Where to find itCanvas→Select a router or L3 switch→L3 tab→Routed interface→Sub-interfaces
Hang dot1q sub-interfaces off any routed parent — each with its own VLAN tag, IP/prefix, VRF, description, and admin state. The section only appears on roles that support them (routers, standalone Nexus and Arista L3 switches); Catalyst and Aruba switches use SVIs for inter-VLAN routing instead.
interface GigabitEthernet0/0/0.10
description Guest VLAN gateway
encapsulation dot1Q 10
vrf forwarding GUEST
ip address 10.0.10.1 255.255.255.0
no shutdown
Why
Sub-interfaces put several routed L3 networks on one physical link — router-on-a-stick for inter-VLAN routing on a router, or a tagged hand-off to a firewall/service device. Each tag is validated for range (1–4094) and uniqueness on its parent, and the editor is hidden on roles whose configs would never render it, so you cannot build something the device rejects.
Where to find itCanvas→Select an L3 device→L3 tab→Loopbacks
Create any number of loopbacks with full configuration: ID, description, IP (default /32), secondary address, VRF, OSPF participation, and shutdown state — rendered in each vendor's dialect.
interface Loopback0
description router-id
ip address 10.255.0.1 255.255.255.255
ip ospf 1 area 0
no shutdown
Why
A loopback never flaps — it is up as long as the device is. That makes it the right anchor for everything that must survive a link failure: the OSPF/BGP router-id, BGP update-source (iBGP sessions ride any available path), and the AAA/NTP/NetFlow source interfaces configured on the Management and Features tabs. The /32 convention advertises exactly one host route per device. Validation ties it together: duplicate loopback IPs are flagged design-wide, and any update-source/source-interface that names an undefined LoopbackN gets a warning before it ships.
Where to find itCanvas→Select an L3 switch→L3 tab→SVIs→First-Hop Redundancy
Each SVI can run HSRP or VRRP with full depth: group and priority, preempt with minimum/reload/sync delays, interface/object tracking with a decrement, hello and hold/dead timers, protocol version (HSRP v1/v2, VRRP v2/v3), a virtual MAC (HSRP), plain-text or MD5 authentication (MD5 is HSRP-only), and secondary virtual IPs.
Preempt with a delay lets a recovered primary reclaim the active role only after its routing table has converged, avoiding a black hole. Tracking with a decrement drops priority when an uplink fails so the standby takes over before traffic is stranded. The authentication key is a vault reference — the real value renders at generation, never stored in the design. Active/Standby (HSRP) and Master/Backup (VRRP) state and statistics are runtime — check them with show standby brief or show vrrp. IPv6 first-hop redundancy is planned alongside platform-wide IPv6 support.
OSPF: process ID, router-id, areas/networks, passive-interface default with an explicit no-passive interface list, default-information originate (conditional or always), and redistribution. EIGRP (Cisco IOS-XE and NX-OS): autonomous system, router-id, networks, passive/no-passive, redistribution — NX-OS gets feature eigrp plus interface-mode enrollment on routed ports and SVIs automatically. BGP: local AS, neighbors with update-source, eBGP multihop, BFD fall-over, per-neighbor default-originate, redistribution, and per-neighbor route-map and prefix-list policy bound from the Features tab.
passive-interface default stops hellos on every port except the ones you explicitly enable — no accidental adjacencies over user ports. default-information originate on the WAN edge means interior devices learntheir default route instead of carrying blind statics — when the edge loses its uplink, the default disappears with it and traffic fails over. BFD on eBGP gives sub-second failure detection where the default hold timer would take 180 seconds. Redistribution glues protocol domains together — an edge redistributing its static default into EIGRP serves the same purpose OSPF's DIO does.
Any static route can be tracked: an IP SLA probe pings a destination and the route stays installed only while the probe succeeds — automatic failover to a higher-metric backup.
ip sla 10
icmp-echo 8.8.8.8 source-interface Gi0/0/0
frequency 5
ip sla schedule 10 life forever start-time now
track 10 ip sla 10 reachability
ip route 10.200.0.0 255.255.0.0 10.200.100.1 5 track 10 name backup
Why
A plain floating static only fails over when the interface goes down — useless when the primary path dies upstream while your local link stays up. Tracking the route against an end-to-end probe fails over on real reachability. Validation enforces unique SLA ids and valid probe targets.