Router Forwarding Decisions

Understanding how a router decides where to send each packet is essential for the CCNA exam. The forwarding process follows a strict order of operations.

The Forwarding Decision Process

When a router receives a packet:

Step 1: Lookup the destination IP in the routing table The router compares the destination IP address against all routes in the routing table.

Step 2: Apply longest prefix match If multiple routes match, the most specific (longest prefix) wins. A /28 is preferred over /24, which is preferred over /16.

Step 3: If prefix lengths are equal, compare AD Routes from different sources to the same destination/prefix are compared by administrative distance. Lower AD wins.

Step 4: If AD is equal, compare metric Routes from the same protocol are compared by metric. Lower metric wins.

Step 5: If all are equal, load balance (ECMP) Equal-cost multipath routes are installed and traffic is balanced across them.

Step 6: If no match, use default route If no specific route matches and a default route (0.0.0.0/0) exists, use it.

Step 7: If no match and no default, drop the packet Send ICMP Destination Unreachable back to the source.

Cisco Express Forwarding (CEF)

CEF is the default switching mechanism on modern Cisco routers and Layer 3 switches. It provides hardware-based forwarding for maximum performance.

CEF uses two tables:

FIB (Forwarding Information Base)

• Mirror of the routing table optimized for fast lookup
• Contains destination prefix, next-hop, and outgoing interface
• Updated automatically when the routing table changes

Adjacency Table

• Contains Layer 2 rewrite information (destination MAC, source MAC, VLAN tag)
• Pre-computed so the router doesn't need to do ARP for every packet
• Populated by ARP and other Layer 2 resolution protocols

Forwarding with CEF:

1. Packet arrives on an interface
2. Router looks up destination IP in the FIB (hardware-based, very fast)
3. FIB points to an entry in the adjacency table
4. Adjacency table provides the Layer 2 header for the outgoing frame
5. Router rewrites the frame header and forwards the packet

Equal-Cost Multipath (ECMP)

When a router has multiple routes to the same destination with equal metrics, it installs all of them and load balances traffic across the paths.

Router# show ip route 10.1.1.0
  10.1.1.0/24 [110/20] via 10.0.0.1, GigabitEthernet0/0
                [110/20] via 10.0.0.5, GigabitEthernet0/1

Both paths have OSPF AD 110 and cost 20, so the router distributes traffic across both interfaces. By default, OSPF supports up to 4 ECMP paths (configurable up to 32).

Packet Processing Summary

On the Exam: Remember the order: longest prefix match → AD → metric → ECMP. This decision hierarchy is tested frequently in scenario-based questions where you must determine which route a router will use.