OSPF (Open Shortest Path First)

OSPF is a link-state routing protocol for IP networks that is widely used in enterprise networks.

Overview

OSPF (RFC 2328 for OSPFv2, RFC 5340 for OSPFv3) is an Interior Gateway Protocol (IGP) that uses Dijkstra’s algorithm.

Characteristics:

Link-state protocol (every router has the full topology)
Fast convergence
Scalability through a hierarchical design (areas)
VLSM and CIDR support
Metric is cost (based on bandwidth)
Multicast for updates (224.0.0.5, 224.0.0.6)

Versions:

OSPFv2 - for IPv4
OSPFv3 - for IPv6

Use cases:

Enterprise campus networks
Data center networking
WAN between offices
ISP backbone (combined with BGP)

Advantages over RIP:

No hop count limit
Fast convergence
Bandwidth-based metric
VLSM support
Less update traffic

OSPF Areas

OSPF uses a hierarchical design based on areas.

Area 0 (Backbone)

Area 0 is the mandatory backbone area that all other areas connect to.

Rules:

All areas must connect to Area 0
Area 0 must be contiguous
Inter-area traffic passes through Area 0

Router types

Internal Router - all interfaces are in a single area.

Area Border Router (ABR) - a router with interfaces in multiple areas (necessarily including Area 0).

Autonomous System Boundary Router (ASBR) - a router that redistributes external routes into OSPF.

Backbone Router - a router with an interface in Area 0.

Area Types

Normal Area - a standard area that receives all types of LSA.

Stub Area - does not receive external LSA (Type 5) and uses a default route for external networks.

Totally Stubby Area - Cisco-specific; does not receive external or summary LSA.

NSSA (Not-So-Stubby Area) - like a Stub area, but allows importing external routes through Type 7 LSA.

Totally NSSA - a combination of NSSA and Totally Stubby.

Basic configuration

Simple OSPF network

Router 1:

set protocols ospf parameters router-id 10.0.0.1

set protocols ospf area 0 network 10.0.0.0/30
set protocols ospf area 0 network 192.168.1.0/24

commit
save

Router 2:

set protocols ospf parameters router-id 10.0.0.2

set protocols ospf area 0 network 10.0.0.0/30
set protocols ospf area 0 network 192.168.2.0/24

commit
save

Verification

show ip ospf neighbor
show ip ospf route
show ip route ospf

Router ID

A unique identifier of an OSPF router (in IPv4 address format).

set protocols ospf parameters router-id 10.0.0.1
commit

Automatic selection (if not configured):

The highest loopback interface IP
The highest IP of an active physical interface

Recommendation: Always configure the router-id explicitly.

Best practice: Use a loopback address:

set interfaces loopback lo address 10.255.255.1/32
set protocols ospf parameters router-id 10.255.255.1
commit

Network Configuration

Network Statement

Enable OSPF on networks:

set protocols ospf area 0 network 192.168.1.0/24
set protocols ospf area 0 network 10.0.0.0/8
commit

All interfaces with an IP from the specified networks will participate in OSPF.

Interface-specific

Enable OSPF on a specific interface:

set protocols ospf interface eth1 area 0
set protocols ospf interface eth2 area 1
commit

More flexible than a network statement.

Interface Parameters

Cost

OSPF cost (metric) of an interface:

set protocols ospf interface eth1 cost 10
commit

Default formula: cost = reference-bandwidth / interface-bandwidth

Reference bandwidth (default 100 Mbps):

set protocols ospf auto-cost reference-bandwidth 1000
commit

Recommended reference-bandwidth values:

1000 for Gigabit networks
10000 for 10 Gigabit networks
100000 for 100 Gigabit networks

Priority

Priority for DR/BDR (Designated Router) election:

set protocols ospf interface eth1 priority 100
commit

Values: 0-255 (default 1).

0 - the router does not participate in DR/BDR elections
Higher - a greater chance of becoming DR

Hello and Dead Intervals

Hello interval (seconds):

set protocols ospf interface eth1 hello-interval 10
commit

Dead interval (seconds):

set protocols ospf interface eth1 dead-interval 40
commit

Defaults:

Hello: 10 seconds
Dead: 40 seconds (4x hello)

Important: These must match between neighbors.

