Skip to content
Log in Sign up My account

3.2.b OSPF Multi-Area, Summarization, Filtering and OSPFv3

Blueprint 3.2.b: Configure simple OSPFv2/v3 environments, including multiple normal areas, summarization, and filtering (neighbor adjacency, point-to-point, and broadcast network types, and passive-interface)

This page covers:

  • Multiple normal areas: ABR role, inter-area routes, the backbone rule
  • Summarization: area range on the ABR and summary-address on the ASBR
  • Filtering: area filter-list, area range not-advertise and distribute-list in
  • OSPFv3 for IPv6 and dual stack, in traditional and address-family configuration

Adjacency, network types, DR/BDR and LSA types are on the previous page, OSPF Adjacencies, Network Types and LSAs.

Why multiple areas

A single area works until the LSDB and the SPF runs get large. Every change in an area makes every router in that area rerun SPF. Areas contain that:

  • Type 1 and type 2 LSAs stay inside their area, so a link flap in area 1 triggers SPF only in area 1.
  • Other areas see area 1 only through type 3 summary LSAs from the ABR, which needs a partial calculation, not a full SPF.
  • With area range, the ABR can hide individual prefixes entirely, so a flap inside the range is invisible to other areas.

Rules and roles

Role Definition
Internal router All OSPF interfaces in one area
Backbone router At least one interface in area 0
ABR (area border router) Interfaces in area 0 and at least one other area
ASBR (autonomous system boundary router) Redistributes routes from outside OSPF, originating type 5 LSAs
  • Every non-backbone area must connect to area 0. Inter-area traffic always goes through the backbone. A virtual link can patch a broken design, but it is ENARSI material.
  • An ABR only advertises type 3 LSAs learned from the backbone into non-backbone areas, and from non-backbone areas into the backbone. This is the loop-prevention rule between areas: inter-area routing behaves like distance vector with area 0 as the hub.
  • One router can be ABR and ASBR at the same time.
graph LR
  subgraph A1 ["Area 1"]
    R3["R3 internal<br/>LANs 10.3.0.0/24 to 10.3.3.0/24"]
  end
  subgraph A0 ["Area 0"]
    R2["R2 ABR"]
    R1["R1 backbone<br/>ASBR in week 5"]
  end
  R3 -- "Gi0/0 10.2.3.0/30<br/>type 1 and 2 stay here" --- R2
  R2 -- "Gi0/1 10.1.2.0/30<br/>type 3 for area 1 prefixes" --- R1

Configuration

A multi-area configuration is just an area number per interface. There is no separate "ABR" command: a router becomes an ABR when it has an up interface in area 0 and in another area.

! R2 (ABR)
router ospf 1
 router-id 10.255.255.2
interface GigabitEthernet0/1
 ip ospf network point-to-point
 ip ospf 1 area 0
interface GigabitEthernet0/0
 ip ospf network point-to-point
 ip ospf 1 area 1
interface Loopback0
 ip ospf 1 area 0

R2# show ip ospf | include border|Area
 It is an area border router
    Area BACKBONE(0)
    Area 1

R1# show ip route ospf
O IA     10.2.3.0/30 [110/2] via 10.1.2.2, 00:02:11, GigabitEthernet0/1
O IA     10.3.0.0/24 [110/3] via 10.1.2.2, 00:02:11, GigabitEthernet0/1
O IA     10.3.1.0/24 [110/3] via 10.1.2.2, 00:02:11, GigabitEthernet0/1
O IA     10.3.2.0/24 [110/3] via 10.1.2.2, 00:02:11, GigabitEthernet0/1
O IA     10.3.3.0/24 [110/3] via 10.1.2.2, 00:02:11, GigabitEthernet0/1
O        10.255.255.2/32 [110/2] via 10.1.2.2, 00:02:11, GigabitEthernet0/1
O IA     10.255.255.3/32 [110/3] via 10.1.2.2, 00:02:11, GigabitEthernet0/1

O IA marks inter-area routes, learned from type 3 LSAs.

Exam trap

An area that is not attached to area 0 is not repaired by making its routers ABRs. If R4 connects only to area 1 and area 2, routes from area 2 never reach area 0 through R4, because R4 has no backbone interface and is not a real ABR for that purpose. The answer to "area 2 routes are missing everywhere else" in that design is to connect area 2 to area 0 (or a virtual link, which ENCOR does not test).

Summarization

OSPF can only summarise where LSAs change type: at the ABR (type 1 and 2 information becoming type 3) and at the ASBR (external routes becoming type 5).

