# OSPF (Open Shortest Path First)

> Configure OSPF on VyOS: OSPF areas, neighbors, authentication, redistribution, link-state routing for Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/routing/vyos-ospf/


OSPF is a link-state routing protocol for IP networks that is widely used in enterprise networks.

## Overview

OSPF (RFC 2328 for OSPFv2, RFC 5340 for OSPFv3) is an Interior Gateway Protocol (IGP) that uses Dijkstra's algorithm.

**Characteristics**:
- Link-state protocol (every router has the full topology)
- Fast convergence
- Scalability through a hierarchical design (areas)
- VLSM and CIDR support
- Metric is cost (based on bandwidth)
- Multicast for updates (224.0.0.5, 224.0.0.6)

**Versions**:
- **OSPFv2** - for IPv4
- **OSPFv3** - for IPv6

**Use cases**:
- Enterprise campus networks
- Data center networking
- WAN between offices
- ISP backbone (combined with BGP)

**Advantages over RIP**:
- No hop count limit
- Fast convergence
- Bandwidth-based metric
- VLSM support
- Less update traffic

## OSPF Areas

OSPF uses a hierarchical design based on areas.

### Area 0 (Backbone)

**Area 0** is the mandatory backbone area that all other areas connect to.

**Rules**:
- All areas must connect to Area 0
- Area 0 must be contiguous
- Inter-area traffic passes through Area 0

### Router types

**Internal Router** - all interfaces are in a single area.

**Area Border Router (ABR)** - a router with interfaces in multiple areas (necessarily including Area 0).

**Autonomous System Boundary Router (ASBR)** - a router that redistributes external routes into OSPF.

**Backbone Router** - a router with an interface in Area 0.

### Area Types

**Normal Area** - a standard area that receives all types of LSA.

**Stub Area** - does not receive external LSA (Type 5) and uses a default route for external networks.

**Totally Stubby Area** - Cisco-specific; does not receive external or summary LSA.

**NSSA (Not-So-Stubby Area)** - like a Stub area, but allows importing external routes through Type 7 LSA.

**Totally NSSA** - a combination of NSSA and Totally Stubby.

## Basic configuration

### Simple OSPF network

**Router 1**:
```
set protocols ospf parameters router-id 10.0.0.1

set protocols ospf area 0 network 10.0.0.0/30
set protocols ospf area 0 network 192.168.1.0/24

commit
save
```

**Router 2**:
```
set protocols ospf parameters router-id 10.0.0.2

set protocols ospf area 0 network 10.0.0.0/30
set protocols ospf area 0 network 192.168.2.0/24

commit
save
```

### Verification

```
show ip ospf neighbor
show ip ospf route
show ip route ospf
```

## Router ID

A unique identifier of an OSPF router (in IPv4 address format).

```
set protocols ospf parameters router-id 10.0.0.1
commit
```

**Automatic selection** (if not configured):
1. The highest loopback interface IP
2. The highest IP of an active physical interface

**Recommendation**: Always configure the router-id explicitly.

**Best practice**: Use a loopback address:

```
set interfaces loopback lo address 10.255.255.1/32
set protocols ospf parameters router-id 10.255.255.1
commit
```

## Network Configuration

### Network Statement

Enable OSPF on networks:

```
set protocols ospf area 0 network 192.168.1.0/24
set protocols ospf area 0 network 10.0.0.0/8
commit
```

All interfaces with an IP from the specified networks will participate in OSPF.

### Interface-specific

Enable OSPF on a specific interface:

```
set protocols ospf interface eth1 area 0
set protocols ospf interface eth2 area 1
commit
```

More flexible than a network statement.