Bandwidth

For a correct cost calculation:

set interfaces ethernet eth1 speed 1000
commit

Or set the bandwidth explicitly:

set protocols ospf interface eth1 bandwidth 1000
commit

Network Type

OSPF network type:

set protocols ospf interface eth1 network point-to-point
commit

Types:

broadcast - Ethernet (default)
point-to-point - serial links, VPN tunnels
non-broadcast - Frame Relay, X.25
point-to-multipoint - partially meshed topologies

Point-to-point is recommended for VPN tunnels (it avoids DR/BDR elections).

Authentication

Protecting OSPF from unauthorized routers.

Plaintext Authentication

Not recommended (the password is in cleartext):

set protocols ospf interface eth1 authentication plaintext-password 'MyPassword'
commit

MD5 Authentication

Recommended:

set protocols ospf interface eth1 authentication md5 key-id 1 md5-key 'SecurePassword123!'
commit

key-id - the key identifier (1-255), which enables smooth password rotation.

Area-wide Authentication

For all interfaces in an area:

set protocols ospf area 0 authentication md5
commit

Then configure keys on each interface:

set protocols ospf interface eth1 authentication md5 key-id 1 md5-key 'Password!'
commit

Passive Interface

The interface advertises its network but does not form adjacencies.

set protocols ospf interface eth2 passive
commit

Useful for:

LAN interfaces with no other OSPF routers
Preventing unauthorized OSPF neighbors

Make all interfaces passive by default:

set protocols ospf passive-interface default
commit

Then explicitly enable the ones you need:

set protocols ospf interface eth0 passive disable
set protocols ospf interface eth1 passive disable
commit

Area Types Configuration

Stub Area

Does not receive external routes (Type 5 LSA):

set protocols ospf area 1 area-type stub
commit

Configured on all routers in the area.

Default cost for a stub area:

set protocols ospf area 1 area-type stub default-cost 10
commit

NSSA (Not-So-Stubby Area)

Allows importing external routes inside a stub area:

set protocols ospf area 2 area-type nssa
commit

Translate Type 7 LSA into Type 5:

set protocols ospf area 2 area-type nssa translate always
commit

Translate options:

candidate - automatic translator election
always - always translate
never - never translate

Totally Stubby / Totally NSSA

Totally Stubby:

set protocols ospf area 1 area-type stub no-summary
commit

Totally NSSA:

set protocols ospf area 2 area-type nssa no-summary
commit

no-summary blocks Type 3 LSA (inter-area routes).

Route Redistribution

Importing routes from other sources.

Redistribution Sources

Connected:

set protocols ospf redistribute connected
commit

Static:

set protocols ospf redistribute static
commit

BGP:

set protocols ospf redistribute bgp
commit

Kernel:

set protocols ospf redistribute kernel
commit

Metric and Metric-Type

Set the metric:

set protocols ospf redistribute connected metric 100
commit

Metric type:

set protocols ospf redistribute connected metric-type 1
commit

Types:

Type 1 (E1) - external cost + internal cost
Type 2 (E2) - external cost only (default)

Route-map for selective redistribution

set protocols ospf redistribute static route-map STATIC-TO-OSPF
commit

Default Route

Advertising a default route into OSPF.

Default Information Originate

set protocols ospf default-information originate
commit

Advertises the default route only if it exists in the routing table.

With the always parameter:

set protocols ospf default-information originate always
commit

Advertises it always, even if it is not in the routing table.

With a metric:

set protocols ospf default-information originate always metric 10 metric-type 1
commit

Route-map for the default route

set protocols ospf default-information originate route-map DEFAULT-ROUTE
commit

Area Range (Summarization)

Summarizing routes on an ABR.

set protocols ospf area 1 range 192.168.0.0/16
commit

The ABR advertises the summary prefix instead of more specific ones.

With cost:

set protocols ospf area 1 range 192.168.0.0/16 cost 100
commit

Not-advertise (suppress):

set protocols ospf area 1 range 192.168.0.0/16 not-advertise
commit

Distance

Administrative distance for OSPF routes.

Global:

set protocols ospf distance global 110
commit

By route type:

set protocols ospf distance ospf intra-area 30
set protocols ospf distance ospf inter-area 110
set protocols ospf distance ospf external 150
commit

By default, all OSPF routes have a distance of 110.