Where Command Summarises
ABR area <id> range <network> <mask> under router ospf Intra-area prefixes of the area named in the command, as they are advertised into other areas
ASBR summary-address <network> <mask> under router ospf Redistributed external prefixes 
! R2: summarise area 1 LANs 10.3.0.0/24 to 10.3.3.0/24 into one /22
router ospf 1
 area 1 range 10.3.0.0 255.255.252.0

What happens:

  • The ABR advertises one type 3 LSA for 10.3.0.0/22 instead of four /24s, as long as at least one prefix inside the range exists in area 1.
  • The ABR installs a discard route to Null0 for the summary, so traffic to a non-existent subnet inside the range is dropped instead of following a default route and looping.
  • Routers in area 1 still see the individual /24s. Summarization only affects what leaves the area.
R2# show ip route ospf | include Null0
O        10.3.0.0/22 is a summary, 00:00:41, Null0

R1# show ip route ospf | include 10.3
O IA     10.3.0.0/22 [110/3] via 10.1.2.2, 00:00:40, GigabitEthernet0/1

Exam trap

area 1 range names the area the prefixes come from, not the area you send the summary into. A question that puts the area 1 LANs in area 0 range is a classic wrong answer: nothing in area 0 matches, so nothing is summarised. And area range on an internal router or on an ASBR for external routes does nothing; external routes use summary-address.

Filtering

OSPF routers in one area must have the same LSDB, so you cannot filter LSAs between routers inside an area. You can filter at the ABR (type 3), and you can filter what one router installs in its own routing table.

Tool Where What it does
area <id> filter-list prefix <name> in ABR Filters type 3 LSAs being advertised into the named area
area <id> filter-list prefix <name> out ABR Filters type 3 LSAs being advertised out of the named area
area <id> range <net> <mask> not-advertise ABR Hides the whole range: no type 3 at all for prefixes inside it
distribute-list prefix <name> in Any router Stops matching routes being installed in this router's RIB. The LSDB is not changed and the LSAs keep flooding
summary-address <net> <mask> not-advertise ASBR Hides matching external routes 
! R2: stop 10.3.3.0/24 from leaving area 1
ip prefix-list NO-LAB3 seq 5 deny 10.3.3.0/24
ip prefix-list NO-LAB3 seq 10 permit 0.0.0.0/0 le 32
!
router ospf 1
 area 1 filter-list prefix NO-LAB3 out

R2# show ip ospf database summary 10.3.3.0
            OSPF Router with ID (10.255.255.2) (Process ID 1)
R2#
R1# show ip route 10.3.3.0
% Subnet not in table

The empty LSDB lookup on R2 proves the type 3 for 10.3.3.0/24 is no longer generated into area 0. R3 and R2 still reach 10.3.3.0/24 inside area 1.

graph LR
  R3["R3 area 1<br/>type 1: 10.3.0.0 to 10.3.3.0"] --> R2{"R2 ABR<br/>area 1 filter-list<br/>prefix NO-LAB3 out"}
  R2 -->|"type 3: 10.3.0.0, 10.3.1.0, 10.3.2.0"| R1["R1 area 0"]
  R2 -. "10.3.3.0/24 denied" .-> X["not advertised"]

Exam trap

The prefix list behind a filter has an implicit deny at the end. Without the final permit 0.0.0.0/0 le 32, the filter-list blocks every type 3 LSA, and the other area loses all inter-area routes. The same is true for distribute-list. When a filter "works too well", check for a missing permit-all line.

Exam trap

distribute-list in only changes the router it is configured on. Downstream routers still get the LSAs and still install the route, because their SPF runs on the full LSDB. If a question wants a prefix hidden from a whole area, the answer is a filter on the ABR, not a distribute-list on one router.

OSPFv3

OSPFv3 (RFC 5340) is OSPF for IPv6, and with address families it can carry IPv4 too. The SPF logic, areas, network types, DR/BDR and adjacency states are the same. The differences that get tested are:

OSPFv2 OSPFv3
Runs over IPv4 IPv6, per link
Neighbor addresses, next hops Interface IPv4 address Link-local IPv6 address
Multicast 224.0.0.5 and 224.0.0.6 FF02::5 and FF02::6
Router ID 32-bit Still 32-bit. Must be set manually on an IPv6-only router
Enabled with network or ip ospf area Interface command only
Authentication Built into the OSPF header (plain text, MD5, HMAC-SHA with key chains) No authentication field in the header. Classically uses IPsec (AH or ESP)
Prefix information In type 1 and 2 LSAs Moved to new LSAs (link LSA type 8 and intra-area prefix LSA type 9). Types 1 and 2 only describe topology
Inter-area LSA name Type 3 summary Type 3 inter-area prefix

Requirements: ipv6 unicast-routing globally, an IPv6 address (or at least ipv6 enable) on every OSPFv3 interface, and a router ID.

ipv6 unicast-routing
!
router ospfv3 1
 router-id 10.255.255.2
 address-family ipv6 unicast
  passive-interface Loopback0
  area 1 range 2001:db8:3::/62
 exit-address-family
 address-family ipv4 unicast
  area 1 range 10.3.0.0 255.255.252.0
 exit-address-family
!
interface GigabitEthernet0/1
 ipv6 address 2001:db8:1:2::2/64
 ospfv3 network point-to-point
 ospfv3 1 ipv6 area 0
 ospfv3 1 ipv4 area 0
!
show ospfv3 neighbor
show ospfv3 interface brief
show ospfv3 database
show ipv6 route ospf

ipv6 unicast-routing
!
ipv6 router ospf 1
 router-id 10.255.255.2
 area 1 range 2001:db8:3::/62
!
interface GigabitEthernet0/1
 ipv6 address 2001:db8:1:2::2/64
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
!
show ipv6 ospf neighbor
show ipv6 ospf interface brief
show ipv6 route ospf

With address families, one router ospfv3 process can run an IPv6 instance and an IPv4 instance. Each instance forms its own adjacency over the link-local IPv6 addresses, so IPv6 must be enabled on the interface even for the IPv4 address family. Use the address-family style for dual stack; you can stay with router ospf for IPv4 and use OSPFv3 only for IPv6, which is what most networks do.

