Courseiva
RoutingGlobal Config

ip default-gateway [ip]

Sets the default gateway for a Cisco switch that is not configured with IP routing, allowing it to forward management traffic to remote networks.

Definition: ip default-gateway [ip] is a Cisco IOS global config command. Sets the default gateway for a Cisco switch that is not configured with IP routing, allowing it to forward management traffic to remote networks.

Overview

The `ip default-gateway` command is a fundamental configuration tool for Cisco switches that are operating as Layer 2 devices—meaning they do not have IP routing enabled. Its primary purpose is to provide a default gateway for the switch's own management traffic, such as Telnet, SSH, SNMP, or syslog messages, when the destination IP address is not on the same local subnet. Without a default gateway, a switch can only communicate with devices on its directly connected networks; any traffic destined for a remote network would be dropped because the switch has no routing table to determine the next hop.

This command essentially tells the switch: "If you don't know how to reach a destination, send the packet to this IP address." The networking concept behind this is the default route, often denoted as 0.0.0.0/0 in routing tables. On a router or a Layer 3 switch with IP routing enabled, you would use `ip route 0.0.0.0 0.0.0.0 [next-hop]` to achieve the same effect. However, on a pure Layer 2 switch (or a switch with IP routing disabled), the `ip default-gateway` command is the only way to set a default gateway.

This command is typically used in scenarios where the switch is managed out-of-band or in a small network where the switch does not need to route between VLANs. It is also common in lab environments or when a switch is used solely as an access layer device. In terms of workflow, you would configure this command after setting the management IP address (via `interface vlan 1` or a specific management VLAN interface) and before attempting to manage the switch from a remote network.

Important IOS behavior: The command takes effect immediately and is stored in the running configuration. It does not require a reload. The privilege level required is 15 (privileged EXEC mode) to enter global configuration mode.

The command is not available on routers or Layer 3 switches with IP routing enabled; on those devices, you must use `ip route 0.0.0.0 0.0.0.0`. Also, note that if you later enable IP routing on a switch (using `ip routing`), the `ip default-gateway` command is ignored in favor of the routing table. The command is simple but critical for remote management; forgetting to configure it is a common cause of management reachability issues.

Syntax·Global Config
ip default-gateway [ip]

When to Use This Command

  • Configuring a default gateway on a Layer 2 switch so it can be managed from a different subnet
  • Providing a fallback route for a router that does not have dynamic routing enabled and needs a static default route
  • Setting a default gateway on a device that only has a single exit path to the rest of the network
  • Ensuring management traffic (e.g., SNMP, SSH, syslog) can reach a network management station in a different subnet

Parameters

ParameterSyntaxDescription
ip-addressA.B.C.DThe IP address of the default gateway (next-hop router) in dotted decimal notation. This must be an address on a directly connected subnet of the switch. A common mistake is to use an IP address that is not reachable via the switch's management interface, or to omit the command entirely, resulting in the switch being unable to communicate with devices on other subnets.

Command Examples

Setting a default gateway on a Layer 2 switch

ip default-gateway 192.168.1.1

This command sets the default gateway to 192.168.1.1. No output is displayed upon successful configuration. Use 'show ip route' or 'show running-config' to verify.

Verifying the default gateway configuration

show ip route
Default gateway is 192.168.1.1
Host               Gateway           Last Updated
192.168.1.1        0.0.0.0          00:00:00

The output shows the configured default gateway. 'Host' is the gateway IP, 'Gateway' is the next-hop (0.0.0.0 means directly connected), and 'Last Updated' indicates when the entry was last refreshed.

Understanding the Output

The 'show ip route' command on a Layer 2 switch displays the default gateway under 'Default gateway is ...'. The table shows 'Host' (the gateway IP), 'Gateway' (the next-hop IP, usually 0.0.0.0 for a directly connected gateway), and 'Last Updated' (time since the entry was last updated). A missing or incorrect default gateway will show no entry or a wrong IP.

Ensure the gateway IP is reachable and that the switch has a management interface in the same subnet as the gateway.

Configuration Scenarios

Configure Default Gateway for a Layer 2 Switch in a Small Office

A small office has a single Layer 2 switch (Cisco Catalyst 2960) that needs to be managed remotely from a PC on a different subnet. The switch's management IP is 192.168.1.10/24, and the router's LAN interface is 192.168.1.1/24.

