Welcome to Mat's Cloud

OSPF Non-Broadcast Multiple-Access (NBMA) Networks

On the Multipoint Frame-Relay network the default OSPF type is NON-BROADCAST. This means that the OSPF Neighbors will not be formed like on the standard Broadcast Network Segment.

Cisqueros_R1#show ip ospf inter s1/0
Serial1/0 is up, line protocol is up
Internet Address 10.1.1.1/24, Area 0
Process ID 1, Router ID 1.1.1.1, Network Type NON_BROADCAST, Cost: 64
Topology-MTID Cost Disabled Shutdown Topology Name
0 64 no no Base
...

So in order to establish the OSPF Neighbors, we can for example use the "network" command in order to transform the OSPF link from MULTICAST to UNICAST

(config-router)#neighbor 172.128.185.66

*In HUB-AND-SPOKE the Spokes do not have the Layer 2 reachability, so this command makes no sense. Instead just be sure to set their OSPF priority to 0, so that they dont participate the DR/BDR Election

(config-if)#ip ospf priority 0

The HUB Router will be elected as DR on every Link and exchange OSPF Database with each of the Spokes:

Cisqueros_R1#show ip ospf neighbor <--- R1 IS THE HUB

Neighbor ID Pri State Dead Time Address Interface
2.2.2.2 0 FULL/DROTHER 00:01:51 10.1.1.2 Serial1/0
3.3.3.3 0 FULL/DROTHER 00:01:51 10.1.1.3 Serial1/0
4.4.4.4 0 FULL/DROTHER 00:01:56 10.1.1.4 Serial1/0

*In this kind of OSPF Topology - it's not necessary to have the Frame-Relay interface configured with the "broadcast" keyword, because we are manually defining the OSPF Neighbor and turning the Links into UNICASTS.

OSPF BROADCAST Networks v.s. POINT-TO-POINT Networks

If you wish to convert the previous network into the Broadcast Network, the following command needs to be applied:

(config-if)#ip ospf network broadcast

And in case it needs to be Point-to-Point:

(config-if)#ip ospf network point-to-point

The main difference here is the NEXT HOP:
BROADCAST: Next Hop is the router that ORIGINATED the Route
POINT-TO-POINT: Next Hop is the router that ADVERTISED the Route

OSPF Route Filtering

First be sure which type of LSA you need to filter by making sure in which part of database the route is:

#show ip ospf database [router | network | summary | internal | external]

There are 5 ways to perform OSPF Route Filtering:

1. DISTRIBUTE LIST - Filters all LSAs from the Routing Table, but they stay in the OSPF Database
!!!distribute-list OUT works on both, routing table and OSPF database, but ONLY on ASBR for LSA5 and 7!!!
2. FILTER LIST - Filters only LSA3, so - only on ABR, but filters from OSPF Database.
filter-list can be applied: IN - into the area, OUT - out of the area
3. NOT-ADVERTISE - ONLY filter LSA Types 1 and 2, apply on ABR (filters both, routing table and OSPF Database)
Can be used with both, "area X range" (ABR) and "summary-address" (ASBR) commands
4. DISTANCE - Set the AD of the advertised routes to 255, so that they are UNREACHABLE
(config-router)#distance 255 3.3.3.3 0.0.0.0 10 <- 10 is an ACL
5. DATABASE-FILTER - If you want to prevent ANY LSAs from being advertised (can be applied per neighbor or on INT):
(config-subif)#ip ospf database-filter all out <- PER INTERFACE
(config-router)#neighbor x.x.x.x database-filter all out <- PER NEIGHBOR

Be sure which type of LSA you need to filter by making sure in which part of database the route is:
#show ip ospf database [router | network | summary | internal | external]

The easiest way to filter the OSPF routes from being added to the Routing Table is the distribute-list.
!!!DISTRIBUTE-LIST only affects the local router!!! Meaning - the Update will be distributed to the other routers, the subnets will only be filtered out the local IP ROUTING TABLE
The advantage is that it's rather easy to implement, and it can filter any type of LSA:
(config-router)#distribute-list prefix MY_PREFIX_LIST in <--- OUT would only work on ASBR TO FILTER LSA5 & LSA7

The big CON is that even though the Route is not added to the Routing Table - it will stay in the database,
and it will be further propagated to the other OSPF Neighbors. The route will therefore appear in the Routing Table,but it will not be reachable, as one of the routers along the path does not have it in it's Routing Table.

*If you need to reach the route without passing through the router that cannot reach it - define the route-map with the next hop pointing towards an alternative path, and apply it in the Global Configuration mode:
(config-router)#ip local policy route-map ROUTE_MAP

Filter using Distribute List

The easiest way to filter the OSPF routes from being added to the Routing Table is the distribute-list. The advantage is that it's rather easy to implement, and it can filter any type of LSA:

Cisqueros_R2(config-router)#distribute-list prefix MY_PREFIX_LIST in <--- OUT would only work on OSBR TO FILTER LSA5 & LSA7

The big CON is that even though the Route is not added to the Routing Table - it will stay in the database, and it will be further propagated to the other OSPF Neighbors.
The route will therefore appear in the Routing Table, but it will not be reachable, as one of the routers along the path does not have it in it's Routing Table.

*If you need to reach the route without passing through the router that cannot reach it - define the route-map with the next hop pointing towards an alternative path, and apply it in the Global Configuration mode:

(config-router)#ip local policy route-map ROUTE_MAP

OSPF filter-list - LSA-3 FILTERING

This ONLY works for LSA-3 (Summary), and therefore needs to be configured on the ABR only. Lets say that we want to filter the network 172.25.185.0/24 from the Area 2. Then on the ABR we define the prefix list that DENIES that network, and ALLOWS everything else

(config)#ip prefix-list JEDANES seq 10 deny 172.25.185.0/24
(config)#ip prefix-list JEDANES seq 20 permit 0.0.0.0/0 le 32

Then apply the prefix-list as a filter-list within a OSPF configuration process for Area 2:

(config-router)#area 2 filter-list prefix JEDANES in

This will prevent the network from being redistributed into Area 2. Note that IN/OUT means that the network is being advertised into or out-from the AREA 2

OSPF "not-advertise" LSA1 & LSA2 FILTERING

If you need to filter LSAs 1 and 2, you can use the "not-advertise" command, but also ONLY ON ABR!

(config-router)#area 1 range 172.25.182.0 255.255.255.0 not-advertise

Tune the ADVERTISED DISTANCE to Filter the Prefix

Another way to filter the OSPF networks is manually setting the distance to 255, which is UNREACHABLE. It's not the most elegant way, but you should know that it's also an option.

Cisqueros_R4(config-router)#distance 255 3.3.3.3 255.255.255.0 10 <--- 10 IS AN ACCESS-LIST WITH THE PREFIXES WE WANT TO FILTER

Filter EXTERNAL OSPF Routes: LSA5 & LSA7

The first way to filter there routes was already mentioned above:

Cisqueros_R2(config-router)#distribute-list prefix MY_PREFIX_LIST OUT

The second way is reserved ONLY for the External Routes, and it's the "not-advertised" applied to the "summary-address" command

(config-router)#summary-address 172.29.189.0 255.255.255.0 not-advertise <--- MUST BE APPLIED ON ASBR

Filter OSPF per Interface

If you wish to prevent LSAs to be sent via particular Interface:

(config-if)#ip ospf database-filter all out

*ALL and OUT are the only options, which means you cannot apply a specific filter on the OSPF interface

Filter OSPF per NEIGHBOR

Even though OSPF doesn't require that we manually configure the Neighbors, we do need to use the "neighbor" command in order to configure the OSPF database filtering:

(config-router)#neighbor 5.5.5.5 database-filter all out

*Network MUST be configured as POINT-TO-POINT (on the Interface Configuration)

OSPF Stub Area Types

First lets make sure we're comfortable with the LSA types, because you will not understand Stubs before you understand LSAs 100%

*LSA - Link State Advertisement, Each LSA has a LSID (Link State ID, like Router-ID for the LSAs)

LSA 1 - Router LSA, One per Router (Generated by Each Router)
LSA 2 - Network LSA, One per Network (Generated by DR)
LSA 3 - Summary LSA, One per Area (generated by ABR when LSAs 1 and 2 are injected into another Area). LSA3 = Subnet + Mask + Cost to reach the Network
LSA 4 - Summary External LSA, One per Autonomous System (Generated by ASBR)
LSA 5 - External LSA, Injected into OSPF from another routing process (non-ospf)
LSA 6 - Grout Membership LSA, Not supported by Cisco
LSA 7 - NSSA External, Generated by ASBR inside the NSSA instead of LSA 5 (details explained below, NSSA Section)
LSA 8-11 - Not implemented by Cisco

Check the LSA Statistics using the command:

Cisqueros_R3(config-router)#do show ip ospf stat

OSPF Router with ID (3.3.3.3) (Process ID 1)

Area 0: SPF algorithm executed 4 times

Summary OSPF SPF statistic

SPF calculation time
Delta T Intra D-Intra Summ D-Summ Ext D-Ext Total Reason
00:22:26 0 0 0 0 0 0 0 R
00:22:16 0 0 0 0 0 0 0 R
00:21:47 0 0 0 0 0 0 0 R, N, SN
00:20:01 0 0 0 0 0 0 0 R, SN

Check the OSPF DATABASE and all the LSAs currently in it:

Cisqueros_R3#show ip ospf database

OSPF Router with ID (3.3.3.3) (Process ID 1)

Router Link States (Area 0) <--- LSA1

Link ID ADV Router Age Seq# Checksum Link count
2.2.2.2 2.2.2.2 79 0x80000003 0x000E94 2
3.3.3.3 3.3.3.3 78 0x80000007 0x006F2C 4
4.4.4.4 4.4.4.4 52 0x80000004 0x007781 3

Net Link States (Area 0) <--- LSA2

Link ID ADV Router Age Seq# Checksum
10.1.23.3 3.3.3.3 78 0x80000001 0x00658F

Summary Net Link States (Area 0) <--- LSA3

Link ID ADV Router Age Seq# Checksum
1.1.1.0 2.2.2.2 124 0x80000002 0x00B33C
2.2.2.0 2.2.2.2 124 0x80000002 0x000D20
10.1.12.0 2.2.2.2 124 0x80000002 0x00BA22
10.1.45.0 4.4.4.4 43 0x80000001 0x00F5F4
44.4.4.0 4.4.4.4 43 0x80000001 0x008077

Router Link States (Area 1) <--- LSA1, Area 1

Link ID ADV Router Age Seq# Checksum Link count
3.3.3.3 3.3.3.3 89 0x80000007 0x00AC78 0

Router Link States (Area 2) <--- LSA2, Area 1

Link ID ADV Router Age Seq# Checksum Link count
3.3.3.3 3.3.3.3 90 0x80000006 0x00AE77 0

STUB - No LSA 5 (E1 and E2) advertised on ABRs. You cannot use a Virtual Link here, but GRE Tunnel is an option.

Totally Stubby Area - Stub without the Summary Routes (LSA3), so no Intra-Area (IA O). Only Route and Network LSAs (LSA1 and LSA2) within the Area
The "no-summary" attribute is ONLY necessary on ABR, because the ABR is the only router that actually originates the LSA 3.

* STUB and Totally Stubby Area: DO NOT FORGET to configure the "area X stub" on all the routers in the Area X. The routers that ONLY belong to the Area X will BY DEFAULT get the Default Route injected with the ABR as a Default Gateway.

NSSA - LSA3 and LSA7 copied into LSA5 (External, E1 and E2)
* ASBR Generates LSA 7 instead of LSA 5 because the LSA 5 is not supported by NSSA. Then the ABR transforms it into LSA 5 on the ingress from NSSA to the regular OSPF Area.

Totally Stubby NSSA - No Summary (LSA3), but External Routes Included (LSA5)

GRE Tunnel used as a OSPF Virtual-Link

GRE - Generic Routing Encapsulation, is a method of tunneling data from one router to another. Packets of one routing protocol - PASSANGER PROTOCOL are being encapsulated into another routing protocol - TRANSPORT PROTOCOL.

In this example there is a need to establish the connectivity between some OSPF Areas that are not connected to the Area 0, and we do not want to use the Virtual Links.
GRE is a pretty simple concept, you need to configure the following on the BOTH ENDS of the tunnel:

1. Create a Tunnel Interface and assign the IP Address

(config)#int tunnel 1
(config-if)#ip add 172.25.185.3 255.255.255.0

2. Define the SOURCE and the DESTINATION of the tunnel

(config-if)#tunnel source 100.10.34.3
(config-if)#tunnel destination 100.10.34.4

If we are using OSPF then the Tunnel subnet needs to be advertised with the "network" command on both ends of the tunnel.

(config-router)#network 172.25.185.0 0.0.0.255 area 0

*The IP Address of the Tunnel MUST be advertised into Area 0!!!

You will see that the OSPF Neighbor will be formed on the Tunnel 1 interface.

Cisqueros_R4#show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
3.3.3.3 0 FULL/ - 00:00:38 172.25.185.3 Tunnel1 <--- GRE-Neighbor
3.3.3.3 0 FULL/ - 00:00:38 100.10.34.3 Serial1/0.43
5.5.5.5 1 FULL/DR 00:00:38 100.10.45.5 GigabitEthernet5/12

OFPF Cost Tuning

NLRI - Network Layer Reachability Information

OSPF routes are mainly classified based on their metric, where the Metric and Cost are calculated based only on the Link Bandwidth.

Cost = 100/(BW[Mbps])

There are two things you could play with here:

1. Set the REFERENCE BW (because with the formula above the Max cost value is 1, and we dont want the same values for 100M and 10G link)

(config-router)#auto-cost reference-bandwidth 10000

*10000 is 10000 Mbps

* Dont forget to clear the OSPF process in order for the changes to take effect:

#clear ip ospf process

2. Change the COST in the Interface Configuration

(config-if)#ip ospf cost 20

and check the result:

Cisqueros_R1#show ip ospf inter Lo0 | i Cost
Process ID 1, Router ID 1.1.1.1, Network Type POINT_TO_POINT, Cost: 20

Then check the metric on the OSPF Neighbor:

Cisqueros_R2#show ip route 1.0.0.0
Routing entry for 1.0.0.0/8
Known via "ospf 1", distance 110, metric 84, type intra area <--- METRIC 84
Last update from 10.1.12.1 on Serial1/0.21, 00:02:31 ago
Routing Descriptor Blocks:
* 10.1.12.1, from 1.1.1.1, 00:02:31 ago, via Serial1/0.21
Route metric is 84, traffic share count is 1

Metric is 84, which is the cost of the Serial interface between routers 1 and 2, and the Cost of the Loopback0 interface on Router 1.

Default cost of the Loopback interface is 1, so it actually increased for 20-1 = 19

OSPF Advanced Virtual Link configuration: Multiple Virtual-Link

At this level I suppose you know how to configure the Virtual Link, and what is it's purpose. Let's get some deeper into clearing out some doubts.

1. What happens with the OSPF Neighbors, and how do I check the Virtual Link?
Configure between two routers out of which none is in the Area 0 (Backbone Area). Once it's configured - a new OSPF neighbor will be added as a Virtual-Link neighbor:

Cisqueros_R3#show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
4.4.4.4 0 FULL/ - 00:00:05 10.1.34.4 OSPF_VL0 <--- VIRTUAL LINK NEIGHBOR
2.2.2.2 0 FULL/ - 00:00:30 10.1.23.2 Serial1/0.32
4.4.4.4 0 FULL/ - 00:00:34 10.1.34.4 Serial1/0.34

2. What do I do if I have more areas connected to each other, but none connected to Area 0. Can I form multiple Virtual Links?

The answer is YES, you can! So for example if we have the following scenario:

Cisqueros_R1 - Area 0 - Cisqueros_R2 - Area 1 - Cisqueros_R3 - Area 2 - Cisqueros_R4 - Area 3 - Cisqueros_R5

We would need to create 2 virtual links
- AREA 1 VIRTUAL LINK between Cisqueros_R2 and Cisqueros_R3 so that Area 2 would have the communication with the Area 0
- AREA 2 VIRTUAL LINK between Cisqueros_R3 and Cisqueros_R4 so that Area 3 could communicate with Area 1, and therefore with Area 0

Cisqueros_R2:
(config-router)#area 1 virtual-link 3.3.3.3

Cisqueros_R3:
(config-router)#area 1 virtual-link 2.2.2.2
(config-router)#area 2 virtual-link 4.4.4.4

Cisqueros_R4:
(config-router)#area 2 virtual-link 3.3.3.3

Let's check the OSPF Neighbors again on Cisqueros_R3 router:

Cisqueros_R3#show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
2.2.2.2 0 FULL/ - - 10.1.23.2 OSPF_VL1
4.4.4.4 0 FULL/ - - 10.1.34.4 OSPF_VL0
2.2.2.2 0 FULL/ - 00:00:34 10.1.23.2 Serial1/0.32
4.4.4.4 0 FULL/ - 00:00:33 10.1.34.4 Serial1/0.34
Cisqueros_R3#

Check the Virtual Link Details:

#show ip ospf virtual-links

Have in mind that routers Cisqueros_R3 and Cisqueros_R4 are now VIRTUALLY connected to Area 0, so if you enable the authentication on the Cisqueros_R1 interface towards Cisqueros_R2, you also must enable authentication for Area 0 on Cisqueros_R3 and Cisqueros_R4!!!

OSPF Authentication

OSPF supports two types of Authentication:
1. Plain Text (64-bit Password)

(config-if)#ip ospf authentication-key ^&*(^*&&%

2. MD5 (ID + 128-bit Password):

(config-if)#ip ospf message-digest-key 1 MD5 ^&*^&^*

You can enable the OSPF Authentication:

1. Globally on the Router, in the "router ospf" configuration, so it's enabled on all the Interfaces

(config-router)#area 0 authentication [message-digest]

*If you enable the Authentication globaly on the routing process configuration, have in mind that you MUST configure the Authentication Key on ALL the OSPF Interfaces. If you need to DISABLE the authentication on some of the interfaces, use the following Interface command:
(config-if)#ip ospf authentication null

**When you've got the Authentication enabled only for one of the Areas within the OSPF process - it will BREAK all the Virtual Links with the non-authentication Areas, and you will get the following message:
*May 1 14:58:46.971: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on OSPF_VL1 from FULL to DOWN, Neighbor Down: Interface down or detached
It will also not receive any Intra-area routes (marked as O IA in the Routing Table)

2. Directly on the Interface

(config-if)#ip ospf authentication [message-digest]

*When you configure per-interface Authentication, the other routers NO NOT NEED TO HAVE THE AUTHENTICATION ENABLED!

Check what type of OSPF Authentication has been configured and what Key/Password is applied:

Cisqueros_R1#show ip ospf interface s1/0.12

Serial1/0.12 is up, line protocol is up
Internet Address 10.1.12.1/24, Area 0
Process ID 1, Router ID 1.1.1.1, Network Type POINT_TO_POINT, Cost: 64
Topology-MTID Cost Disabled Shutdown Topology Name
0 64 no no Base
Transmit Delay is 1 sec, State POINT_TO_POINT
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
oob-resync timeout 40
Hello due in 00:00:01
Supports Link-local Signaling (LLS)
Cisco NSF helper support enabled
IETF NSF helper support enabled
Index 1/1, flood queue length 0
Next 0x0(0)/0x0(0)
Last flood scan length is 1, maximum is 1
Last flood scan time is 0 msec, maximum is 0 msec
Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 2.2.2.2
Suppress hello for 0 neighbor(s)
Message digest authentication enabled <--- AUTHENTICATION TYPE
Youngest key id is 1 <--- THE APPLIED AUTHENTICATION KEY

If you need to seemlessly change the authentication key, here is how it's done:
1. Add the MD5 authentication Key 2
2. Make sure that both keys are configured using the command from above. Note that these lines will be added to the bottom of the output:

Message digest authentication enabled
Youngest key id is 2
Rollover in progress, 1 neighbor(s) using the old key(s):
key id 1

3. Configure the Key 2 on the Neighbor routers, and do the same command as above. You will notice that the output changes to:

Message digest authentication enabled
Youngest key id is 2

4. It is now safe to remove the Key 1. KEY NUMBERS HAVE NOTHING TO DO WITH THE ORDER!!! This means that next time you need to change Keys, you can use Key 1 again with a different Password.

Most Popular Posts