R1# show ospfv3 neighbor

          OSPFv3 1 address-family ipv6 (router-id 10.255.255.1)

Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
10.255.255.2      0   FULL/  -        00:00:36    3               GigabitEthernet0/1

R1# show ipv6 route ospf
OI  2001:DB8:2:3::/64 [110/2]
     via FE80::5200:FF:FE02:1, GigabitEthernet0/1
OI  2001:DB8:3::/62 [110/3]
     via FE80::5200:FF:FE02:1, GigabitEthernet0/1

The next hop is R2's link-local address, and the area 1 LANs arrive as one /62 summary. The link-local value depends on the MAC address in your lab.

Exam trap

On a router with no IPv4 addresses at all, the OSPFv3 process does not start until you configure router-id. The router ID is a 32-bit dotted value in both versions, never an IPv6 address. And IPv6 neighbors do not need to share a global prefix on the link, because they talk over link-local addresses.

Lab: dual-stack OSPF across two areas

Topology: module lab R1, R2, R3 (see the module index). Goal: OSPFv2 and OSPFv3 across area 0 and area 1, with summarization and filtering on R2, the ABR. Time target: 30 minutes.

  1. Address all interfaces for IPv4 and IPv6 per the module addressing table. On R3, create Loopback1 to Loopback4 for the "LANs" and set ip ospf network point-to-point on them so they keep their /24 mask.
  2. Configure OSPFv2 process 1 on all three routers with manual router IDs. R1 Gi0/1 and R2 Gi0/1 and both their Loopback0 interfaces are area 0. R2 Gi0/0, R3 Gi0/0 and all R3 loopbacks are area 1. Make every Ethernet link point-to-point and every loopback passive.

  3. Verify the ABR and the inter-area routes:

    R2# show ip ospf border-routers
R2# show ip ospf | include area border
 It is an area border router
R1# show ip route ospf | count O IA

    R1 should show the four R3 LANs, the R2 to R3 link and R3's loopback as O IA.

  4. On R2, filter 10.3.3.0/24 out of area 1 with a prefix list and area 1 filter-list prefix NO-LAB3 out. Confirm R1 lost only that prefix and R2 and R3 still have it. Then remove the filter.

  5. On R2, add area 1 range 10.3.0.0 255.255.252.0. Confirm R1 has one O IA 10.3.0.0/22 and R2 has the Null0 discard route.
  6. Enable ipv6 unicast-routing on all routers and configure OSPFv3 with the address-family style for IPv6 only, mirroring the IPv4 areas. On R2 add area 1 range 2001:db8:3::/62 under address-family ipv6 unicast.

  7. Verify IPv6:

    R1# show ospfv3 neighbor
R1# show ipv6 route ospf
R1# ping 2001:db8:3:2::1 source Loopback0

    Expected: one Full neighbor (10.255.255.2), OI routes for the R2 to R3 link and the /62 summary, both via R2's link-local address, and a successful ping.

  8. Save a baseline: copy running-config flash:week4-ospf.cfg. The eBGP lab on the eBGP page starts from this state.

Quick check

R2 is an ABR between area 0 and area 1. The engineer configures area 0 range 10.3.0.0 255.255.252.0 to summarise the area 1 LANs. R1 in area 0 still sees four /24s. Why?

area range summarises prefixes of the area named in the command. The 10.3.x LANs are in area 1, so the command must be area 1 range 10.3.0.0 255.255.252.0.

An engineer needs to keep 10.3.3.0/24 out of every router in area 0 without changing anything inside area 1. Which configuration on the ABR does it?

area 1 filter-list prefix X out (or area 0 filter-list prefix X in) with a prefix list that denies 10.3.3.0/24 and permits everything else. A distribute-list on one area 0 router would only hide it from that router.

Why does an OSPFv3 IPv4 address family instance need IPv6 enabled on the interface?

OSPFv3 always runs over IPv6 link-local addresses. The IPv4 address family only changes what prefixes are carried, not the transport.

References

  • RFC 2328, OSPF Version 2, and RFC 5340, OSPF for IPv6, at rfc-editor.org
  • RFC 5838, Support of Address Families in OSPFv3, at rfc-editor.org
  • IP Routing: OSPF Configuration Guide and IP Routing: OSPFv3 Configuration Guide for Cisco IOS XE: search on cisco.com
  • Cisco Live On-Demand Library: search "OSPF design" and "IPv6 routing protocols"
  • Related: Sim 03, Sim 04, E24 OSPF multi-area design and LSA flow