No Gateway of Last Resort
A router reaches every internal subnet and nothing at all beyond them. Diagnose the missing gateway of last resort and fix it yourself, live, right below.
Symptom
Every internal subnet is reachable and nothing at all on the internet is. The ISP link is up and pings fine, and the router is doing exactly what it was told to do.
Your mission
Prove the cause, then fix it
Format
Guided CLI investigation
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: R1
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
LAN clients on 192.168.20.0/24 can reach the router and every internal subnet, and cannot reach anything on the internet. The ISP link on Gi0/0 is up, the ISP next hop answers ping, and both interfaces are healthy.
What you'll practice
- Read the gateway of last resort line before anything else
- Understand why a router drops traffic it has no route for
- Configure a default route with a correct next hop
- Recognise the S* code and know why the exit-interface form is discouraged
1. The first line of show ip route
Gateway of last resort is not set answers the entire question in one line, before you read a single route entry. You will learn to look there first whenever the complaint is that internal works and external does not.
2. A router is not guessing on your behalf
There is no implicit fallback path. Anything the routing table cannot match is dropped, and no error is logged that a user would ever see. That is why this fault presents as silence rather than as an error message.
3. Next hop, not exit interface
You will try pointing the default route at an interface instead of an address and learn why that is discouraged on a multi-access link: the router ends up ARPing for every destination on the internet rather than sending everything to one router.
The topology
R1 has a LAN on Gi0/1 at 192.168.20.1/24 and an ISP link on Gi0/0 at 198.51.100.2/30, with the ISP next hop at 198.51.100.1.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show ip routeshow ip route 8.8.8.8ping 198.51.100.1Topology diagram
Frequently asked
The ISP link pings fine, so why is nothing reaching the internet?
Because reaching the next hop and having a route to a destination are different things. Ping to 198.51.100.1 succeeds because that address is on a directly connected subnet the router already knows about. Anything beyond it needs a route, and without a default route the router has nothing to match, so it drops the packet.
What does the asterisk in S* mean?
It marks the route as a candidate default, which is what makes it the gateway of last resort. You can see the code explained in the legend at the top of show ip route as * - candidate default. Seeing S* rather than plain S is the confirmation that your static route is genuinely acting as the default.
Why point the default route at an address rather than the interface?
On a multi-access link such as Ethernet, an exit-interface default route makes the router treat every internet destination as directly connected, so it ARPs for each one and relies on the ISP router answering with proxy ARP. It often works and it scales badly, filling the ARP table and adding latency. A next-hop address tells the router to send everything to one place, which is what you actually want.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.