Routing Decisions, NAT, PAT, and FHRP Quick Reference for Network+ N10-009

Several routing terms can appear in the same question even though they answer different questions.

A route decides where a packet goes next. A routing protocol can help a router learn routes. Network Address Translation (NAT) changes address information. Port Address Translation (PAT) lets many sessions share an address by also distinguishing transport-layer identifiers. First Hop Redundancy Protocol (FHRP) protects the host's default-gateway function. A subinterface lets one physical interface support multiple logical Layer 3 interfaces.

1. Routing jobs at a glance

2. Route selection: start with the destination prefix

Forwarding begins with the destination IP address. The router compares that address with installed routes and uses the longest matching prefix.

Suppose the routing table contains:

10.0.0.0/8       via Router A
10.40.0.0/16     via Router B
10.40.8.0/24     via Router C
0.0.0.0/0        via Router D

Traffic for 10.40.8.25 matches all four entries, but /24 is the most specific match. Router C is the forwarding choice.

Traffic for 10.40.90.25 matches /8, /16, and the default route. The /16 entry is the most specific match, so Router B is used.

The default route is a fallback. It wins only when no more-specific installed route matches the destination.

3. Same-prefix route choices: source preference and metric

A different decision happens when multiple route sources offer the same prefix.

Many routing platforms use administrative distance to rank route sources. Lower administrative distance is preferred on platforms that use this value. This is a local trust decision about how the route was learned.

A metric ranks paths inside the relevant routing protocol or route source. Open Shortest Path First (OSPF), Enhanced Interior Gateway Routing Protocol (EIGRP), and Border Gateway Protocol (BGP) use different path-selection logic. Their metrics are not one shared number that you compare directly across protocols.

Keep the stages separate:

1. A routing process or configured static route offers reachability information.
2. When the same prefix competes from different sources, route-source preference can decide which route is installed.
3. Within a routing protocol, that protocol's metric or path-selection rules choose its preferred path.
4. When forwarding a packet, the router uses the longest matching installed prefix.

This distinction explains a common exam trap. Administrative distance does not make a /16 route override an installed /24 route for traffic that matches the /24.

4. Static and dynamic routing solve different operating problems

A static route is entered by an administrator or automation system. It is predictable and does not require a routing protocol exchange.

Static routing is a strong fit when:

• A small network has few stable paths.
• A destination should always use a defined next hop.
• A stub network has one practical exit.
• A backup route should remain unused until the preferred route disappears.

Dynamic routing is useful when routers need to exchange reachability and adapt to topology changes.

The tradeoff is not simply "static is easy, dynamic is better." Static routes reduce protocol complexity but require deliberate maintenance. Dynamic routing reacts to change but adds protocol state, neighbor relationships, timers, metrics, and troubleshooting evidence.

A routing table can contain both.

5. OSPF, EIGRP, and BGP: identify the scope before the protocol

Open Shortest Path First (OSPF) is a link-state interior routing protocol. Routers exchange topology information and calculate paths inside the routing domain. A Network+ scenario may point toward OSPF when internal routers need a dynamic protocol and topology changes should be learned without maintaining many static routes.

Enhanced Interior Gateway Routing Protocol (EIGRP) is commonly associated with Cisco environments. It exchanges routing information inside an organization and uses its own path-selection calculations.

Border Gateway Protocol (BGP) exchanges reachability between autonomous systems and is central to Internet routing. It can also appear in large enterprise or cloud designs where policy-based route exchange matters.

Do not choose BGP because the network is "large" without reading the boundary in the question. A large internal network can still use an interior routing protocol. BGP becomes the stronger clue when autonomous-system boundaries, external route exchange, or routing policy between administrative domains matters.

6. Default, host, network, and floating routes

A route can describe different scopes.

• A default route matches destinations that have no more-specific route. IPv4 commonly writes this as 0.0.0.0/0; IPv6 uses ::/0.
• A network route represents a destination prefix such as 192.0.2.0/24.
• A host route identifies one host with the most-specific ordinary host prefix, such as /32 for IPv4 or /128 for IPv6.
• A floating static route is configured with a weaker route-source preference than the primary path so it can act as a backup.

A floating static route should not replace a healthy preferred route. Its purpose is to become useful when the preferred route disappears or is no longer eligible.

The default route is also not automatically the backup route for every failure. A more-specific stale or incorrect route can continue to capture traffic and prevent the default from being used.

7. NAT and PAT change packet addressing, not route logic

Network Address Translation (NAT) changes IP address information as traffic crosses a translation point. A common use is translating between private internal IPv4 addresses and public addressing.

Port Address Translation (PAT) allows multiple internal sessions to share an external address by also translating transport-layer identifiers such as Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) ports.

That difference matters when many private hosts need simultaneous Internet access through one public IPv4 address. PAT can keep the sessions distinct because the translation table tracks more than the IP address.

Keep translation separate from routing:

• The router still needs a route toward the destination.
• The translated return traffic still needs a valid path back to the translation device.
• A correct route does not prove that translation is configured.
• A NAT or PAT entry does not prove that a firewall policy permits the session.

When internal communication works but Internet access fails for every private client, translation becomes one possible fault area. It is not the only one. The upstream route, default route, interface state, and security policy can create similar symptoms.

8. First-hop redundancy protects the default-gateway function

Hosts commonly use one default-gateway IP address. If that address belongs only to one physical router and the router fails, the hosts can lose off-subnet connectivity even when another router is available.

First Hop Redundancy Protocol (FHRP) designs solve that availability problem by presenting a resilient gateway function through a shared or virtual address. One router forwards for that virtual gateway according to the protocol state, and another can take over when needed.

Virtual Router Redundancy Protocol (VRRP) is one standards-based example.

FHRP does not replace a routing protocol. The routers still need usable routes beyond the first hop. It also does not make every path active at the same time or guarantee application availability beyond the gateway.

A strong FHRP clue is:

Hosts should keep the same configured default gateway when one gateway router fails.

That points toward first-hop redundancy rather than BGP, NAT, or a second static default gateway configured separately on every host.

9. Subinterfaces connect one physical router link to multiple logical Layer 3 networks

A subinterface divides one physical router interface into multiple logical Layer 3 interfaces. Router-on-a-stick is the familiar example: one physical link carries tagged traffic for several Virtual Local Area Networks (VLANs), and each router subinterface handles one VLAN's Layer 3 gateway function.

A subinterface is not the same thing as a switch virtual interface (SVI).

• A router subinterface is a logical interface under one physical router interface.
• An SVI is a logical Layer 3 interface associated with a VLAN on a multilayer switch.

Both can provide inter-VLAN routing, but the implementation and evidence differ.

If one VLAN fails through a router-on-a-stick design while other VLANs work, inspect the affected subinterface, VLAN tag, trunk allowance, gateway address, and related policy before blaming the physical link.

Use the VLANs, Trunks, STP, and Link Aggregation Quick Reference when the Layer 2 side of the path is the weak spot.

10. Symptoms and useful evidence

11. Scenario comparisons

A /24 route and a /16 route both match the destination

Use the /24 route if both routes are installed. The longer prefix is more specific. Do not choose the /16 because it came from a protocol with a lower administrative distance.

A static route and an OSPF route advertise the same prefix

Now route-source preference matters. On a platform that uses administrative distance, compare the route sources for that same prefix. Once the preferred route is installed, packet forwarding uses the installed routing table.

A branch needs a backup path only when the dynamic route disappears

Use a floating static route with a weaker preference than the primary route. A normal static route with stronger preference could replace the dynamic path even while the primary path is healthy.

Hundreds of private clients share one public IPv4 address

PAT is the stronger fit because transport-layer identifiers keep simultaneous sessions distinct. Ordinary routing alone does not provide the translation.

Hosts must retain one default-gateway address when a router fails

Use FHRP. The requirement is first-hop availability, not external route exchange.

Several VLANs reach a router through one physical Ethernet link

Use tagged VLAN transport plus router subinterfaces when the design is router-on-a-stick. A single untagged Layer 3 interface cannot independently serve several tagged VLAN gateways.

12. Common exam traps

• Comparing administrative distance before checking whether the competing routes describe the same prefix.
• Treating a default route as more important than a more-specific route.
• Comparing OSPF, EIGRP, and BGP metrics as though they share one common scale.
• Choosing BGP merely because the network is large.
• Treating NAT or PAT as a routing protocol.
• Treating PAT as another name for ordinary one-to-one address translation.
• Using FHRP to solve a missing route beyond the gateway.
• Confusing a router subinterface with a switch SVI.
• Assuming a route in the table proves the next hop, translation, or security policy works.

13. Rapid review grid

14. Official references

• CompTIA Network+ certification page
• RFC 4632: Classless Inter-domain Routing
• RFC 2328: OSPF Version 2
• RFC 4271: A Border Gateway Protocol 4
• RFC 7868: Cisco's Enhanced Interior Gateway Routing Protocol
• RFC 3022: Traditional IP Network Address Translator
• RFC 9568: Virtual Router Redundancy Protocol Version 3