## Interface Parameters

### Cost

OSPF cost (metric) of an interface:

```
set protocols ospf interface eth1 cost 10
commit
```

**Default formula**: `cost = reference-bandwidth / interface-bandwidth`

Reference bandwidth (default 100 Mbps):
```
set protocols ospf auto-cost reference-bandwidth 1000
commit
```

**Recommended reference-bandwidth values**:
- **1000** for Gigabit networks
- **10000** for 10 Gigabit networks
- **100000** for 100 Gigabit networks

### Priority

Priority for DR/BDR (Designated Router) election:

```
set protocols ospf interface eth1 priority 100
commit
```

Values: 0-255 (default 1).
- **0** - the router does not participate in DR/BDR elections
- **Higher** - a greater chance of becoming DR

### Hello and Dead Intervals

Hello interval (seconds):
```
set protocols ospf interface eth1 hello-interval 10
commit
```

Dead interval (seconds):
```
set protocols ospf interface eth1 dead-interval 40
commit
```

Defaults:
- Hello: 10 seconds
- Dead: 40 seconds (4x hello)

**Important**: These must match between neighbors.

### Bandwidth

For a correct cost calculation:

```
set interfaces ethernet eth1 speed 1000
commit
```

Or set the bandwidth explicitly:
```
set protocols ospf interface eth1 bandwidth 1000
commit
```

### Network Type

OSPF network type:

```
set protocols ospf interface eth1 network point-to-point
commit
```

Types:
- **broadcast** - Ethernet (default)
- **point-to-point** - serial links, VPN tunnels
- **non-broadcast** - Frame Relay, X.25
- **point-to-multipoint** - partially meshed topologies

**Point-to-point** is recommended for VPN tunnels (it avoids DR/BDR elections).

## Authentication

Protecting OSPF from unauthorized routers.

### Plaintext Authentication

**Not recommended** (the password is in cleartext):

```
set protocols ospf interface eth1 authentication plaintext-password 'MyPassword'
commit
```

### MD5 Authentication

**Recommended**:

```
set protocols ospf interface eth1 authentication md5 key-id 1 md5-key 'SecurePassword123!'
commit
```

**key-id** - the key identifier (1-255), which enables smooth password rotation.

### Area-wide Authentication

For all interfaces in an area:

```
set protocols ospf area 0 authentication md5
commit
```

Then configure keys on each interface:

```
set protocols ospf interface eth1 authentication md5 key-id 1 md5-key 'Password!'
commit
```

## Passive Interface

The interface advertises its network but does not form adjacencies.

```
set protocols ospf interface eth2 passive
commit
```

Useful for:
- LAN interfaces with no other OSPF routers
- Preventing unauthorized OSPF neighbors

Make all interfaces passive by default:

```
set protocols ospf passive-interface default
commit
```

Then explicitly enable the ones you need:

```
set protocols ospf interface eth0 passive disable
set protocols ospf interface eth1 passive disable
commit
```

## Area Types Configuration

### Stub Area

Does not receive external routes (Type 5 LSA):

```
set protocols ospf area 1 area-type stub
commit
```

Configured on **all** routers in the area.

Default cost for a stub area:

```
set protocols ospf area 1 area-type stub default-cost 10
commit
```

### NSSA (Not-So-Stubby Area)

Allows importing external routes inside a stub area:

```
set protocols ospf area 2 area-type nssa
commit
```

Translate Type 7 LSA into Type 5:

```
set protocols ospf area 2 area-type nssa translate always
commit
```

Translate options:
- **candidate** - automatic translator election
- **always** - always translate
- **never** - never translate

### Totally Stubby / Totally NSSA

**Totally Stubby**:
```
set protocols ospf area 1 area-type stub no-summary
commit
```

**Totally NSSA**:
```
set protocols ospf area 2 area-type nssa no-summary
commit
```

`no-summary` blocks Type 3 LSA (inter-area routes).

## Route Redistribution

Importing routes from other sources.

### Redistribution Sources

Connected:
```
set protocols ospf redistribute connected
commit
```

Static:
```
set protocols ospf redistribute static
commit
```

BGP:
```
set protocols ospf redistribute bgp
commit
```

Kernel:
```
set protocols ospf redistribute kernel
commit
```

### Metric and Metric-Type

Set the metric:

```
set protocols ospf redistribute connected metric 100
commit
```

Metric type:

```
set protocols ospf redistribute connected metric-type 1
commit
```

Types:
- **Type 1 (E1)** - external cost + internal cost
- **Type 2 (E2)** - external cost only (default)

### Route-map for selective redistribution

```
set protocols ospf redistribute static route-map STATIC-TO-OSPF
commit
```

## Default Route

Advertising a default route into OSPF.

