CCIE ENTERPRISE INFRASTRUCTURE · RESILIENT ARCHITECTURE

Enterprise Routing & Resilient

Network Architecture

Module 5

OSPF (OSPFv2 & OSPFv3)

Programme Enterprise Routing & Resilient Network Architecture (ERRNA)

Target cert CCIE Enterprise Infrastructure v1.1 (lab) + CCNP ENCOR 350-401

Primary platform Cisco IOS XE — with IOS XR, NX-OS, FRRouting, VyOS, Linux, AWS, Azure, GCP

Format Module of a multi-module professional course manual

Consistency contract: device names, addressing, ASNs, areas, zones, communities and route tags are fixed in
Module 1 and reused unchanged across all modules.
 Module 5 — OSPF (OSPFv2 & OSPFv3)

Continuity. OSPF is the data-centre and backbone IGP in the reference design (Module 1 §8.1–8.2):
process 1, Area 0 backbone across PRD-CORE / DRS-CORE , Area 10 (production DC, totally stubby),
Area 20 (campus aggregation, NSSA — where EIGRP redistributes in), Area 30 (DR DC, totally
stubby). Loopbacks/router-IDs from 10.255.x . This module builds OSPF on exactly that footprint.
Blueprint: OSPF is core Domain 1.0 and the deepest single IGP topic on the exam. It is link-
state: every router in an area builds an identical map of the topology and runs SPF (Dijkstra)
locally — a fundamentally different model from RIP/EIGRP's "learn metrics from neighbours."

Platform: Cisco IOS XE primary; IOS XR/NX-OS/FRR/VyOS equivalents in §5.22. No invented commands.

Table of Contents — Module 5

1. Objectives and lab topology
2. Link-state vs distance-vector; the LSDB and SPF
3. OSPF packet types and neighbour states
4. Router-ID, DR/BDR election, interface priority
5. Network types and the timers they imply
6. Cost and reference bandwidth
7. Areas and the LSA types
8. Special areas: stub, totally stubby, NSSA, totally NSSA
9. ABR/ASBR, external routes (E1/E2/N1/N2), forwarding address
10. Baseline configuration and command breakdown
11. Summarization and default-route advertisement
12. Route filtering, distribute-lists, prefix suppression
13. Virtual links
14. Authentication
15. OSPFv3 (IPv6 and address families)
16. Redistribution, BFD, graceful restart
17. Verification and representative output
18. Common failures and systematic troubleshooting
19. Cross-platform quick reference
20. Guided labs 5A–5N
21. Challenges (config / troubleshooting / design)
22. Review questions
23. Module close-out
24. Module 5 Answer Key (separated)

1. Objectives and lab topology

1.1 By the end of Module 5 you can
• Explain link-state operation, the LSDB, and the SPF (Dijkstra) calculation.
• Walk the neighbour state machine (Down → … → Full) and diagnose where it stalls.
• Drive DR/BDR election with priority and router-ID; know where DR/BDR do and don't exist.
• Match network types and the hello/dead timers they imply.

Enterprise Routing & Resilient Network Architecture Module 5 · Page 2

 • Design areas (Area 0 + standard/stub/totally-stubby/NSSA/totally-NSSA) and predict which LSA types
appear in each.
• Configure summarization (inter-area and external), default origination, filtering and virtual links.
• Run OSPFv3 for IPv6 (and address-family mode), authentication, BFD and redistribution.
• Troubleshoot the classic adjacency killers: area/network-type/timer/auth/MTU mismatch, duplicate RID,
stuck ExStart/Exchange.

1.2 Lab topology — the OSPF backbone + DC areas

Why this design teaches every area type: Area 0 is the mandatory backbone; Area 10/30 are
totally stubby (DCs need only a default out); Area 20 is NSSA because the campus EIGRP
redistribution makes CAM-CORE an ASBR inside a stubby-style area (only NSSA permits that). PRD-EDGE is
an ASBR injecting the BGP/Internet default. This single topology exercises ABR, ASBR, stub, totally-
stubby, NSSA, summarization, external routes and virtual links (when we deliberately break Area 0
contiguity in Lab 5G).
Addressing: Area 0 transit /31 s from 10.0.10.x ; DC subnets 10.10.x / 10.30.x ; campus 10.20.x ;
router-IDs = Loopback0 per Module 1 §7.3.

2. Link-state vs distance-vector; the LSDB and SPF

In link-state routing, each router describes its own links in a Link-State Advertisement (LSA) and
floods it to every router in the area. Every router thus assembles an identical Link-State Database
(LSDB) — a complete map — and independently runs SPF (Dijkstra) to compute the shortest-path tree
to every prefix.

