: hard-set every access port (no DTP), use a dedicated and unused native VLAN on trunks, and enforce VLAN ACLs.

Inter-VLAN routing — the "router on a stick" and L3 switches

VLANs separate broadcast domains, but they cannot talk to each other without routing. Two patterns: Router on a stick — a single router with a trunk port and one sub-interface per VLAN; cheap, works for small offices, all inter-VLAN traffic crosses the router. L3 switch (SVI) — the switch itself routes between VLANs in hardware, fast, the modern default. Either way, the routing point becomes the security choke — that is where ACLs live, where IDS sees inter-VLAN traffic, where firewalls inspect.

Designing for securityput a stateful firewall between user VLANs and server VLANs (north-south control), and consider micro-segmentation tools (NSX, Illumio, native cloud SGs) for east-west between servers. Module 12 covers segmentation patterns in depth.

Asymmetric routing — the production trap

Asymmetric routing means traffic takes one path going out and a different path coming back. The most common cause: dual ISPs with one preferred for outbound, the other receiving inbound (because of their own routing decisions on the public side). With stateful firewalls, asymmetric routing is fatal — packets entering via firewall A and leaving via firewall B fail because A never saw the original SYN, B never sees the response.

Symptoms“ping works but TCP fails”, “this app works for some users but not others”, connection establishment hangs.

Diagnosistraceroute from both ends, ip route get on Linux, show route protocol on routers. The fix is either symmetric routing (route policy or VIP-based load balancers) or stateless filtering on the asymmetric path. Cloud-side: AWS source/destination check, GCP routing precedence, Azure UDR rules each have their own quirks. Asymmetric routes are the single most common cause of “works on Tuesday, fails on Wednesday” inter-region issues.

Building a routing lab on a laptop

GNS3 or EVE-NG let you run real Cisco/Juniper images on a laptop with multi-router topologies. Containerlab uses container-native routers (FRR, vSRX, EOS) for faster startup. VyOS is a free Linux-based router that runs in any VM.

Recommended starter lab4 VyOS or FRR routers in a square topology, OSPF on the inside, BGP between two of them, a “customer” Linux box behind each. With this you can practise: route filtering, OSPF area design, BGP redistribution, ECMP, and failover. Fifteen hours in this lab teaches more than a hundred hours of reading. Build it once, save the config, redeploy when you want to test something. Indian students with limited hardware can run all of this on a 16 GB laptop with a Linux host.

OSPF security checklist — what to verify on every router

Run through this on every OSPF-speaking router in your network:

VLAN trunking pitfalls — the configuration that catches everyone

Trunk-port misconfiguration causes a recurring class of outages. Five specific patterns to verify on every trunk:

Diagrams

Forwarding table:
   Prefix              Next-hop          Cost
  ─────────────────────────────────────────────
   0.0.0.0/0           10.0.0.1          10
   10.0.0.0/8          10.10.0.1          5
   10.10.10.0/24       10.10.10.1         1

Packet destined for  10.10.10.5
   matches  /0   → no
   matches  /8   → yes
   matches  /24  → yes (longer prefix wins)
  → forward to 10.10.10.1 (cost 1)

  ┌───────────┐                              ┌───────────┐
  │ Switch A  │====[ 802.1Q TRUNK ]========│ Switch B  │
  │           │  carrying VLANs 10, 20, 30 │           │
  └─┬─┬─┬─────┘                              └─┬─┬─┬───┘
   │ │ │                                       │ │ │
   │ │ └── Access port  VLAN 30  (printer)
   │ └──── Access port  VLAN 20  (server)
   └────── Access port  VLAN 10  (user PC)

Frames on access ports: untagged.
Frames on trunk: 802.1Q tag inserted on egress, stripped on ingress.

References & deeper reading

• RFC 2328 — OSPF v2
• RFC 7868 — EIGRP
• IEEE 802.1Q — VLAN tagging
• Cisco IOS routing reference
• NIST SP 800-189 (Resilient Interdomain Routing)
• GNS3 — free routing/switching simulator
• EVE-NG community edition

FAQ

Should small offices run OSPF or just static routes?

Up to 4-5 routers in a stable topology, static routes win — predictable, easy to troubleshoot, no protocol surprises. Beyond that, OSPF auto-recovers from link failures while you sleep. The crossover is around the size at which “I will just SSH in and fix it” becomes “I will be on a flight when this fails.”

What is the difference between an L3 switch and a router?

Functionally the same for IP routing. Architecturally the L3 switch does line-rate forwarding in ASIC and is built for many high-bandwidth ports; routers prioritise feature richness (advanced QoS, deep ACLs, MPLS, IPSec termination) over raw port count. Use L3 switches for the campus core; use routers at the WAN edge.

Why do most enterprises avoid VLAN 1?

Because every switch ships with VLAN 1 as the default management VLAN, default native VLAN on trunks, and default for any unconfigured port. An attacker who plugs into an unconfigured port lands in VLAN 1 next to your management plane. Best practice: leave VLAN 1 unused, set native VLAN to a dedicated unused number on every trunk.

Are private VLANs (PVLANs) still useful?

Yes for hotel-style network designs (each guest gets isolation while sharing the same gateway VLAN), DMZ designs where servers must not talk to each other, and MDU/co-tenant infrastructure. Most modern designs prefer micro-segmentation tools (cloud SGs, host-based firewalls) but PVLANs remain the right answer in some campus-LAN cases.

Do I need to learn OSPF if my company runs everything in cloud?

AWS Transit Gateway, Azure Virtual WAN, GCP NCC all hide routing protocols from you — but they implement BGP underneath. You will not write OSPF configs, but understanding link-state and path selection makes hybrid-cloud routing problems debuggable instead of mysterious. Module 8 (BGP) is the more important follow-up for cloud practitioners.

Should I memorise OSPF area types or look them up?

Memorise: standard area, stub area, totally stubby, NSSA. Lookup the precise LSA-type behaviour. Recognising area types from a topology diagram is design-interview-grade; reciting LSA filtering rules is configuration-time work.

Why do enterprise networks still mix OSPF and BGP?

OSPF inside the enterprise (fast convergence, simple config, multi-vendor); BGP for the internet edge and large fabric architectures. They do not compete; they live at different scopes. Modern data-centre fabrics (Clos, BGP-EVPN) increasingly use BGP all the way down for consistency.

⚖️ Legal: Use any techniques described here only on networks you own or have explicit written authorisation to test. In India, unauthorised access is punishable under IT Act §66 (up to 3 years + fine). Pair offensive testing with a signed Statement of Work / Rules of Engagement; pair forensic activity with §65B-aligned chain of custody.