### Default Information Originate

```
set protocols ospf default-information originate
commit
```

Advertises the default route **only if** it exists in the routing table.

With the `always` parameter:

```
set protocols ospf default-information originate always
commit
```

Advertises it always, even if it is not in the routing table.

With a metric:

```
set protocols ospf default-information originate always metric 10 metric-type 1
commit
```

### Route-map for the default route

```
set protocols ospf default-information originate route-map DEFAULT-ROUTE
commit
```

## Area Range (Summarization)

Summarizing routes on an ABR.

```
set protocols ospf area 1 range 192.168.0.0/16
commit
```

The ABR advertises the summary prefix instead of more specific ones.

With cost:

```
set protocols ospf area 1 range 192.168.0.0/16 cost 100
commit
```

Not-advertise (suppress):

```
set protocols ospf area 1 range 192.168.0.0/16 not-advertise
commit
```

## Distance

Administrative distance for OSPF routes.

Global:
```
set protocols ospf distance global 110
commit
```

By route type:

```
set protocols ospf distance ospf intra-area 30
set protocols ospf distance ospf inter-area 110
set protocols ospf distance ospf external 150
commit
```

By default, all OSPF routes have a distance of 110.

## Timers

### SPF Throttle

Control the frequency of SPF calculation:

```
set protocols ospf timers throttle spf delay 200
set protocols ospf timers throttle spf initial-holdtime 1000
set protocols ospf timers throttle spf max-holdtime 10000
commit
```

Values are in milliseconds:
- **delay** - delay before the first SPF (0-600000 ms)
- **initial-holdtime** - initial delay between SPF runs (0-600000 ms)
- **max-holdtime** - maximum delay (0-600000 ms)

### LSA Timers

Control LSA generation:

```
set protocols ospf timers lsa min-arrival 1000
commit
```

Minimum interval between receiving identical LSA (milliseconds).

## Graceful Restart

Allows forwarding to continue while the OSPF process restarts.

```
set protocols ospf parameters graceful-restart
commit
```

Helper mode (helping neighbors during their restart):

```
set protocols ospf parameters graceful-restart helper enable
commit
```

Grace period:

```
set protocols ospf parameters graceful-restart grace-period 120
commit
```

## BFD Integration

Bidirectional Forwarding Detection for fast failure detection.

```
set protocols ospf interface eth1 bfd
commit
```

Configuring a BFD profile:

```
set protocols bfd profile ospf-peers interval transmit 300
set protocols bfd profile ospf-peers interval receive 300
set protocols bfd profile ospf-peers interval multiplier 3

set protocols ospf interface eth1 bfd profile ospf-peers

commit
```

BFD detects a failure in seconds vs. tens of seconds with the OSPF dead interval.

## Virtual Link

Connecting a non-backbone area to Area 0 through another area.

```
set protocols ospf area 1 virtual-link 10.0.0.2
commit
```

**10.0.0.2** - the router-id of the remote ABR.

With authentication:

```
set protocols ospf area 1 virtual-link 10.0.0.2 authentication md5 key-id 1 md5-key 'Secret!'
commit
```

## Logging

### Adjacency Changes

```
set protocols ospf log-adjacency-changes
commit
```

With details:

```
set protocols ospf log-adjacency-changes detail
commit
```

## Advanced Parameters

### Max Metric Router LSA

Announce the maximum metric (effectively "take out of service"):

Administrative:
```
set protocols ospf max-metric router-lsa administrative
commit
```

On startup (temporarily after boot):

```
set protocols ospf max-metric router-lsa on-startup 300
commit
```

For 300 seconds after boot, the router advertises the max metric.