Enterprise Routing & Resilient Network Architecture Module 5 · Page 3

 Distance-vector (RIP/EIGRP) Link-state (OSPF/IS-IS)

Knowledge neighbours' summaries full area map

Loop risk needs split-horizon/FC inherently loop-resistant within an area

Update periodic/triggered routes flood LSAs on change; refresh every 30 min

Scaling lever summarization areas (limit flooding + SPF scope)

Control plane: maintain neighbours, flood LSAs, run SPF on change. Data plane: ordinary CEF
forwarding. Cost of scale: a big single area means a big LSDB and expensive SPF — hence areas (§7).

3. OSPF packet types and neighbour states

OSPF rides directly on IP protocol 89, multicast [Link] (AllSPFRouters) and [Link]
(AllDRouters).

Packet Type Purpose

Hello 1 discover/maintain neighbours, elect DR/BDR

DBD (Database Description) 2 summarise LSDB contents during sync

LSR (Link-State Request) 3 ask for specific LSAs you lack

LSU (Link-State Update) 4 carry the actual LSAs

LSAck 5 acknowledge LSAs (reliable flooding)

Neighbour state machine:

State Meaning Common stall cause

Down no Hellos heard L1/L2, wrong subnet

Init Hello seen, not yet bidirectional one-way Hello (ACL/auth one side)

2-Way bidirectional; DR/BDR elected here normal end-state for DROTHER↔DROTHER on broadcast

ExStart negotiating master/slave + seq MTU mismatch (classic), auth mismatch

Exchange swapping DBDs MTU mismatch, duplex/MTU drops

Loading requesting missing LSAs (LSR/LSU) corrupted/oversized LSAs

Full LSDBs synchronised the goal

Two DROTHER routers on a broadcast segment intentionally stay at 2-Way with each other (they
only go Full with the DR/BDR) — that is not a fault.

4. Router-ID, DR/BDR election, interface priority

Router-ID selection order: configured router-id → highest loopback IP → highest active interface IP.
Always configure it (use Loopback0). A duplicate RID causes missing routes and LSDB confusion.

Enterprise Routing & Resilient Network Architecture Module 5 · Page 4

 DR/BDR exist only on multi-access segments (broadcast/NBMA) to reduce adjacencies from O(n²) to
O(n): everyone goes Full with the DR and BDR only; all others are DROTHER. Election:
1. Highest interface priority ( ip ospf priority , default 1; 0 = never DR/BDR).
2. Tie → highest router-ID.
3. Non-preemptive: a new higher-priority router does not take over an existing DR.

interface GigabitEthernet0/0/0
ip ospf priority 100 ! make this router the DR on this segment (e.g. a core)

DR/BDR generate the Type-2 (Network) LSA. On point-to-point links there is no DR/BDR (only two
routers — no benefit).

5. Network types and the timers they imply

The network type sets DR/BDR behaviour and the Hello/Dead timers — and both ends must agree on
timers or the adjacency never forms.

Network type DR/BDR? Hello/Dead Neighbours Typical use

broadcast yes 10/40 auto via multicast Ethernet LAN

point-to-point no 10/40 auto routed /31 links

non-broadcast (NBMA) yes 30/120 static neighbor legacy Frame Relay/hub

point-to-multipoint no 30/120 auto hub-spoke without DR

point-to-multipoint non-broadcast no 30/120 static special NBMA

loopback n/a — advertises a /32 host route loopbacks

interface GigabitEthernet0/0/2
ip ospf network point-to-point ! routed link → no DR election, faster, cleaner

A network-type mismatch usually surfaces as a Hello/Dead timer mismatch (e.g. broadcast

10/40 vs p2mp 30/120) → adjacency stuck. show ip ospf interface shows the type and timers per
side.

6. Cost and reference bandwidth

OSPF cost on a link = reference-bandwidth ÷ interface-bandwidth. Default reference is 100 Mbps
(10⁸), so anything ≥ 100 Mbps computes cost 1 — making 1 G/10 G/100 G indistinguishable. Fix domain-
wide:

router ospf 1
auto-cost reference-bandwidth 100000 ! 100 Gbps reference (value in Mbps)

Question Answer

Why distinguish high-speed links; otherwise everything is cost 1

Rule the reference value must be identical on every router or path selection is inconsistent (logs a
warning)

Alternatives set ip ospf cost <n> per interface for explicit control

Verify show ip ospf interface <if> (Cost: line)

Total path cost = sum of outbound interface costs along the path (the cost of the link out of each router
toward the destination).

