Skip to content
Log in Sign up My account

1.4 OSPF Design

Blueprint 1.4: Stable, secure, and scalable routing designs for OSPF

  • Area design: sizing, placement of ABRs and ASBRs, area types as scaling tools
  • Summarization, filtering and prefix suppression to limit LSA flooding
  • Network types, timers, BFD and SPF/LSA throttling for convergence
  • Authentication and protection against overload
  • OSPF on WAN, DMVPN and multi-area campus designs

OSPF is the default answer in many multi-vendor enterprises, and the exam tests whether you can scale it. Mechanics (LSA types, adjacency states, network types) are in ENCOR OSPF multi-area and the ENARSI pages areas and LSAs, network types and adjacency and authentication. Here the focus is on design choices.

Why areas exist

Every router in an area holds the same link-state database and runs a full SPF when that database changes. Areas limit the scope of the LSDB and of SPF: inside an area routers know every link, but across an area boundary they know only prefixes and costs, like a distance-vector protocol. Smaller areas mean less flooding, fewer SPF runs and faster convergence, at the cost of less topology visibility and more design work.

Design property Single area Multi-area
Operational complexity Lowest Higher (ABR placement, summarization, area 0 continuity)
SPF and flooding scope The whole network One area
Path selection across the network Always shortest by link state Intra-area preferred over inter-area, even when the inter-area path is cheaper
Summarization Not possible At ABRs and ASBRs
Right when Small network, fast hardware, no summary requirement Hundreds of routers, many WAN sites, a need to hide instability

Modern routers handle far larger single areas than the old rules of thumb suggest, so a question will rarely hinge on a hard router count. It will instead mention instability, summarization, or a hub-and-spoke WAN with many sites, which points to multi-area.

Area design rules

  • Area 0 must be contiguous and every other area attaches to it at an ABR. Use a virtual link only as a temporary fix in a merger or migration, never as a design.
  • ABRs belong where the topology naturally divides, such as the distribution layer in a campus or the WAN aggregation routers. Place ABRs where a summary can be generated, since an ABR without a summary only reduces the LSA scope and still floods one Type 3 LSA per prefix.
  • Keep the ABR count per area small (two for redundancy). Every extra ABR multiplies Type 3 LSAs and creates more asymmetric inter-area paths.
  • Align areas with address blocks, as in Addressing Plans. An area per region or per campus building that matches one summary prefix is the target.
  • Do not put ASBRs in area 0 if they redistribute large tables. Place them in a dedicated area (often NSSA) so external route churn stays out of the backbone.
graph TB
    A0["Area 0 backbone: core pair"]
    ABR1["ABR 1 summarizes 10.0.0.0/17"] --- A0
    ABR2["ABR 2 summarizes 10.0.128.0/17"] --- A0
    ABR1 --- AR1["Area 1: campus A"]
    ABR2 --- AR2["Area 2: campus B NSSA"]
    AR2 --- ASBR["ASBR to partner"]

Area types as scaling tools

Area type Blocks Use when
Normal Nothing Backbone and areas that must carry specifics
Stub Type 5 external LSAs, adds a default The area has no ASBR and exits via ABRs
Totally stubby Types 3, 4, 5 except a default Remote sites that only need a default (no-summary on the ABR)
NSSA Type 5 inside the area, ASBR generates Type 7 which the ABR converts to Type 5 The area contains an ASBR (for example a partner or branch static)
Totally NSSA NSSA plus no summary LSAs Small remote area with a local redistribution point

The question to ask is what does the area's router actually need to know? A branch with one exit needs only a default, so totally stubby minimizes its LSDB. A branch with a local firewall injecting a few routes needs NSSA.

Never put an area into stub or totally stubby state if it needs to hold an ASBR or a virtual link, and remember that all routers in the area must agree on the setting or adjacencies do not form (E-bit mismatch).

Summarization, filtering and suppression

Summarization is the main stability tool. Without it, a flapping prefix in one area keeps generating Type 3 LSA updates in every other area, and each update costs flooding and route calculation work on every router.

Mechanism Where Notes
area <n> range ABR Summarizes intra-area prefixes into Type 3 LSAs. The ABR installs a discard route to Null0 for the summary.
summary-address ASBR Summarizes redistributed (external) routes
area <n> filter-list prefix ABR Blocks specific Type 3 prefixes in or out of an area
distribute-list in Any router Filters only what enters the local routing table, not the LSDB, so it cannot stop flooding
Prefix suppression (prefix-suppression) Router or interface Stops advertising transit link prefixes, advertising only loopbacks and passive interfaces. Reduces LSDB size and attack surface.
passive-interface default Router No adjacencies on user-facing interfaces. Prevents rogue neighbours and wasted hellos.

Exam trap

distribute-list in on an OSPF router filters routes from being installed in the RIB. It does not filter LSAs, so the router still floods them and other routers still see the prefix. To keep a prefix out of an area's LSDB you must filter at the ABR with filter-list or area range not-advertise.

Exam trap

Summaries can only be created at ABRs (inter-area) and ASBRs (external). A question that asks to summarize "inside area 0 on a core router" has no valid OSPF answer unless the router is also the ABR for the prefixes involved.