On shutdown:

```
set protocols ospf max-metric router-lsa on-shutdown 60
commit
```

### ABR Type

Area Border Router behavior:

```
set protocols ospf parameters abr-type cisco
commit
```

Types:
- **cisco** - Cisco-compatible (default)
- **ibm** - IBM-compatible
- **standard** - RFC 2328
- **shortcut** - with virtual links

### RFC1583 Compatibility

Compatibility with older OSPF implementations:

```
set protocols ospf parameters rfc1583-compatibility
commit
```

## Configuration examples

### Simple point-to-point network

**HQ Router**:
```
set interfaces loopback lo address 10.255.255.1/32

set protocols ospf parameters router-id 10.255.255.1
set protocols ospf auto-cost reference-bandwidth 1000

set protocols ospf area 0 network 10.255.255.1/32
set protocols ospf area 0 network 10.0.0.0/30
set protocols ospf area 0 network 192.168.1.0/24

set protocols ospf interface eth1 network point-to-point
set protocols ospf interface eth1 authentication md5 key-id 1 md5-key 'SecureOSPF123!'

set protocols ospf interface eth2 passive

commit
save
```

**Branch Router**:
```
set interfaces loopback lo address 10.255.255.2/32

set protocols ospf parameters router-id 10.255.255.2
set protocols ospf auto-cost reference-bandwidth 1000

set protocols ospf area 0 network 10.255.255.2/32
set protocols ospf area 0 network 10.0.0.0/30
set protocols ospf area 0 network 192.168.2.0/24

set protocols ospf interface eth1 network point-to-point
set protocols ospf interface eth1 authentication md5 key-id 1 md5-key 'SecureOSPF123!'

set protocols ospf interface eth2 passive

commit
save
```

### Multi-area with an ABR

**Core ABR (Area 0 and Area 1)**:
```
set interfaces loopback lo address 10.255.255.1/32

set protocols ospf parameters router-id 10.255.255.1
set protocols ospf auto-cost reference-bandwidth 1000

# Area 0 (backbone)
set protocols ospf area 0 network 10.255.255.1/32
set protocols ospf area 0 network 10.0.0.0/24

# Area 1
set protocols ospf area 1 network 10.1.0.0/24

set protocols ospf interface eth1 authentication md5 key-id 1 md5-key 'Area0Pass!'
set protocols ospf interface eth2 authentication md5 key-id 1 md5-key 'Area1Pass!'

commit
save
```

**Area 1 Router**:
```
set interfaces loopback lo address 10.255.255.10/32

set protocols ospf parameters router-id 10.255.255.10
set protocols ospf auto-cost reference-bandwidth 1000

set protocols ospf area 1 network 10.255.255.10/32
set protocols ospf area 1 network 10.1.0.0/24
set protocols ospf area 1 network 192.168.10.0/24

set protocols ospf interface eth1 authentication md5 key-id 1 md5-key 'Area1Pass!'
set protocols ospf interface eth2 passive

commit
save
```

### Stub Area with a default route

**ABR**:
```
set protocols ospf area 1 area-type stub default-cost 10
commit
```

**Internal Router in the Stub Area**:
```
set protocols ospf area 1 area-type stub
set protocols ospf area 1 network 192.168.20.0/24
commit
```

The router receives a default route with cost 10 from the ABR.

### NSSA with redistribution

**ASBR in NSSA**:
```
set protocols ospf area 2 area-type nssa

set protocols ospf area 2 network 192.168.30.0/24

# Redistribute static routes
set protocols static route 203.0.113.0/24 blackhole
set protocols ospf redistribute static metric 20 metric-type 1

commit
save
```

**ABR for NSSA**:
```
set protocols ospf area 0 network 10.0.0.0/24
set protocols ospf area 2 area-type nssa translate always
set protocols ospf area 2 network 10.2.0.0/24

commit
save
```