Enterprise Routing & Resilient Network Architecture Module 5 · Page 5

 7. Areas and the LSA types
Areas limit LSA flooding and SPF scope. Area 0 is the backbone; every other area must touch Area 0
(directly or via a virtual link/tunnel). An ABR sits between Area 0 and another area; an ASBR injects
external (redistributed) routes.

LSA Name Originated by Scope Carries

1 Router every router within area the router's links/costs

2 Network DR within area the multi-access segment's

attached routers

3 Summary (inter- ABR into other areas inter-area prefixes

area)

4 ASBR-Summary ABR into other areas how to reach the ASBR

5 AS-External ASBR whole OSPF domain (except redistributed external routes

stub/NSSA)

7 NSSA-External ASBR in an within the NSSA externals; translated to Type-5 at

NSSA the NSSA ABR

8/9 Link / Intra-area- — link / area IPv6 prefix carriage

(OSPFv3) prefix

8. Special areas: stub, totally stubby, NSSA, totally

NSSA
Special areas shrink the LSDB at the edge by blocking external/inter-area LSAs and injecting a default
instead. No area type may contain Area 0, a virtual link, or (except NSSA) an ASBR.

Area type Blocks Injects Use

Stub Type-5 default (Type-3) edge areas with no external sources

(externals)

single default DCs that only need "a way out" — Areas 10/30

Enterprise Routing & Resilient Network Architecture Module 5 · Page 6

 Area type Blocks Injects Use
Totally stubby Type-5 and
(Cisco) Type-3

NSSA Type-5 Type-7 (its own externals) + a stubby area that must host an ASBR — Area
optional default 20 (EIGRP redistribution)

Totally NSSA Type-5 and default + Type-7 NSSA that also wants inter-area suppressed
(Cisco) Type-3

! Area 10 / 30 — totally stubby (configure on the ABR with 'no-summary')

router ospf 1
area 10 stub no-summary
! Area 20 — NSSA (ABR translates Type-7 → Type-5 toward the backbone)
area 20 nssa
! Totally NSSA variant:
area 20 nssa no-summary

Command piece Effect

area X stub stub (blocks Type-5) — must be set on every router in the area

area X stub no-summary totally stubby — no-summary only needed on the ABR

area X nssa NSSA — allows local ASBR via Type-7

default-information-originate (under nssa) force the NSSA ABR to inject a default

All routers in a stub/NSSA must agree on the area type (it's carried in Hellos via the E/N-bit)
— a mismatch breaks adjacency (§18).

9. ABR/ASBR, external routes (E1/E2/N1/N2),

forwarding address
• ABR — borders Area 0 and ≥1 other area; generates Type-3/4; summarises with area range .
• ASBR — redistributes external routes; generates Type-5 (or Type-7 in an NSSA).
External metric types:

Type Cost seen by other routers When to use

E2 the redistributed seed cost only (internal path cost when the external cost should look the same
(default) ignored) everywhere

E1 seed cost + internal OSPF cost to the ASBR when you want the closest exit to win

N1 / N2 the NSSA equivalents of E1/E2 inside NSSAs

router ospf 1
redistribute eigrp 100 subnets metric 50 metric-type 1 ! E1: nearest-ASBR wins

Forwarding address: in some redistribution/topologies the Type-5 carries a non-zero forwarding

address; if routers can't reach it, the external route is discarded — a subtle "external present in LSDB
but not installed" fault.

Enterprise Routing & Resilient Network Architecture Module 5 · Page 7

 10. Baseline configuration and command breakdown
PRD-CORE-01#
router ospf 1
router-id [Link]
auto-cost reference-bandwidth 100000
passive-interface default
no passive-interface GigabitEthernet0/0/0
no passive-interface GigabitEthernet0/0/1
network [Link] [Link] area 0
network [Link] [Link] area 0
area 10 stub no-summary
area 20 nssa

Command breakdown

Command What / why / depends / if omitted / if misconfigured / verify

router ospf 1 Starts process 1 (a local process ID — need not match neighbours).

router-id [Link] Fixes the RID to a loopback. If omitted, it's auto-chosen and may change on reboot;
if duplicated, routes go missing. Verify show ip ospf .

auto-cost reference- Distinguish 1/10/100 G. Must be identical domain-wide.

bandwidth 100000

network [Link] Wildcard-matches interfaces into Area 0. If the wrong area is typed, you create
[Link] area 0 an unintended ABR / area mismatch → adjacency or routing breaks.

passive-interface default Run OSPF only on transit links; advertise LANs without inviting peers.
+ selective no

area 10 stub no-summary Makes Area 10 totally stubby (this router is its ABR). All Area-10 routers need
area 10 stub ; only the ABR needs no-summary .

area 20 nssa Lets CAM-CORE be an ASBR inside Area 20.

Modern alternative to network : configure OSPF per interface with ip ospf 1 area X — clearer and
increasingly preferred.

11. Summarization and default-route advertisement

11.1 Inter-area summarization (on the ABR)

router ospf 1
area 10 range [Link] [Link] ! summarise PROD DC into the backbone
area 10 range [Link] [Link] not-advertise ! hide a block entirely

area range summarises Type-3 leaving an area; not-advertise suppresses a block. A summary auto-
creates a Null0 discard on the ABR.

11.2 External summarization (on the ASBR)

router ospf 1
summary-address [Link] [Link] ! summarise redistributed externals

Enterprise Routing & Resilient Network Architecture Module 5 · Page 8

 11.3 Default-route origination (the ASBR injects 0/0)

router ospf 1
default-information originate ! advertise a default IF the router has one
default-information originate always ! advertise it unconditionally (use with care)

PRD-EDGE originates the Internet default into OSPF; always advertises even without a default in the RIB
(dangerous if the exit is actually down). In totally-stubby/NSSA areas the ABR injects the default
automatically.

12. Route filtering, distribute-lists, prefix suppression

OSPF floods LSAs area-wide, so you cannot "filter an LSA out of the LSDB" within an area — filtering
works at specific points:

Tool Where Effect

area X filter-list prefix PL in/ ABR filter Type-3 summaries entering/leaving an area (the proper
out inter-area filter)

distribute-list … in any router filters what SPF installs into the local RIB — does not
change the LSDB or downstream routers

distribute-list … out ASBR filters redistributed routes at the source

area X range … not-advertise ABR suppress a summarised block

prefix-suppression / ip ospf router/ stop advertising transit prefixes (loopbacks still advertised) to
prefix-suppression interface shrink the LSDB

ip prefix-list PL-NO-DB deny [Link]/24

ip prefix-list PL-NO-DB permit [Link]/0 le 32
router ospf 1
area 10 filter-list prefix PL-NO-DB out ! keep the DB subnet out of other areas

Trap: distribute-list in is a local filter only — neighbours still have the route. To truly stop inter-
area propagation, filter on the ABR with area filter-list .

13. Virtual links

A virtual link repairs a topology where an area is not directly attached to Area 0, or Area 0 itself is
partitioned, by tunnelling backbone traffic across a transit (non-stub) area between two ABRs.

! On both ABRs, across transit Area 20, using each other's RID:
router ospf 1
area 20 virtual-link [Link] ! peer ABR's router-id

Rule Detail

Transit area must be a standard area (cannot be stub/NSSA)

Endpoints the two ABRs, referenced by router-ID

Use sparingly a band-aid for migrations/failures — prefer fixing the physical/area design

Verify show ip ospf virtual-links (must reach Full)

Enterprise Routing & Resilient Network Architecture Module 5 · Page 9

 14. Authentication
OSPFv2 supports null (0), plaintext (1) and MD5/key-chain per interface or per area. Modern IOS XE
prefers key chains.

key chain OSPF-KC

key 1
cryptographic-algorithm hmac-sha-256
key-string Sup3r-OSPF-Secret
!
interface GigabitEthernet0/0/0
ip ospf authentication key-chain OSPF-KC
! Legacy MD5 per interface:
! ip ospf authentication message-digest
! ip ospf message-digest-key 1 md5 <key>
! Area-wide:
! router ospf 1 / area 0 authentication message-digest

If mismatched: adjacency never reaches Full; debug ip ospf adj shows "mismatch authentication."
Both ends must use the same type/key.

15. OSPFv3 (IPv6 and address families)

OSPFv3 carries IPv6 (and, in address-family mode, IPv4 too). It runs per-link using link-local sources;
the 32-bit router-ID must be set manually if no IPv4 address exists.

! Traditional OSPFv3 for IPv6:

ipv6 unicast-routing
interface GigabitEthernet0/0/0
ipv6 ospf 1 area 0
router ospfv3 1
router-id [Link]
address-family ipv6 unicast
!
! OSPFv3 address-family form (IPv4 + IPv6 in one process):
router ospfv3 1
router-id [Link]
address-family ipv4 unicast
address-family ipv6 unicast
interface GigabitEthernet0/0/0
ospfv3 1 ipv4 area 0
ospfv3 1 ipv6 area 0

Same states, areas, LSA logic; LSA types 8 (Link) and 9 (Intra-area-prefix) carry IPv6 prefixes.
Authentication uses IPsec or key chains. Verify: show ospfv3 neighbor , show ospfv3 database , show ipv6
route ospf .