Convergence design

Total failover time is detection plus propagation plus calculation plus FIB programming. Each has a design lever:

Phase Lever
Detection BFD on routed links (ENARSI BFD). Prefer BFD over aggressive hello timers. Fast hellos with sub-second dead intervals add CPU load.
Propagation LSA throttling (timers throttle lsa), LSA pacing, flood-reduction on stable links
Calculation SPF throttling (timers throttle spf), incremental SPF, area sizing
Programming Prioritized installation of critical prefixes where the platform supports it, and platform FIB programming speed
Graceful handling of supervisor failover NSF with graceful restart, Stateful Switchover (SSO)

Also remember the cost design items:

  • Set auto-cost reference-bandwidth consistently on all routers. The default reference of 100 Mbps makes 1 G and 10 G links look identical (cost 1). Set it above the fastest link (for example 100,000 for 100 Gbps) and apply it everywhere.
  • Use ip ospf network point-to-point on routed Ethernet links. This removes DR election, speeds adjacency formation and avoids a DR/BDR failure domain.
  • On a DMVPN, use point-to-multipoint or broadcast network type with the hub as DR, and set DR priority 0 on spokes. Dynamic spoke-to-spoke tunnels work best with broadcast type (Phase 2) or point-to-multipoint with a default or summary from the hub (Phase 3).

Security

  • Authentication: use cryptographic authentication on every interface. OSPFv2 supports key-chain based HMAC-SHA (RFC 5709) in addition to MD5. OSPFv3 uses the authentication trailer (RFC 7166) or IPsec.
  • Passive interfaces by default on user-facing links.
  • TTL security (ip ospf ttl-security) for hop-count checks, so packets that did not originate one hop away are discarded.
  • LSA limits: max-lsa and redistribute maximum-prefix protect a router from being overwhelmed by a leak of external routes.
  • Filter at the boundary between the OSPF domain and untrusted networks. Do not run an IGP across a trust boundary if a BGP session with policy is available.
router ospf 1
 router-id 10.255.0.1
 auto-cost reference-bandwidth 100000
 passive-interface default
 no passive-interface TenGigabitEthernet1/0/1
 area 1 range 10.0.0.0 255.255.248.0
 area 1 nssa no-summary
 max-lsa 50000 75
 prefix-suppression
 bfd all-interfaces
!
interface TenGigabitEthernet1/0/1
 ip ospf network point-to-point
 ip ospf authentication key-chain OSPF-KEYS

OSPFv3 and address families

OSPFv3 carries IPv6 (and IPv4 with address families) using link-local addresses for adjacencies and a per-link instance ID. For a dual-stack design, choose between two separate processes (OSPFv2 plus OSPFv3 IPv6) or one OSPFv3 process with the IPv4 and IPv6 address families. The single-process approach shares timers, authentication and area design across both stacks, which is easier to operate, but both address families must use the same topology and a failure of the process affects both. Separate processes give independent failure domains.

Design exercise

Scenario. A bank has 150 branch routers connected in a hub-and-spoke WAN to two regional data centres, which connect to a core. Today all are in area 0. A flapping access link in one branch triggers SPF on every router, and the data-centre routers show high CPU during failures. Branches have a single exit via one of two data-centre WAN routers. A few branches also redistribute a static route for a local payment terminal network. The security team requires authentication on all adjacencies and wants unnecessary link prefixes hidden.

Requirements and constraints.

  • Contain branch instability to the branch.
  • Branches should hold the smallest possible LSDB.
  • A few branches redistribute local statics.
  • Authenticate adjacencies, hide transit link prefixes.
  • Keep OSPF as the protocol.
Model answer

Design: keep the data centres and core in area 0. Place branches in non-zero areas, grouped by region (for example one area per 25 to 30 branches), with the two data-centre WAN routers as the ABRs. Make each branch area totally NSSA (nssa no-summary) so branches carry only a default plus their area, while the branch with a local static can originate its prefix as a Type 7 LSA that the ABR converts to Type 5. Summarize each region at the ABRs with area range and enable prefix-suppression, key-chain authentication and passive-interface default everywhere.

A flap inside a branch area now causes SPF only inside that area (and a Type 3 update that the summary absorbs), so the data-centre routers and other regions see nothing.

Rejected alternatives:

  • Totally stubby: would block the branches that need to redistribute a static, because stub areas cannot contain an ASBR.
  • One area per branch: maximum containment but 150 areas, and the ABRs would hold 150 LSDBs, which is a poor use of the hub CPU.
  • Keeping a single area and tuning SPF timers: reduces but does not remove the shared failure domain.
  • distribute-list filtering at the data centre: does not reduce LSA flooding or SPF scope.
  • Virtual links to attach distant branch areas: fragile, and a sign the area boundaries are wrong.

Quick check

A router in a stub area needs to learn a partner's routes through a local ASBR. What area type fits?

NSSA. Stub areas cannot contain an ASBR. The ASBR originates Type 7 LSAs that the ABR translates to Type 5 for the rest of the domain.

Why does a core with link bandwidth of 1 G and 10 G choose poor paths with default OSPF costs?

The default reference bandwidth of 100 Mbps gives both links a cost of 1. Raise auto-cost reference-bandwidth on every router so the costs differ.

Does prefix-suppression remove loopbacks from the LSDB?

No. It suppresses transit link prefixes. Loopbacks and prefixes on passive interfaces continue to be advertised.

References

  • IP Routing: OSPF Configuration Guide, Cisco IOS XE (search "OSPF Configuration Guide IOS XE" on cisco.com)
  • RFC 2328 (OSPFv2), RFC 5340 (OSPFv3), RFC 5709 (OSPFv2 HMAC-SHA), RFC 6860 (hiding transit-only networks), RFC 7166 (OSPFv3 authentication trailer) at rfc-editor.org
  • Cisco Live On-Demand Library: search "OSPF design" and "scalable routing"