Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Training Camp • Cybersecurity Glossary
A backup static route set with a higher administrative distance than the primary, activating only when the preferred route fails to provide failover.
Floating Static Route Definition: A backup static route set with a higher administrative distance than the primary, activating only when the preferred route fails to provide failover.
A floating static route is a backup static route configured with a higher administrative distance (AD) than the primary route to the same destination. Because routers prefer the route with the lower AD, the floating route stays inactive and "floats" out of the routing table until the primary route fails, at which point it is installed and provides automatic failover.
Administrative distance is the trustworthiness ranking a router uses to choose between routes from different sources; a standard static route defaults to an AD of 1. To create a floating static route, an administrator configures a second static route to the same network with a deliberately higher AD, for example 200, so it is less preferred. While the primary path is up, only the primary route appears in the routing table. If the primary route is withdrawn, because the next hop becomes unreachable or a tracked object goes down, the router promotes the floating route and forwards traffic over the backup path.
For security and resilience, floating static routes support availability by ensuring connectivity survives the loss of a primary link without dynamic routing complexity. They are commonly used to back up a primary WAN or VPN link with a secondary connection, or to provide a backup to a dynamic routing protocol. Because they are simple and predictable, they reduce the attack and misconfiguration surface compared with full dynamic routing, though they rely on accurate failure detection (often paired with IP SLA tracking) to fail over reliably.
For example, a branch router uses a primary MPLS circuit as its default path with an AD of 1 and configures a floating static default route over a backup internet VPN tunnel with an AD of 200. Under normal conditions all traffic flows over MPLS. When the MPLS circuit fails and its route disappears, the router installs the floating static route, and traffic shifts seamlessly to the VPN tunnel, maintaining connectivity until the primary link is restored.
Turn knowledge into credentials with our instructor-led cybersecurity boot camps.
View All Courses →