Timers

SPF Throttle

Control the frequency of SPF calculation:

set protocols ospf timers throttle spf delay 200
set protocols ospf timers throttle spf initial-holdtime 1000
set protocols ospf timers throttle spf max-holdtime 10000
commit

Values are in milliseconds:

delay - delay before the first SPF (0-600000 ms)
initial-holdtime - initial delay between SPF runs (0-600000 ms)
max-holdtime - maximum delay (0-600000 ms)

LSA Timers

Control LSA generation:

set protocols ospf timers lsa min-arrival 1000
commit

Minimum interval between receiving identical LSA (milliseconds).

Graceful Restart

Allows forwarding to continue while the OSPF process restarts.

set protocols ospf parameters graceful-restart
commit

Helper mode (helping neighbors during their restart):

set protocols ospf parameters graceful-restart helper enable
commit

Grace period:

set protocols ospf parameters graceful-restart grace-period 120
commit

BFD Integration

Bidirectional Forwarding Detection for fast failure detection.

set protocols ospf interface eth1 bfd
commit

Configuring a BFD profile:

set protocols bfd profile ospf-peers interval transmit 300
set protocols bfd profile ospf-peers interval receive 300
set protocols bfd profile ospf-peers interval multiplier 3

set protocols ospf interface eth1 bfd profile ospf-peers

commit

BFD detects a failure in seconds vs. tens of seconds with the OSPF dead interval.

Virtual Link

Connecting a non-backbone area to Area 0 through another area.

set protocols ospf area 1 virtual-link 10.0.0.2
commit

10.0.0.2 - the router-id of the remote ABR.

With authentication:

set protocols ospf area 1 virtual-link 10.0.0.2 authentication md5 key-id 1 md5-key 'Secret!'
commit

Logging

Adjacency Changes

set protocols ospf log-adjacency-changes
commit

With details:

set protocols ospf log-adjacency-changes detail
commit

Advanced Parameters

Max Metric Router LSA

Announce the maximum metric (effectively “take out of service”):

Administrative:

set protocols ospf max-metric router-lsa administrative
commit

On startup (temporarily after boot):

set protocols ospf max-metric router-lsa on-startup 300
commit

For 300 seconds after boot, the router advertises the max metric.

On shutdown:

set protocols ospf max-metric router-lsa on-shutdown 60
commit

ABR Type

Area Border Router behavior:

set protocols ospf parameters abr-type cisco
commit

Types:

cisco - Cisco-compatible (default)
ibm - IBM-compatible
standard - RFC 2328
shortcut - with virtual links

RFC1583 Compatibility

Compatibility with older OSPF implementations:

set protocols ospf parameters rfc1583-compatibility
commit

Configuration examples

Simple point-to-point network

HQ Router:

set interfaces loopback lo address 10.255.255.1/32

set protocols ospf parameters router-id 10.255.255.1
set protocols ospf auto-cost reference-bandwidth 1000

set protocols ospf area 0 network 10.255.255.1/32
set protocols ospf area 0 network 10.0.0.0/30
set protocols ospf area 0 network 192.168.1.0/24

set protocols ospf interface eth1 network point-to-point
set protocols ospf interface eth1 authentication md5 key-id 1 md5-key 'SecureOSPF123!'

set protocols ospf interface eth2 passive

commit
save

Branch Router:

set interfaces loopback lo address 10.255.255.2/32

set protocols ospf parameters router-id 10.255.255.2
set protocols ospf auto-cost reference-bandwidth 1000

set protocols ospf area 0 network 10.255.255.2/32
set protocols ospf area 0 network 10.0.0.0/30
set protocols ospf area 0 network 192.168.2.0/24

set protocols ospf interface eth1 network point-to-point
set protocols ospf interface eth1 authentication md5 key-id 1 md5-key 'SecureOSPF123!'

set protocols ospf interface eth2 passive

commit
save

Multi-area with an ABR

Core ABR (Area 0 and Area 1):

set interfaces loopback lo address 10.255.255.1/32

set protocols ospf parameters router-id 10.255.255.1
set protocols ospf auto-cost reference-bandwidth 1000