Topology

PC(10.0.0.2)---Router(10.0.0.1/24 & 192.168.1.1/24)---Switch(192.168.1.10/24)

Steps

  1. 1.Step 1: Enter privileged EXEC mode: Switch> enable
  2. 2.Step 2: Enter global configuration mode: Switch# configure terminal
  3. 3.Step 3: Configure the management interface (VLAN 1 by default): Switch(config)# interface vlan 1
  4. 4.Step 4: Set the IP address: Switch(config-if)# ip address 192.168.1.10 255.255.255.0
  5. 5.Step 5: Ensure the interface is up: Switch(config-if)# no shutdown
  6. 6.Step 6: Exit to global config: Switch(config-if)# exit
  7. 7.Step 7: Set the default gateway: Switch(config)# ip default-gateway 192.168.1.1
  8. 8.Step 8: Exit and save: Switch(config)# end; Switch# copy running-config startup-config
Configuration
! Full IOS config block
Switch> enable
Switch# configure terminal
Switch(config)# interface vlan 1
Switch(config-if)# ip address 192.168.1.10 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit
Switch(config)# ip default-gateway 192.168.1.1
Switch(config)# end
Switch# copy running-config startup-config

Verify: Use `show ip default-gateway` to verify the configured gateway. Expected output: 'Default gateway is 192.168.1.1'. Also, ping from the switch to the router: `ping 192.168.1.1` should succeed.

Watch out: A common mistake is to forget to configure the management interface IP address before setting the default gateway. The default gateway must be reachable via a directly connected interface; otherwise, the switch will not use it.

Configure Default Gateway for a Switch with Multiple VLANs (Management in VLAN 10)

A Layer 2 switch in a larger network has multiple VLANs, and the management interface is on VLAN 10. The switch needs to be managed from a remote network via a router that serves as the default gateway for VLAN 10.

Topology

Management PC(10.10.10.100)---Router(10.10.10.1/24 & 192.168.10.1/24)---Switch(VLAN 10: 192.168.10.10/24)

Steps

  1. 1.Step 1: Enter privileged EXEC mode: Switch> enable
  2. 2.Step 2: Enter global configuration mode: Switch# configure terminal
  3. 3.Step 3: Create VLAN 10 if not already present: Switch(config)# vlan 10
  4. 4.Step 4: Configure the management interface (SVI) for VLAN 10: Switch(config)# interface vlan 10
  5. 5.Step 5: Set the IP address: Switch(config-if)# ip address 192.168.10.10 255.255.255.0
  6. 6.Step 6: Ensure the interface is up: Switch(config-if)# no shutdown
  7. 7.Step 7: Exit to global config: Switch(config-if)# exit
  8. 8.Step 8: Set the default gateway: Switch(config)# ip default-gateway 192.168.10.1
  9. 9.Step 9: Exit and save: Switch(config)# end; Switch# copy running-config startup-config
Configuration
! Full IOS config block
Switch> enable
Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# exit
Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.10 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit
Switch(config)# ip default-gateway 192.168.10.1
Switch(config)# end
Switch# copy running-config startup-config

Verify: Use `show ip default-gateway` to verify. Also, `show ip interface brief` should show VLAN 10 as up/up. Ping the gateway: `ping 192.168.10.1`.

Watch out: Ensure that the management VLAN (VLAN 10) is allowed on the trunk link to the router. If the trunk does not carry VLAN 10, the switch cannot reach the default gateway even if configured correctly.

Troubleshooting with This Command

When troubleshooting management connectivity issues on a Layer 2 switch, the `ip default-gateway` command is often the first place to look. A healthy configuration shows a single default gateway IP address that is reachable via a directly connected interface. Use `show ip default-gateway` to display the configured gateway.

If the output shows 'Default gateway is not set', then the command is missing or has been removed. Another useful command is `show running-config | include ip default-gateway` to verify the configuration. If the gateway is set but the switch cannot ping remote hosts, check the following: First, ensure the management interface (e.g., VLAN 1 or a specific SVI) has an IP address and is up/up using `show ip interface brief`.

If the interface is down, check the physical connectivity and VLAN configuration. Second, verify that the default gateway IP is correct and that the switch can reach it via a direct ping: `ping [gateway-ip]`. If the ping fails, the gateway may be on a different subnet, or there may be a Layer 2 issue (e.g., VLAN mismatch, trunk not allowing the management VLAN).

Third, check the switch's ARP table with `show arp` to see if the gateway's MAC address is resolved. If the ARP entry is incomplete, the switch cannot send frames to the gateway. Fourth, consider that the switch may have IP routing enabled inadvertently.

Use `show ip route` to check for a routing table. If you see routes, especially a default route via `ip route 0.0.0.0 0.0.0.0`, then the `ip default-gateway` command is ignored. In that case, remove the static route or disable IP routing with `no ip routing`.

