Administrative Distance: The Complete Table and Why It Matters

When a router learns the same destination from two different routing protocols, it cannot install both. It has to pick a winner, and it does not use the metric to decide, because metrics from different protocols are not comparable (an OSPF cost of 20 and an EIGRP metric of 307200 measure completely different things). Instead the router uses administrative distance: a fixed number that ranks how much it trusts each source of routing information. Lower is more trusted. Understanding AD is the difference between predicting exactly which path a router will take and being surprised by an outage. This article gives you the full table and then proves the behavior on a live Cisco IOS XE lab. It is part of the IP Routing complete guide.

What administrative distance actually is

Administrative distance (AD) is a per-route-source trust value between 0 and 255. It is local to the router; it is never advertised to neighbors and never leaves the box. When two sources offer a route to the same prefix with the same prefix length, the router installs the one with the lower AD and ignores the other (though it keeps it in the background in case the winner disappears). AD is compared only after longest prefix match has already been decided, a subtlety covered in longest prefix match. Within a single protocol, AD is irrelevant and the metric breaks the tie.

The complete administrative distance table

These are the default values on Cisco IOS and IOS XE. Memorize the common ones (0, 1, 90, 110, 120, and the two BGP values); they come up constantly in design and on the exam.

Two entries deserve a note. eBGP at 20 is deliberately lower than every IGP so that a router prefers a route learned from an external AS over its own internal routing, which is what you want at an internet edge. iBGP at 200 is deliberately higher than every IGP so internal routes win inside your network. And 255 is not "the worst route," it is "do not install this route at all," which is how route filtering via distance works under the hood.

Watching AD choose a winner, live

On router R1, the subnet 10.0.20.0/24 is reachable through both EIGRP and OSPF. Ask which one the router installed:

R1#show ip route 10.0.20.0 255.255.255.0
Routing entry for 10.0.20.0/24
  Known via "eigrp 100", distance 90, metric 307200, precedence routine (0), type internal
  Redistributing via eigrp 100
  Last update from 10.0.12.2 on Ethernet0/1, 00:07:48 ago
  Routing Descriptor Blocks:
  * 10.0.12.2, from 10.0.12.2, 00:07:48 ago, via Ethernet0/1
      Route metric is 307200, traffic share count is 1
      Total delay is 2000 microseconds, minimum bandwidth is 10000 Kbit
      Reliability 255/255, minimum MTU 1500 bytes
      Loading 1/255, Hops 1

EIGRP won, because its AD of 90 is lower than OSPF's 110. The router installed the EIGRP path and the OSPF version sits idle in the OSPF database, never making it into the table. The distance 90 in the output is the AD; the metric 307200 is EIGRP's composite metric, which only matters for comparing EIGRP paths against other EIGRP paths.

The failover: what happens when the winner disappears

Here is where AD earns its keep. Shut down EIGRP on R1 and immediately re-check the same prefix:

R1(config)#router eigrp 100
R1(config-router)#shutdown

R1#show ip route 10.0.20.0 255.255.255.0
Routing entry for 10.0.20.0/24
  Known via "ospf 1", distance 110, metric 20, type intra area
  Last update from 10.0.12.2 on Ethernet0/1, 00:00:12 ago
  Routing Descriptor Blocks:
  * 10.0.12.2, from 2.2.2.2, 00:00:12 ago, via Ethernet0/1
      Route metric is 20, traffic share count is 1

The moment EIGRP went away, OSPF's route (which had been waiting in the wings all along) dropped into the table. The distance flipped from 90 to 110 and the Last update timer reset to 00:00:12, showing the route is freshly installed. This is the entire point of running (or having available) a backup source: AD gives you a deterministic, instant fallback order. No packet loss beyond the convergence time, and no manual intervention.

Internal vs external distance in one protocol

Some protocols carry two AD values. EIGRP is the clearest example. Ask the protocol directly:

R1#show ip protocols | section eigrp
Routing Protocol is "eigrp 100"
  EIGRP-IPv4 Protocol for AS(100)
    Metric weight K1=1, K2=0, K3=1, K4=0, K5=0
    Router-ID: 1.1.1.1
    Topology : 0 (base)
      Distance: internal 90 external 170

The line Distance: internal 90 external 170 tells you that routes EIGRP learned natively (from another EIGRP router) get AD 90, but routes redistributed into EIGRP from some other protocol get AD 170. The higher external distance is a safety feature: it makes the router prefer a natively learned path over a redistributed one, which reduces the chance of a redistribution loop. OSPF has an analogous internal/external split, and BGP has its 20/200 external/internal pair.

Changing administrative distance (and when you should)

You can override the default AD, but do it deliberately. The two common cases are:

• Floating static routes. Give a static route a higher AD than a dynamic protocol so it only installs when the dynamic route fails. A static with AD 250 sits below OSPF's 110, so OSPF wins until it disappears. This is the backbone of static backup design and is walked through in static routing on Cisco IOS XE.
• Migration and preference. During a protocol migration you might raise or lower a protocol's distance so the network prefers the new one while both run in parallel. Use distance under the routing process, and change it on every router consistently, because AD is local and an inconsistent change causes routing loops.

The trap to avoid: because AD is per-router, if you lower a static route's distance on one router to force a path but forget the return path on the far end, you create asymmetric routing or a loop. Always reason about AD changes from both directions.

AD is per-route, not per-protocol-globally

A subtle point that trips up even experienced engineers: administrative distance is evaluated per prefix, not once for the whole protocol. OSPF does not "lose to EIGRP" across your entire network. For each individual destination, the router compares only the sources that actually offered that prefix. So it is entirely normal to have one router where some prefixes are EIGRP (because only EIGRP advertised them), others are OSPF, and others are static, all coexisting. The show ip route summary output makes this concrete: it counts how many networks each source contributed, and those numbers add up to the whole table precisely because each prefix was won independently.

This also explains why redistribution is dangerous. When you redistribute OSPF into EIGRP and EIGRP back into OSPF, a prefix can arrive at a router from two directions with different ADs, and if you have not planned the distances carefully the router may prefer the redistributed copy over the native one, creating a loop. The internal/external AD split (90 versus 170 for EIGRP) exists specifically to bias routers toward native routes and reduce this risk, but it is not a complete safeguard; on any network with mutual redistribution you should map the AD of every path a prefix can take.

Metric versus administrative distance: do not confuse them

The two numbers in the routing-table bracket [110/20] get mixed up constantly, so nail the distinction:

An OSPF cost of 20 and an EIGRP metric of 307200 are not on the same scale and are never compared to each other. That incomparability is the entire reason administrative distance exists: without it, the router would have no consistent way to choose between an OSPF route and an EIGRP route to the same place.

Key takeaways

Administrative distance is the tie-breaker between routing sources, applied after longest prefix match and before metric. Lower wins: connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, RIP 120, external EIGRP 170, iBGP 200, and 255 meaning "never install." When two protocols offer the same prefix the lower-AD source is installed and the other waits as a hot standby, which is exactly what gives you deterministic sub-second failover. Read the winning source and its distance straight off show ip route <destination>, and reach for a floating static (a high-AD static) whenever you want a manual backup path. For how these routes then get chosen and forwarded, continue with the IP Routing complete guide.