Enterprise Routing & Resilient Network Architecture Module 5 · Page 10

 16. Redistribution, BFD, graceful restart
16.1 Redistribution

router ospf 1
redistribute eigrp 100 subnets metric 50 metric-type 1 tag 100
redistribute bgp 65000 subnets route-map RM-BGP-TO-OSPF

• subnets is mandatory — without it only classful networks redistribute (a frequent "where did my /24s
go?" bug).
• Choose E1 when nearest-exit matters; E2 (default) when uniform cost is wanted.
• Tag on entry; deny the foreign tag on the way back (Module 1 §8.6).

16.2 BFD

interface GigabitEthernet0/0/0
bfd interval 300 min_rx 300 multiplier 3
ip ospf bfd
! or: router ospf 1 / bfd all-interfaces

Sub-second failure detection instead of waiting on the 40 s Dead timer.

16.3 Graceful restart (NSF)

Lets a router whose control plane restarts keep forwarding while it re-syncs the LSDB, avoiding a
topology churn — nsf / nsf ietf under the process, with helper neighbours.

17. Verification and representative output

Command Shows

show ip ospf neighbor per-neighbour state, RID, DR/BDR role, dead

timer

show ip ospf interface [brief] area, network type, cost, Hello/Dead, DR/
BDR, auth

show ip ospf database [router|network|summary|external| the LSDB by LSA type

nssa-external]

show ip ospf RID, areas, area types, SPF stats, reference

bw

show ip route ospf installed routes: O , O IA , O E1/E2 , O N1/

N2

debug ip ospf adj / hello / events adjacency, timer/auth/MTU issues

PRD-CORE-01# show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
[Link] 1 FULL/DR 00:00:36 [Link] Gi0/0/0
[Link] 1 FULL/ - 00:00:38 [Link] Gi0/0/1
[Link] 0 2WAY/DROTHER 00:00:33 [Link] Gi0/0/2

FULL/- = adjacency on a p2p link (no DR). 2WAY/DROTHER = two DROTHERs on a broadcast segment
(normal).

Enterprise Routing & Resilient Network Architecture Module 5 · Page 11

 PRD-CORE-01# show ip route ospf
O IA [Link]/24 [110/30] via [Link], Gi0/0/0 ! inter-area (from DR)
O E2 [Link]/0 [110/1] via [Link], Gi0/0/0 ! external default from ASBR
O N2 [Link]/24 [110/20] via [Link], Gi0/0/1 ! NSSA external from campus

18. Common failures and systematic troubleshooting

Symptom Likely cause Check / fix

Stuck at Init/2- one-way Hellos (ACL/auth one side), or expected show ip ospf neighbor ; verify it
Way DROTHER↔DROTHER (normal) should go Full

Stuck at ExStart/ MTU mismatch (most common), or auth mismatch show ip ospf interface (MTU),
Exchange match MTU or ip ospf mtu-ignore
(band-aid)

No neighbour at all area mismatch, subnet/mask mismatch, network- show ip ospf interface (area,
type/timer mismatch, passive interface, wrong type, Hello/Dead), debug ip ospf
network area adj

Adjacency up, wrong area design, distribute-list in filtering RIB, show ip ospf database , show ip
routes missing stub/NSSA blocking, subnets missing on redistribution route ospf

External in LSDB unreachable forwarding address show ip ospf database external ;

but not installed provide a route to the FA

Duplicate routes/ duplicate router-ID show ip ospf RID; make RIDs unique
black-hole

Everything cost 1 default reference bandwidth auto-cost reference-bandwidth

domain-wide

Stub adjacency stub/NSSA flag mismatch across the area make every router's area type agree
fails

Systematic process: 1. show ip ospf neighbor — what state, and is it the expected state? 2. Stuck
pre-Full → show ip ospf interface : compare area, network type, Hello/Dead, MTU, auth on both
ends. 3. Full but routes wrong → show ip ospf database (right LSA types present?) then show ip route
ospf . 4. Check area type agreement (stub/NSSA), redistribution subnets , filters, forwarding address. 5.
Validate; confirm the LSDB matches across the area.

19. Cross-platform quick reference

Task IOS XE IOS XR NX-OS ( feature FRRouting VyOS
ospf )

Enable router ospf 1 router ospf 1 router ospf 1 router ospf set protocols
ospf

Area network … area area X / ip router ospf network … area set ...ospf area
assign X or ip ospf 1 interface … 1 area X (iface) X X network …
area X

Router-ID router-id router-id router-id ospf router-id set …ospf

parameters
router-id

Ref auto-cost auto-cost auto-cost auto-cost set …auto-cost

bandwidth reference- reference- reference- reference-
bandwidth bandwidth bandwidth bandwidth

Stub/TS/ area X stub [no- area X stub/ area X stub/ area X stub/ set …area X
NSSA summary] / nssa nssa nssa nssa

Enterprise Routing & Resilient Network Architecture Module 5 · Page 12

 Task IOS XE IOS XR NX-OS ( feature FRRouting VyOS
ospf )

Summarize area X range / area X range / area X range / area X range / set …area X
summary-address summary-prefix summary-address summary-address range

Auth ip ospf authentication ip ospf ip ospf set …

authentication keychain authentication authentication authentication
key-chain …

BFD ip ospf bfd bfd ip ospf bfd ip ospf bfd set …ospf
interface … bfd

Verify show ip ospf show ospf show ip ospf show ip ospf show ip ospf
neighbor neighbor neighbor neighbor (vtysh) neighbor

Clouds: AWS/Azure/GCP do not run OSPF on the underlay; hybrid routing is BGP (Modules 19–22).
OSPF appears only inside customer VMs/virtual routers if you build them.

20. Guided labs 5A–5N

Build on the §1.2 topology. Each lab: objective, steps, verify, inject, reset.

5A — Single-area OSPF
Area 0 only across the cores; confirm all reach Full and exchange routes. Verify: show ip ospf neighbor ,
show ip route ospf .

5B — Multi-area + ABR
Add Areas 10/20/30; confirm PRD-CORE becomes an ABR generating Type-3s. Verify: show ip ospf
database summary .

5C — Stub area
Make Area 10 a plain stub ( area 10 stub on all its routers); confirm Type-5 gone, default present.

5D — Totally stubby
Add no-summary on the ABR; confirm Type-3 also gone, single default remains.

5E — NSSA
Make Area 20 NSSA; redistribute EIGRP at CAM-CORE ; confirm Type-7 inside the area and Type-5 after
the ABR translation; observe O N2 routes.

5F — Totally NSSA
Add no-summary to the NSSA; confirm inter-area suppressed, default injected, Type-7 retained.

Enterprise Routing & Resilient Network Architecture Module 5 · Page 13

 5G — Virtual link
Break Area 0 contiguity (split it), connect a stranded ABR through Area 20 with a virtual link; confirm it
reaches Full and routing recovers. Then fix the design and remove it.

5H — Summarization
area 10 range [Link]/16 on the ABR; confirm a single Type-3 and the Null0 discard.

5I — Authentication
Apply HMAC-SHA-256 key-chain on Area-0 links; prove mismatch fails (stuck pre-Full).

5J — Route filtering
Use area 20 filter-list prefix … out to keep a campus prefix out of the backbone; contrast with a
distribute-list in (local only) to show the difference.

5K — External routes E1 vs E2
Redistribute with metric-type 2 then 1 ; compare costs from two vantage points; show nearest-exit
behaviour with E1.

5L — Redistribution
Redistribute BGP/static into OSPF with subnets and a tag; verify externals appear; remove subnets to
reproduce the "missing /24s" bug.

5M — Network-type / timer mismatch

Set one side point-to-point and the other broadcast (or change Hello); observe the timer mismatch
and stuck adjacency; fix.

5N — The adjacency-killer gauntlet (troubleshooting)

(Instructor) plant one each of: area mismatch, MTU mismatch (stuck ExStart/Exchange), auth
mismatch, duplicate RID. Diagnose each from show ip ospf neighbor state + show ip ospf
interface , and fix.

21. Challenges
21.1 Independent configuration challenge
Build the full reference OSPF: process 1, RID from loopbacks, reference bandwidth 100 Gbps, Area 0
backbone, Areas 10/30 totally stubby, Area 20 NSSA with EIGRP redistribution (E1, tagged), area
10/30 range summaries, HMAC-SHA-256 on all Area-0 links, PRD-EDGE originating the default. Provide the
verification sequence proving each area type and the externals. (Outline in §24.)

Enterprise Routing & Resilient Network Architecture Module 5 · Page 14

 21.2 Troubleshooting challenge
Four planted faults: MTU mismatch (ExStart), area-type mismatch (Area 10 stub flag missing on one
router), missing subnets on redistribution, duplicate router-ID. For each: symptom → revealing command
→ root cause → fix. (Answers in §24.)

21.3 Design exercise

Justify, per area, the chosen type (why Areas 10/30 totally stubby, why Area 20 must be NSSA not stub),
and explain what would break if Area 20 were made a plain stub. Then propose where you'd summarise
to minimise LSDB size and SPF cost across the estate. (Discussion in §24.)

22. Review questions

1. Why can a stub/totally-stubby area not contain an ASBR, and which area type solves that?
2. Two routers are stuck in ExStart/Exchange. What is the single most likely cause and one quick (if
imperfect) workaround?
3. Distinguish E1 from E2 external routes and when you'd choose each.
4. On a broadcast segment, two routers sit at 2-Way/DROTHER. Is this a fault? Explain.
5. Why does distribute-list in fail to stop a prefix from reaching routers in other areas, and what does
instead?
6. What selects the OSPF router-ID, and why must you set it explicitly?
7. Which LSA does the DR generate, and on which network types is there no DR at all?
8. Default reference bandwidth makes 1 G and 100 G the same cost. What's the fix and what's the rule
when applying it?
9. An external route is in the LSDB ( show ip ospf database external ) but not installed in the RIB. Name
the classic cause.
10. Why is subnets required when redistributing into OSPF?
(Answers in §24.)

23. Module close-out

23.1 Summary
OSPF is link-state: routers flood LSAs to build an identical LSDB and run SPF locally. Adjacencies progress
Down→2-Way→ExStart→Exchange→Loading→Full; DR/BDR exist only on multi-access segments (priority
then RID; non-preemptive) and generate the Type-2 LSA. Network type sets DR behaviour and Hello/
Dead timers, which must match. Cost = reference-bw ÷ interface-bw — set the reference domain-wide.
Areas scale OSPF by limiting flooding; special areas (stub, totally stubby, NSSA, totally NSSA) trade
external visibility for a default. ABRs generate Type-3/4 and summarise with area range ; ASBRs inject
Type-5 (or Type-7 in an NSSA) as E1/E2 (N1/N2). Filtering happens at ABRs ( area filter-list ) or the
ASBR; distribute-list in is local only. Virtual links are a transit-area band-aid. OSPFv3 extends all of
this to IPv6 (and IPv4 via address families). The recurring failures are area/network-type/timer/auth/MTU
mismatches, duplicate RIDs, and forgetting subnets .

Enterprise Routing & Resilient Network Architecture Module 5 · Page 15

 23.2 Key commands

router ospf 1 / router-id <id> / auto-cost reference-bandwidth <Mbps>

network <addr> <wild> area X | interface: ip ospf 1 area X
area X stub [no-summary] | area X nssa [no-summary] | area X range <net> <mask> [not-advertise]
area X filter-list prefix <PL> in|out | area X virtual-link <peer-rid>
default-information originate [always] | summary-address <net> <mask>
redistribute <proto> subnets metric <m> metric-type 1|2 tag <t>
ip ospf network point-to-point | ip ospf priority <0-255> | ip ospf cost <n>
ip ospf authentication key-chain <KC> | ip ospf bfd
show ip ospf neighbor | interface [brief] | database [type] | show ip route ospf | debug ip ospf
adj

23.3 Common mistakes

• MTU mismatch → stuck ExStart/Exchange.
• Area / network-type / timer / auth mismatch → no adjacency.
• Duplicate router-ID → missing routes.
• Omitting subnets on redistribution → classful-only externals.
• Expecting distribute-list in to stop inter-area propagation.
• Leaving default reference bandwidth → all high-speed links cost 1.

23.4 Verification checklist

• [ ] All neighbours Full (or correctly 2-Way as DROTHERs); RIDs unique.
• [ ] Each area is the intended type, agreed on every router.
• [ ] Reference bandwidth identical domain-wide; costs sensible.
• [ ] Summaries at ABRs/ASBR with Null0 discards; externals as intended E1/E2.
• [ ] Redistribution uses subnets + tags; default originated where required.
• [ ] OSPFv3 (if used) has manual RIDs and per-link area assignment.

23.5 Practical assignment

Build the full reference OSPF design (Area 0 + totally-stubby 10/30 + NSSA 20 with EIGRP redistribution),
authenticated and summarised, dual-stack with OSPFv3. Commit to Git with a README mapping each
area to its type and the LSA types you expect to see in each. This is the DC/backbone baseline that BGP
(Module 7) and the DR design (Modules 15–17) sit on top of.