Also, note that the `ip default-gateway` command only affects traffic originated by the switch itself, not traffic being switched through the switch. For troubleshooting remote management, also check ACLs on the management interface or VTY lines that might block traffic. Common symptoms that this command helps diagnose include: inability to SSH or telnet to the switch from a remote subnet, SNMP traps not reaching the NMS, or syslog messages not being sent.

A step-by-step diagnostic flow: 1) Verify the management IP is configured and reachable from the local subnet. 2) Check `show ip default-gateway`. 3) Ping the gateway. 4) Check ARP. 5) Check for IP routing. 6) Verify VLAN and trunk configurations. Correlate with `debug ip packet` (carefully, as it can be CPU-intensive) to see if packets are being sent to the gateway.

CCNA Exam Tips

1.

CCNA exam tip: Remember that 'ip default-gateway' is used on Layer 2 switches, while 'ip route 0.0.0.0 0.0.0.0 [next-hop]' is used on routers and Layer 3 switches with IP routing enabled.

2.

CCNA exam tip: The command is configured in global configuration mode and does not require 'ip routing' to be enabled.

3.

CCNA exam tip: If a switch has multiple VLANs, the default gateway must be reachable from the management VLAN interface (SVI).

4.

CCNA exam tip: On a router, 'ip default-gateway' is ignored if 'ip routing' is enabled; use 'ip route 0.0.0.0 0.0.0.0' instead.

Common Mistakes

Mistake 1: Using 'ip default-gateway' on a router with IP routing enabled — the command is ignored; use 'ip route 0.0.0.0 0.0.0.0' instead.

Mistake 2: Forgetting to configure a management interface (SVI) in the same subnet as the default gateway — the switch cannot reach the gateway.

Mistake 3: Typing the wrong IP address or subnet mask — the command only takes an IP address, no mask.

ip default-gateway [ip] vs show ip route

Although 'ip default-gateway' and 'show ip route' both relate to routing in Cisco IOS, they serve fundamentally different purposes. The former sets a static default gateway for a switch operating in Layer 2 mode, while the latter displays the entire IP routing table on a device with IP routing enabled. They are often considered together when troubleshooting end-to-end connectivity or verifying that a default route exists in the routing table.

Aspectip default-gateway [ip]show ip route
ScopeSets default gateway for management traffic on L2 switchDisplays all routes in the IP routing table
Configuration ModeGlobal ConfigurationPrivileged EXEC
FunctionConfigures a gateway for non-routing switchesShows route sources, AD, metric, next-hop, interface
PersistencePersists in startup-config if savedOutput only; no configuration change
DependenciesEffective only when ip routing is disabledRequires ip routing enabled for non-default routes
Typical UseEnable management access to a remote networkVerify route presence and next-hop for troubleshooting

Use ip default-gateway [ip] when configuring a Layer 2 switch that needs to reach a management station on a different subnet and IP routing is not enabled.

Use show ip route when you need to examine the routing table to verify connectivity, check for a default route, or troubleshoot path selection on a router or multilayer switch.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 series), the `ip default-gateway` command behaves identically to classic IOS. The syntax and output are the same. However, on IOS-XE switches that support IP routing (like the Catalyst 9300), if you enable IP routing with `ip routing`, the default gateway is ignored and you must use `ip route 0.0.0.0 0.0.0.0` instead.

In NX-OS (e.g., Nexus switches), the equivalent command is `ip default-gateway` as well, but NX-OS uses a different configuration mode. On Nexus switches, you configure it under the management interface (mgmt0) using `ip default-gateway` in interface configuration mode. For example: `interface mgmt0; ip address 192.168.1.10/24; ip default-gateway 192.168.1.1`.

Note that NX-OS does not have a global `ip default-gateway` command; it is per-interface. On ASA firewalls, the equivalent is `route management 0.0.0.0 0.0.0.0 [gateway]` for management traffic. In IOS-XR (e.g., ASR 9000), the command does not exist; instead, you configure a default route using `router static` or `route` commands.

Behavior differences across IOS versions: In older IOS (12.x), the command is exactly the same. In 15.x and 16.x, there are no changes. The command is available on all Catalyst switches that operate as Layer 2 (e.g., 2960, 3560 with IP routing disabled).

On routers, the command is not available; you must use `ip route 0.0.0.0 0.0.0.0`. Always verify with `show ip default-gateway` on IOS; on NX-OS, use `show ip route` or `show running-config interface mgmt0`.

Related Commands

show ip route

Displays the IP routing table showing all known routes, their source protocols, administrative distances, metrics, next-hops, and outgoing interfaces.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions