Skip to content
Log in Sign up My account

1.10.c Areas, Router Types, LSAs and Virtual Links

Blueprint 1.10.c (ii) to (iv): Troubleshoot OSPF (v2/v3): Area types, router types and virtual link

  • Area types: backbone, normal, transit, stub, totally stubby, NSSA and totally NSSA
  • Router types: internal, backbone, ABR and ASBR
  • LSA types 1 to 7: who originates each, how far it floods and what it carries
  • Virtual links: when they are needed, how to configure them and why they fail
  • Reading show ip ospf, show ip ospf database and show ip ospf border-routers to find the fault

The exam rarely asks you to define an LSA in isolation. It shows you an LSDB, a routing table or a configuration and asks why a route is missing, why a default route appeared or why an area is cut off. Every one of those questions is answered by knowing which router generates which LSA and which area types block it.

Router types

Router type Definition How to spot it
Internal All OSPF interfaces in one area show ip ospf lists one area and no border role
Backbone At least one interface in area 0 Area BACKBONE(0) appears in show ip ospf
ABR (area border router) Interfaces in area 0 and in at least one other area It is an area border router
ASBR (AS boundary router) Redistributes routes into OSPF (including a default with default-information originate) It is an autonomous system boundary router

One router can hold several roles. An ABR that also redistributes reports It is an area border and autonomous system boundary router. Every ABR is also a backbone router.

R3# show ip ospf
 Routing Process "ospf 1" with ID 10.255.255.3
 Supports only single TOS(TOS0) routes
 Supports opaque LSA
 It is an area border router
 ...
    Area BACKBONE(0)
        Number of interfaces in this area is 2
    Area 2
        Number of interfaces in this area is 1
        It is a NSSA area
        Perform type-7/type-5 LSA translation

show ip ospf border-routers lists the ABRs and ASBRs this router can reach and the cost to each. It is the quickest way to see whether an ASBR is reachable at all, which matters for external routes.

R4# show ip ospf border-routers
Internal Router Routing Table
Codes: i - Intra-area route, I - Inter-area route

i 10.255.255.2 [1] via 10.2.4.2, GigabitEthernet0/0, ABR, Area 1, SPF 7
I 10.255.255.1 [2] via 10.2.4.2, GigabitEthernet0/0, ASBR, Area 1, SPF 7

LSA types

Type Name Originated by Flooding scope Link-state ID Carries Database keyword
1 Router Every router, once per area it is in Area Router ID of the originator Its links, their costs and the stub networks attached router
2 Network The DR on a multiaccess segment Area DR's interface address The segment's mask and the list of attached routers network
3 Summary (network) ABR Area (each ABR regenerates it into the next area) Destination network A prefix from another area and the ABR's cost to it summary
4 Summary (ASBR) ABR Area ASBR's router ID How to reach an ASBR that is in another area asbr-summary
5 AS External ASBR Whole AS, except stub, totally stubby, NSSA and totally NSSA areas External network External prefix, metric, E1 or E2, forwarding address, tag external
6 Group membership (MOSPF) Not supported by Cisco IOS
7 NSSA External ASBR inside an NSSA That NSSA only External network Same as Type 5; translated to Type 5 by an ABR nssa-external

Key points for troubleshooting:

  • Type 1 and 2 never leave their area. Other areas learn those prefixes only from the Type 3 LSAs that an ABR generates.
  • An ABR regenerates Type 3 LSAs. In area 1, the advertising router of a summary for an area 2 prefix is the area 1 ABR, not the router where the prefix lives.
  • Type 4 exists only because Type 5 does not change its advertising router. A Type 5 still names the original ASBR after it crosses an ABR. Routers in other areas need a Type 4 to find the cost to that ASBR. No Type 4 means routers outside the ASBR's area cannot use its externals.
  • An ASBR inside area 0 or a normal area is reached through Type 1 LSAs in its own area and Type 4 LSAs elsewhere.
  • Type 7 to Type 5 translation. When an NSSA has more than one ABR, the one with the highest router ID does the translation. The translated Type 5 is advertised by that ABR, which therefore also acts as an ASBR toward the rest of the domain.
R1# show ip ospf database

            OSPF Router with ID (10.255.255.1) (Process ID 1)

                Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
10.255.255.1    10.255.255.1    322         0x80000006 0x00B1C4 3
10.255.255.2    10.255.255.2    318         0x80000005 0x0057E2 3
10.255.255.3    10.255.255.3    297         0x80000007 0x00D219 4

                Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
10.0.123.3      10.255.255.3    297         0x80000002 0x004AF0

                Summary Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
10.4.40.0       10.255.255.2    310         0x80000001 0x00C83A
10.5.50.0       10.255.255.3    289         0x80000001 0x0091D5

                Type-5 AS External Link States

Link ID         ADV Router      Age         Seq#       Checksum Tag
192.168.5.0     10.255.255.3    280         0x80000001 0x0036AB 0

Reading this: area 0 has three routers and one DR segment. The summaries show that 10.4.40.0 lives behind R2 and 10.5.50.0 behind R3. The external 192.168.5.0 is advertised by R3, which is an ABR and not where the redistribution happens. That pattern means 192.168.5.0 was redistributed inside an NSSA attached to R3 and translated from Type 7 to Type 5 by R3.

Drill into one LSA with a keyword and the link-state ID: show ip ospf database external 192.168.5.0, show ip ospf database router 10.255.255.2, show ip ospf database summary 10.4.40.0. Use self-originate to list only what the local router generates and adv-router <rid> to list everything from one router.

Area types

graph LR
  EXT["External routes"] --> ASBR["ASBR in area 0"]
  ASBR -->|"Type 5"| ABR["ABRs"]
  ABR -->|"Types 3, 4, 5"| N["Normal area"]
  ABR -->|"Type 3 plus default, no 4 or 5"| S["Stub"]
  ABR -->|"Default Type 3 only"| TS["Totally stubby"]
  ABR -->|"Type 3, no 4 or 5"| NS["NSSA"]
  ABR -->|"Default Type 3 only"| TN["Totally NSSA"]
  NS -->|"Type 7 translated to Type 5"| ABR
  TN -->|"Type 7 translated to Type 5"| ABR
Area type Type 3 Type 4 Type 5 Type 7 Default route into the area Configuration
Backbone (area 0) Yes Yes Yes No Only if an ASBR originates one Area 0, cannot be stub or NSSA
Normal Yes Yes Yes No Only if an ASBR originates one Default
Stub Yes No No No Type 3 default from the ABR, automatic area 1 stub on every router in the area
Totally stubby Default only No No No Type 3 default from the ABR, automatic area 1 stub no-summary on the ABR, area 1 stub on the others
NSSA Yes No No Yes None automatically. area 1 nssa default-information-originate on the ABR creates a Type 7 default area 1 nssa on every router
Totally NSSA Default only No No Yes Type 3 default from the ABR, automatic area 1 nssa no-summary on the ABR, area 1 nssa on the others

A transit area is an area that a virtual link passes through (see below). It must be a normal area.

Rules that cause faults:

  1. Every router in a stub or NSSA area must agree. The stub and NSSA settings are carried as option bits in the hello. A router configured as stub and a neighbor configured as normal do not become neighbors at all.
  2. no-summary matters only on the ABR. It tells the ABR to suppress Type 3 LSAs. On an internal router it changes nothing, and forgetting it on the ABR leaves a plain stub or NSSA.
  3. No ASBR in a stub area. A stub area cannot carry externals. If an ASBR is needed, the area must be NSSA.
  4. A plain NSSA gets no default route automatically. If the NSSA also needs to reach externals from elsewhere, add default-information-originate to the area nssa command on the ABR. The default then appears as O*N2. In a totally NSSA the ABR injects a Type 3 default, which appears as O*IA.
  5. Area 0 cannot be stub or NSSA, and a virtual link cannot cross a stub or NSSA area.
R4# show ip route ospf
Gateway of last resort is 10.2.4.2 to network 0.0.0.0

O*IA  0.0.0.0/0 [110/2] via 10.2.4.2, 00:03:12, GigabitEthernet0/0

A routing table with only intra-area routes and an O*IA default is what a router inside a totally stubby or totally NSSA area should look like.

Exam trap

"Routers in area 1 still see inter-area routes after the area was made totally stubby." The fix is almost always that no-summary was configured on an internal router instead of the ABR. Check the ABR with show ip ospf: a totally stubby area shows It is a stub area, no summary LSA in this area.