23.6 Troubleshooting assignment

Resolve the Module 1 pre-staged duplicate router-ID ( [Link] on two routers) now that OSPF is
live: capture the exact symptom ( show ip ospf and missing routes), fix the RID, and document why link-
state is sensitive to RID uniqueness.

---

24. Module 5 Answer Key

Stop. Attempt everything first.

Enterprise Routing & Resilient Network Architecture Module 5 · Page 16

 24.1 Review-question answers
1. A stub/totally-stubby area blocks Type-5 LSAs, but an ASBR's whole job is to originate externals — so
it can't live where Type-5 is forbidden. NSSA solves it by using Type-7 internally and translating to
Type-5 at the ABR.
2. MTU mismatch — the larger side's DBD/LSU exceeds the smaller side's MTU and is dropped during
database exchange. Quick workaround: ip ospf mtu-ignore on the interface (better: fix the MTU).
3. E1 = external seed cost plus the internal cost to the ASBR (so the nearest exit wins, costs
accumulate); E2 (default) = seed cost only (uniform everywhere). Use E1 when you want closest-exit
selection; E2 when the external cost should look identical from everywhere.
4. Not a fault. On a broadcast segment only the DR and BDR go Full with everyone; two DROTHER
routers intentionally remain at 2-Way with each other.
5. distribute-list in only filters what the local router installs into its RIB; the LSA still floods, so other
routers (and other areas) still have it. To stop inter-area propagation, filter the Type-3 on the ABR with
area X filter-list prefix … in/out .
6. Selection order: configured router-id → highest loopback → highest active interface IP. Set it explicitly
so it's stable across reboots/interface changes and never duplicated.
7. The DR generates the Type-2 (Network) LSA. There is no DR on point-to-point, point-to-multipoint,
or loopback network types.
8. Fix with auto-cost reference-bandwidth <Mbps> (e.g. 100000 for 100 G). Rule: it must be identical
on every router or path costs are computed inconsistently.
9. The Type-5's forwarding address is unreachable, so the route is discarded. Provide a route to the
forwarding address (or eliminate the non-zero FA).
10. Without subnets , OSPF redistributes only classful networks; subnetted prefixes (the usual case) are
dropped — so subnets is required to carry /24 -style routes.

24.2 Configuration-challenge outline (§21.1)

router ospf 1 + router-id (loopback) + auto-cost reference-bandwidth 100000 ; Area 0 across cores;
area 10 stub no-summary and area 30 stub no-summary (with area 10/30 stub on all member routers);
area 20 nssa ; at CAM-CORE : redistribute eigrp 100 subnets metric-type 1 tag 100 ; area 10/30 range
[Link]/16 / [Link]/16 ; key-chain HMAC-SHA-256 on Area-0 interfaces; PRD-EDGE : default-
information originate . Verify: show ip ospf (areas+types), show ip ospf database nssa-external
(Type-7), show ip route ospf ( O IA , O E2/E1 , O N2 , single default in stubby areas).

24.3 Troubleshooting-challenge faults (§21.2)

• MTU mismatch → stuck ExStart/Exchange; show ip ospf interface MTU differs; match MTU.
• Area-type mismatch → Area-10 adjacency fails because one router lacks area 10 stub ; make all
agree.
• Missing subnets → externals appear only as classful or not at all; add subnets .
• Duplicate RID → missing/oscillating routes; show ip ospf shows same RID twice; set unique RIDs.

24.4 Design-exercise discussion (§21.3)

Areas 10/30 are totally stubby because a data centre only needs a default to exit — blocking Type-3/5
minimises LSDB and SPF there. Area 20 must be NSSA (not stub) because it hosts an ASBR (EIGRP
redistribution); a plain stub forbids Type-5/ASBR, so the campus externals could not be injected —
making Area 20 a stub would either break redistribution or force those routes out of OSPF entirely.
Summarise at every ABR ( area range for 10.10/16 , 10.30/16 , campus aggregates) and at the ASBR
( summary-address for redistributed externals) to keep LSDBs small and SPF fast.

Enterprise Routing & Resilient Network Architecture Module 5 · Page 17

 End of Module 5. Module 6 — IS-IS — the other link-state protocol, used on the inter-DC core in this
design; you'll contrast its CLNS/NET addressing, L1/L2 hierarchy and TLV flexibility with OSPF's area
model.

Enterprise Routing & Resilient Network Architecture Module 5 · Page 18