# Area 0 (backbone)
set protocols ospf area 0 network 10.255.255.1/32
set protocols ospf area 0 network 10.0.0.0/24

# Area 1
set protocols ospf area 1 network 10.1.0.0/24

set protocols ospf interface eth1 authentication md5 key-id 1 md5-key 'Area0Pass!'
set protocols ospf interface eth2 authentication md5 key-id 1 md5-key 'Area1Pass!'

commit
save

Area 1 Router:

set interfaces loopback lo address 10.255.255.10/32

set protocols ospf parameters router-id 10.255.255.10
set protocols ospf auto-cost reference-bandwidth 1000

set protocols ospf area 1 network 10.255.255.10/32
set protocols ospf area 1 network 10.1.0.0/24
set protocols ospf area 1 network 192.168.10.0/24

set protocols ospf interface eth1 authentication md5 key-id 1 md5-key 'Area1Pass!'
set protocols ospf interface eth2 passive

commit
save

Stub Area with a default route

ABR:

set protocols ospf area 1 area-type stub default-cost 10
commit

Internal Router in the Stub Area:

set protocols ospf area 1 area-type stub
set protocols ospf area 1 network 192.168.20.0/24
commit

The router receives a default route with cost 10 from the ABR.

NSSA with redistribution

ASBR in NSSA:

set protocols ospf area 2 area-type nssa

set protocols ospf area 2 network 192.168.30.0/24

# Redistribute static routes
set protocols static route 203.0.113.0/24 blackhole
set protocols ospf redistribute static metric 20 metric-type 1

commit
save

ABR for NSSA:

set protocols ospf area 0 network 10.0.0.0/24
set protocols ospf area 2 area-type nssa translate always
set protocols ospf area 2 network 10.2.0.0/24

commit
save

OSPF with BGP redistribution

Edge Router:

# OSPF internal
set protocols ospf parameters router-id 10.255.255.1
set protocols ospf area 0 network 10.0.0.0/8

# BGP for external
set protocols bgp system-as 65001
set protocols bgp neighbor 203.0.113.1 remote-as 65000
set protocols bgp address-family ipv4-unicast network 192.0.2.0/24

# Redistribute BGP into OSPF
set protocols ospf redistribute bgp metric 100 metric-type 2

# Redistribute OSPF into BGP (selective)
set protocols bgp address-family ipv4-unicast redistribute ospf route-map OSPF-TO-BGP

set policy route-map OSPF-TO-BGP rule 10 action permit
set policy route-map OSPF-TO-BGF rule 10 match ip address prefix-list INTERNAL-NETWORKS

set policy prefix-list INTERNAL-NETWORKS rule 10 action permit
set policy prefix-list INTERNAL-NETWORKS rule 10 prefix 10.0.0.0/8 le 24

commit
save

OSPF over VPN (VTI)

Site A:

# VTI interface
set interfaces vti vti0 address 172.16.0.1/30

# OSPF over VTI
set protocols ospf parameters router-id 10.0.0.1
set protocols ospf interface vti0 area 0
set protocols ospf interface vti0 network point-to-point
set protocols ospf interface vti0 authentication md5 key-id 1 md5-key 'VPN-OSPF!'

set protocols ospf area 0 network 192.168.1.0/24
set protocols ospf interface eth1 passive

commit
save

Site B:

# VTI interface
set interfaces vti vti0 address 172.16.0.2/30

# OSPF over VTI
set protocols ospf parameters router-id 10.0.0.2
set protocols ospf interface vti0 area 0
set protocols ospf interface vti0 network point-to-point
set protocols ospf interface vti0 authentication md5 key-id 1 md5-key 'VPN-OSPF!'

set protocols ospf area 0 network 192.168.2.0/24
set protocols ospf interface eth1 passive

commit
save

Operational commands

OSPF Neighbors

show ip ospf neighbor

Output:

Neighbor ID     Pri State           Dead Time Address         Interface
10.0.0.2          1 Full/DR         00:00:35  10.0.0.2        eth1

Neighbor details:

show ip ospf neighbor detail

OSPF Database

Link State Database:

show ip ospf database

Router LSA:

show ip ospf database router

Network LSA:

show ip ospf database network

Summary LSA:

show ip ospf database summary

External LSA:

show ip ospf database external

OSPF Routes

show ip ospf route

Only OSPF routes in the routing table:

show ip route ospf

OSPF Interface

show ip ospf interface

A specific interface:

show ip ospf interface eth1

OSPF Border Routers

show ip ospf border-routers

Clear OSPF Process

Restart OSPF:

restart ospf

Troubleshooting

Neighbor does not form

Check:

IP connectivity:
```
ping <neighbor-ip>
```
Subnet mask matches
Hello/Dead intervals match:
```
show ip ospf interface eth1
```
Authentication matches:
```
show ip ospf interface eth1
```
Area ID matches
Network type matches (broadcast vs point-to-point)
MTU matches:
```
show interfaces ethernet eth1
```

Neighbor stuck in INIT/2WAY state

INIT - it receives Hello packets but does not see its own Router ID in the Hello from the neighbor.

2WAY - normal for broadcast networks when the router is neither DR nor BDR.

Check the Router ID:

show ip ospf

Routes do not appear

Check:

Neighbor is in the FULL state:
```
show ip ospf neighbor
```
Database contains the LSA:
```
show ip ospf database
```
ABR between areas:
```
show ip ospf border-routers
```
Area configuration is correct
Stub/NSSA are configured on all routers in the area

High CPU usage

OSPF SPF calculation:

Check for flapping interfaces:
```
show interfaces
```

Tune SPF timers:

set protocols ospf timers throttle spf delay 1000
set protocols ospf timers throttle spf initial-holdtime 5000
set protocols ospf timers throttle spf max-holdtime 30000
commit

Use BFD instead of short hello intervals

Routing loops

Check:

Area 0 is contiguous
ABRs are connected to Area 0
Virtual links are configured correctly (if needed)
Route summarization does not overlap

Best practices

Router ID - always use loopback addresses
Reference bandwidth - configure it for Gigabit+ networks
Authentication - use MD5 on all interfaces
Passive interfaces - for LANs without OSPF neighbors
Point-to-point network type for VPN tunnels
Area design:
- Area 0 - backbone
- Area 1+ - edge/branch networks
- Stub areas for leaf networks
Summarization on the ABR to reduce LSA
BFD for fast failover
Timers - do not change them unless necessary
Monitoring - track neighbor states

Security

Recommendations

MD5 Authentication:

set protocols ospf interface eth1 authentication md5 key-id 1 md5-key 'StrongPassword!'

Passive interfaces for LANs:

set protocols ospf interface eth2 passive

Firewall for OSPF traffic:

set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 destination address 224.0.0.5
set firewall ipv4 input filter rule 100 protocol ospf

set firewall ipv4 input filter rule 101 action accept
set firewall ipv4 input filter rule 101 destination address 224.0.0.6
set firewall ipv4 input filter rule 101 protocol ospf

Restrict the source for OSPF packets:

set firewall ipv4 input filter rule 100 source address 10.0.0.0/24

Log adjacency changes:

set protocols ospf log-adjacency-changes detail

Do not use plaintext authentication

Performance

Optimization

Reference bandwidth:

set protocols ospf auto-cost reference-bandwidth 10000

SPF throttle timers for unstable networks:

set protocols ospf timers throttle spf delay 1000
set protocols ospf timers throttle spf initial-holdtime 5000
set protocols ospf timers throttle spf max-holdtime 30000

Summarization on the ABR:

set protocols ospf area 1 range 192.168.0.0/16

Stub areas to reduce LSA:

set protocols ospf area 1 area-type stub

BFD instead of short OSPF timers

Comparison with other protocols

OSPF vs RIP

Characteristic	OSPF	RIP
Type	Link-state	Distance-vector
Metric	Cost (bandwidth)	Hop count
Hop limit	None	15
Convergence	Fast	Slow
Scalability	High	Low
Complexity	Medium	Simple
VLSM	Yes	RIPv2 yes

OSPF vs BGP

OSPF - for internal routing (IGP). BGP - for external routing (EGP).

They are often used together: OSPF for internal routing, BGP for ISP connectivity.

Next steps

BGP - for connecting to an ISP
Static Routes - backup for OSPF
BFD - fast failure detection
VTI Interfaces - OSPF over VPN

Reviewed by OpenNix LLC · Last updated on 29 July 2026

BGP (Border Gateway Protocol)DHCP Server