Exam trap

An ASBR inside an NSSA redistributes a route that shows up as O N2 inside the NSSA and as O E2 everywhere else. If the rest of the domain never sees it, check the ABR: translation happens only on one ABR, and show ip ospf on that ABR must show Perform type-7/type-5 LSA translation. Also check that the Type 7 LSA has its P-bit set (show ip ospf database nssa-external shows the options), because an ABR does not translate a Type 7 without it.

Why area 0 matters: the backbone rule

All inter-area traffic passes through area 0. An ABR advertises its intra-area routes into every attached area, but it only advertises inter-area routes into non-backbone areas when it learned them from area 0. Summaries received in a non-backbone area are not passed on to other areas. As a result:

  • An area that touches only another non-backbone area is cut off. Its routes never reach area 0, and area 0 routes never reach it.
  • An area 0 that is split into two pieces (a partitioned backbone) cannot exchange inter-area routes between the pieces.

Both are fixed by a physical connection to area 0, by redesign, or by a virtual link.

A virtual link is a logical area 0 link between two ABRs, tunnelled across a transit area they both belong to.

graph LR
  subgraph AREA0 ["Area 0"]
    R1["R1"]
  end
  subgraph AREA1 ["Area 1, transit"]
    R2["R2 ABR<br/>RID 10.255.255.2"]
    R4["R4<br/>RID 10.255.255.4"]
  end
  subgraph AREA3 ["Area 3, no link to area 0"]
    R6["R6"]
  end
  R1 -- "Gi0/1" --- R2
  R2 -- "10.2.4.0/30" --- R4
  R4 -- "10.4.6.0/30" --- R6
  R2 -. "virtual link via area 1" .- R4
! R2 (area 0 and area 1)
router ospf 1
 area 1 virtual-link 10.255.255.4
!
! R4 (area 1 and area 3)
router ospf 1
 area 1 virtual-link 10.255.255.2

Rules:

  • The command names the transit area and the router ID of the far end, not an interface address.
  • It is configured on both ABRs.
  • The transit area must be a normal area, never stub, totally stubby or NSSA.
  • The virtual link is an area 0 interface. Area 0 authentication applies to it, and it must be given the same key (area 1 virtual-link 10.255.255.4 message-digest-key 1 md5 <key> or authentication key-chain).
  • Its cost is the intra-area cost between the two ABRs through the transit area. You cannot set it directly.
  • It runs as a demand circuit, so hellos are suppressed once it is FULL and the LSAs carried across it do not age out.

Once R4 has an area 0 interface (the virtual link), it is an ABR attached to the backbone and passes area 3 routes into area 0.

R4# show ip ospf virtual-links
Virtual Link OSPF_VL0 to router 10.255.255.2 is up
  Run as demand circuit
  DoNotAge LSA allowed.
  Transit area 1, via interface GigabitEthernet0/0
  Transmit Delay is 1 sec, State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:03
    Adjacency State FULL (Hello suppressed)

R4# show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
10.255.255.2      0   FULL/  -           -        10.2.4.2        OSPF_VL0
10.255.255.2      0   FULL/  -        00:00:34    10.2.4.2        GigabitEthernet0/0
10.255.255.6      0   FULL/  -        00:00:37    10.4.6.6        GigabitEthernet0/1

R2 appears twice: once on the physical area 1 link and once on the virtual link OSPF_VL0. The dead time is - on the virtual link because hellos are suppressed.

Virtual link symptom Cause
Virtual Link OSPF_VL0 to router x is down on one side only, or both The far-end router ID is wrong, often typed as an interface address
Virtual link down right after area 0 authentication was enabled No key on the virtual link
IOS refuses the command or the link never comes up after the transit area changed The transit area is now stub or NSSA
Virtual link up, routes still missing The transit area path itself is broken, or the other side has no virtual link configured

Exam trap

A virtual link does not need to be configured in the area you want to connect. The area number in the command is the transit area, the one both ABRs share. area 3 virtual-link ... in the example above would be wrong, because area 3 is the disconnected area.

OSPFv3 notes

OSPFv3 uses the same area types, router roles and virtual link rules, with the same commands under router ospfv3 (outside or inside an address family). The LSA names differ (Inter-Area Prefix instead of Summary, Inter-Area Router instead of ASBR Summary), as covered on the address families page. Use show ospfv3 database and show ospfv3 border-routers for the same checks.