### OSPF with BGP redistribution

**Edge Router**:
```
# OSPF internal
set protocols ospf parameters router-id 10.255.255.1
set protocols ospf area 0 network 10.0.0.0/8

# BGP for external
set protocols bgp system-as 65001
set protocols bgp neighbor 203.0.113.1 remote-as 65000
set protocols bgp address-family ipv4-unicast network 192.0.2.0/24

# Redistribute BGP into OSPF
set protocols ospf redistribute bgp metric 100 metric-type 2

# Redistribute OSPF into BGP (selective)
set protocols bgp address-family ipv4-unicast redistribute ospf route-map OSPF-TO-BGP

set policy route-map OSPF-TO-BGP rule 10 action permit
set policy route-map OSPF-TO-BGF rule 10 match ip address prefix-list INTERNAL-NETWORKS

set policy prefix-list INTERNAL-NETWORKS rule 10 action permit
set policy prefix-list INTERNAL-NETWORKS rule 10 prefix 10.0.0.0/8 le 24

commit
save
```

### OSPF over VPN (VTI)

**Site A**:
```
# VTI interface
set interfaces vti vti0 address 172.16.0.1/30

# OSPF over VTI
set protocols ospf parameters router-id 10.0.0.1
set protocols ospf interface vti0 area 0
set protocols ospf interface vti0 network point-to-point
set protocols ospf interface vti0 authentication md5 key-id 1 md5-key 'VPN-OSPF!'

set protocols ospf area 0 network 192.168.1.0/24
set protocols ospf interface eth1 passive

commit
save
```

**Site B**:
```
# VTI interface
set interfaces vti vti0 address 172.16.0.2/30

# OSPF over VTI
set protocols ospf parameters router-id 10.0.0.2
set protocols ospf interface vti0 area 0
set protocols ospf interface vti0 network point-to-point
set protocols ospf interface vti0 authentication md5 key-id 1 md5-key 'VPN-OSPF!'

set protocols ospf area 0 network 192.168.2.0/24
set protocols ospf interface eth1 passive

commit
save
```

## Operational commands

### OSPF Neighbors

```
show ip ospf neighbor
```

Output:
```
Neighbor ID     Pri State           Dead Time Address         Interface
10.0.0.2          1 Full/DR         00:00:35  10.0.0.2        eth1
```

Neighbor details:
```
show ip ospf neighbor detail
```

### OSPF Database

Link State Database:
```
show ip ospf database
```

Router LSA:
```
show ip ospf database router
```

Network LSA:
```
show ip ospf database network
```

Summary LSA:
```
show ip ospf database summary
```

External LSA:
```
show ip ospf database external
```

### OSPF Routes

```
show ip ospf route
```

Only OSPF routes in the routing table:
```
show ip route ospf
```

### OSPF Interface

```
show ip ospf interface
```

A specific interface:
```
show ip ospf interface eth1
```

### OSPF Border Routers

```
show ip ospf border-routers
```

### Clear OSPF Process

Restart OSPF:
```
restart ospf
```

## Troubleshooting

### Neighbor does not form

Check:

1. **IP connectivity**:
   ```
   ping <neighbor-ip>
   ```

2. **Subnet mask** matches

3. **Hello/Dead intervals** match:
   ```
   show ip ospf interface eth1
   ```

4. **Authentication** matches:
   ```
   show ip ospf interface eth1
   ```

5. **Area ID** matches

6. **Network type** matches (broadcast vs point-to-point)

7. **MTU** matches:
   ```
   show interfaces ethernet eth1
   ```

### Neighbor stuck in INIT/2WAY state

**INIT** - it receives Hello packets but does not see its own Router ID in the Hello from the neighbor.

**2WAY** - normal for broadcast networks when the router is neither DR nor BDR.

Check the Router ID:
```
show ip ospf
```

### Routes do not appear

Check:

1. **Neighbor is in the FULL state**:
   ```
   show ip ospf neighbor
   ```

2. **Database** contains the LSA:
   ```
   show ip ospf database
   ```

3. **ABR** between areas:
   ```
   show ip ospf border-routers
   ```

4. **Area configuration** is correct

5. **Stub/NSSA** are configured on all routers in the area

### High CPU usage

OSPF SPF calculation:

1. **Check for flapping** interfaces:
   ```
   show interfaces
   ```

2. **Tune SPF timers**:
   ```
   set protocols ospf timers throttle spf delay 1000
   set protocols ospf timers throttle spf initial-holdtime 5000
   set protocols ospf timers throttle spf max-holdtime 30000
   commit
   ```

3. **Use BFD** instead of short hello intervals

### Routing loops

Check:

1. **Area 0** is contiguous

2. **ABRs** are connected to Area 0

3. **Virtual links** are configured correctly (if needed)

4. **Route summarization** does not overlap

## Best practices

1. **Router ID** - always use loopback addresses
2. **Reference bandwidth** - configure it for Gigabit+ networks
3. **Authentication** - use MD5 on all interfaces
4. **Passive interfaces** - for LANs without OSPF neighbors
5. **Point-to-point** network type for VPN tunnels
6. **Area design**:
   - Area 0 - backbone
   - Area 1+ - edge/branch networks
   - Stub areas for leaf networks
7. **Summarization** on the ABR to reduce LSA
8. **BFD** for fast failover
9. **Timers** - do not change them unless necessary
10. **Monitoring** - track neighbor states

## Security

### Recommendations

1. **MD5 Authentication**:
   ```
   set protocols ospf interface eth1 authentication md5 key-id 1 md5-key 'StrongPassword!'
   ```

2. **Passive interfaces** for LANs:
   ```
   set protocols ospf interface eth2 passive
   ```

3. **Firewall** for OSPF traffic:
   ```
   set firewall ipv4 input filter rule 100 action accept
   set firewall ipv4 input filter rule 100 destination address 224.0.0.5
   set firewall ipv4 input filter rule 100 protocol ospf

   set firewall ipv4 input filter rule 101 action accept
   set firewall ipv4 input filter rule 101 destination address 224.0.0.6
   set firewall ipv4 input filter rule 101 protocol ospf
   ```

4. **Restrict the source** for OSPF packets:
   ```
   set firewall ipv4 input filter rule 100 source address 10.0.0.0/24
   ```

5. **Log adjacency changes**:
   ```
   set protocols ospf log-adjacency-changes detail
   ```

6. **Do not use plaintext** authentication

## Performance

### Optimization

1. **Reference bandwidth**:
   ```
   set protocols ospf auto-cost reference-bandwidth 10000
   ```

2. **SPF throttle timers** for unstable networks:
   ```
   set protocols ospf timers throttle spf delay 1000
   set protocols ospf timers throttle spf initial-holdtime 5000
   set protocols ospf timers throttle spf max-holdtime 30000
   ```

3. **Summarization** on the ABR:
   ```
   set protocols ospf area 1 range 192.168.0.0/16
   ```

4. **Stub areas** to reduce LSA:
   ```
   set protocols ospf area 1 area-type stub
   ```

5. **BFD** instead of short OSPF timers

## Comparison with other protocols

### OSPF vs RIP

| Characteristic | OSPF | RIP |
|---------------|------|-----|
| Type | Link-state | Distance-vector |
| Metric | Cost (bandwidth) | Hop count |
| Hop limit | None | 15 |
| Convergence | Fast | Slow |
| Scalability | High | Low |
| Complexity | Medium | Simple |
| VLSM | Yes | RIPv2 yes |

### OSPF vs BGP

**OSPF** - for internal routing (IGP).
**BGP** - for external routing (EGP).

They are often used together: OSPF for internal routing, BGP for ISP connectivity.

## Next steps

- [BGP](/docs/vyos/routing/vyos-bgp/) - for connecting to an ISP
- [Static Routes](/docs/vyos/routing/vyos-static/) - backup for OSPF
- [BFD](/docs/vyos/routing/vyos-bfd/) - fast failure detection
- [VTI Interfaces](/docs/vyos/interfaces/vyos-vti/) - OSPF over VPN