Topology: six IOSv routers. R1 is an ASBR in area 0 and originates a default route (default-information originate always). R2 is the ABR for area 1 (normal, transit). R4 is the ABR between area 1 and area 3, joined to area 0 by a virtual link. R3 is the ABR for area 2, an NSSA, where R5 redistributes 192.168.5.0/24 from a static route.

graph LR
  subgraph A0 ["Area 0"]
    R1["R1 ASBR<br/>default originate"]
    R3["R3 ABR"]
  end
  subgraph A1 ["Area 1, transit"]
    R2["R2 ABR"]
    R4["R4 ABR"]
  end
  subgraph A3 ["Area 3"]
    R6["R6<br/>Lo60 10.6.60.1/24"]
  end
  subgraph A2 ["Area 2, NSSA"]
    R5["R5 ASBR<br/>192.168.5.0/24"]
  end
  R1 -- "10.1.2.0/30" --- R2
  R1 -- "10.1.3.0/30" --- R3
  R2 -- "10.2.4.0/30" --- R4
  R4 -- "10.4.6.0/30" --- R6
  R3 -- "10.3.5.0/30" --- R5
  R2 -. "VL area 1" .- R4

Baseline (router configuration only)

! R1
router ospf 1
 router-id 10.255.255.1
 default-information originate always
! R2
router ospf 1
 router-id 10.255.255.2
 area 1 virtual-link 10.255.255.4
! R3
router ospf 1
 router-id 10.255.255.3
 area 2 nssa default-information-originate
! R4
router ospf 1
 router-id 10.255.255.4
 area 1 virtual-link 10.255.255.2
! R5
ip route 192.168.5.0 255.255.255.0 Null0
router ospf 1
 router-id 10.255.255.5
 area 2 nssa
 redistribute static subnets
! R6
router ospf 1
 router-id 10.255.255.6

Interfaces use ip ospf 1 area <n> and ip ospf network point-to-point as shown in the diagram. Verify: R1 has O IA 10.6.60.0/24 and O E2 192.168.5.0/24; R5 has O*N2 0.0.0.0/0; show ip ospf virtual-links on R2 shows the link up.

Tickets

  1. Area 3 is unreachable from everywhere. Fault: on R4 change the virtual link to area 1 virtual-link 10.2.4.2. Proof: show ip ospf virtual-links shows the link down and the configured address is an interface IP. Fix: use R2's router ID.
  2. The virtual link drops after a security change. Fault: on R1, R2, R3 and R4 add area 0 authentication message-digest and per-interface keys on physical area 0 links only. Proof: physical neighbors fine, OSPF_VL0 gone. Fix: add message-digest-key 1 md5 <key> to the virtual link on R2 and R4.
  3. Someone made area 1 a stub to "save memory". Fault: area 1 stub on R2 and R4. Proof: the virtual link is rejected or down, area 3 routes vanish. Fix: return area 1 to normal (a transit area cannot be stub).
  4. R2 and R4 lose their adjacency. Fault: area 1 stub on R4 only. Proof: debug shows a stub/transit option bit mismatch. Fix: agree on the area type on both.
  5. R5 cannot reach the internet. Fault: on R3 change to area 2 nssa without default-information-originate. Proof: R5 has no O*N2 default; the Type 5 default from R1 is not allowed into an NSSA. Fix: restore the option, or make it totally NSSA.
  6. Change request: R5 should see only its own area plus a default. Task: make area 2 totally NSSA with area 2 nssa no-summary on R3. Verify O*IA 0.0.0.0/0 on R5 and no O IA routes. Note that the totally NSSA Type 3 default replaces the need for the Type 7 default.

Quick check

Which LSA type tells routers in area 1 how to reach an ASBR located in area 0?

Type 4 (ASBR Summary), originated by the area 1 ABR. Without it, routers in area 1 can see the Type 5 LSA but cannot calculate a path to the advertising ASBR.

A stub area is changed to totally stubby by adding no-summary on every router in the area except the ABR. What changes?

Nothing. no-summary only affects the ABR, which is the router that originates Type 3 LSAs into the area. The area remains a plain stub until the ABR is changed.

Which router's ID goes in the area 1 virtual-link command on R2, and what is area 1?

The router ID of the ABR at the other end of the virtual link. Area 1 is the transit area that both ABRs belong to, and it must be a normal area.

References