Skip to content
Log in Sign up My account

OSPF Multi-Area Lab: Stub, NSSA, Summarization and Authentication

This lab builds a four-router OSPFv2 network with three areas on IOS XE. You start with plain multi-area, then turn area 1 into a stub and a totally stubby area, turn area 2 into an NSSA with an external route, summarize at both ABRs, and finish with authentication. Each stage shows what changes in the routing table and the LSDB, which is the point of the exercise.

Topology

graph LR
    R3["R3<br/>Area 1 internal"] ---|"10.0.13.0/30<br/>Area 1"| R1["R1<br/>ABR 0/1 + ASBR"]
    R1 ---|"10.0.12.0/30<br/>Area 0"| R2["R2<br/>ABR 0/2"]
    R2 ---|"10.0.24.0/30<br/>Area 2"| R4["R4<br/>Area 2 ASBR"]
Router Role Loopbacks
R1 ABR for areas 0 and 1; redistributes a static route (type 5) 1.1.1.1/32 in area 0
R2 ABR for areas 0 and 2; translates NSSA type 7 to type 5 2.2.2.2/32 in area 0
R3 Internal, area 1 10.1.0.1/32
R4 Internal and ASBR, area 2 Lo1 to Lo4: 10.2.0.1/24 to 10.2.3.1/24

Link addressing: R1-R2 is 10.0.12.0/30 (R1 .1, R2 .2), R1-R3 is 10.0.13.0/30 (R1 .1, R3 .2), R2-R4 is 10.0.24.0/30 (R2 .1, R4 .2). Interface names are placeholders.

Step 1: Basic multi-area

! R1
hostname R1
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
 ip ospf 1 area 0
interface GigabitEthernet2
 ip address 10.0.12.1 255.255.255.252
 ip ospf 1 area 0
 ip ospf network point-to-point
 no shutdown
interface GigabitEthernet3
 ip address 10.0.13.1 255.255.255.252
 ip ospf 1 area 1
 ip ospf network point-to-point
 no shutdown
router ospf 1
 router-id 1.1.1.1
ip route 192.0.2.0 255.255.255.0 Null0

! R2
hostname R2
interface Loopback0
 ip address 2.2.2.2 255.255.255.255
 ip ospf 1 area 0
interface GigabitEthernet2
 ip address 10.0.12.2 255.255.255.252
 ip ospf 1 area 0
 ip ospf network point-to-point
 no shutdown
interface GigabitEthernet3
 ip address 10.0.24.1 255.255.255.252
 ip ospf 1 area 2
 ip ospf network point-to-point
 no shutdown
router ospf 1
 router-id 2.2.2.2

! R3
hostname R3
interface Loopback0
 ip address 10.1.0.1 255.255.255.255
 ip ospf 1 area 1
interface GigabitEthernet2
 ip address 10.0.13.2 255.255.255.252
 ip ospf 1 area 1
 ip ospf network point-to-point
 no shutdown
router ospf 1
 router-id 3.3.3.3

! R4
hostname R4
interface Loopback1
 ip address 10.2.0.1 255.255.255.0
 ip ospf 1 area 2
 ip ospf network point-to-point
interface Loopback2
 ip address 10.2.1.1 255.255.255.0
 ip ospf 1 area 2
 ip ospf network point-to-point
interface Loopback3
 ip address 10.2.2.1 255.255.255.0
 ip ospf 1 area 2
 ip ospf network point-to-point
interface Loopback4
 ip address 10.2.3.1 255.255.255.0
 ip ospf 1 area 2
 ip ospf network point-to-point
interface GigabitEthernet2
 ip address 10.0.24.2 255.255.255.252
 ip ospf 1 area 2
 ip ospf network point-to-point
 no shutdown
router ospf 1
 router-id 4.4.4.4
ip route 10.44.0.0 255.255.255.0 Null0
ip route 10.44.1.0 255.255.255.0 Null0

The ip ospf network point-to-point on loopbacks makes OSPF advertise the configured /24 mask. The default loopback network type advertises a /32 host route regardless of mask. On the point-to-point links it removes DR election and speeds up adjacency.

Verify the base state before adding features:

R3# show ip ospf neighbor
R3# show ip route ospf
R3# show ip ospf database

R3 should see O IA routes for 1.1.1.1, 2.2.2.2, the R1-R2 and R2-R4 links, and the four 10.2.x.0/24 loopbacks. All four loopbacks appear as separate inter-area routes because nothing is summarized yet.

Step 2: Redistribute an external route on R1

! R1
router ospf 1
 redistribute static subnets

R1 now originates 192.0.2.0/24 as an external type 5 LSA (E2, metric 20 by default). Check the flooding scope:

R3# show ip route 192.0.2.0
R3# show ip ospf database external
R2# show ip route 192.0.2.0

R3 and R2 both show O E2 192.0.2.0/24. A type 5 LSA floods through every regular area. That is what stub areas are designed to stop.

Step 3: Make area 1 a stub

A stub area blocks type 5 LSAs and the ABR injects a default route in their place. Every router in the area must agree, or the adjacency fails: the E-bit in the Hello options must match.

! R1 and R3
router ospf 1
 area 1 stub

R3# show ip ospf neighbor
R3# show ip route ospf
R3# show ip ospf | include Area|stub

Expect the adjacency to drop and re-form once both ends are configured. On R3 the E2 route for 192.0.2.0/24 is gone and there is now O*IA 0.0.0.0/0 via 10.0.13.1. Inter-area (type 3) routes are still present.

To go further and also drop the inter-area routes, make area 1 totally stubby. Only the ABR needs the no-summary keyword.

! R1 only
router ospf 1
 area 1 stub no-summary

R3 now has just the default route and its connected networks. That is the smallest routing table for a leaf area. The trade-off is that R3 can no longer choose between two ABRs by distance to the specific destination; it follows the default.

Tip

A stub area cannot contain an ASBR and cannot be a transit area for a virtual link. If you need external routes in an area that otherwise wants stub behaviour, that is the NSSA.

Step 4: Make area 2 an NSSA

R4 needs to bring external routes into area 2, so a plain stub will not do. An NSSA (RFC 3101) blocks type 5 LSAs but allows type 7 LSAs originated inside the area. The ABR translates type 7 to type 5 when it floods them out to the rest of the network.

! R2 and R4
router ospf 1
 area 2 nssa

! R4
router ospf 1
 redistribute static subnets

An NSSA ABR does not inject a default route unless you ask. Add one from R2:

! R2
router ospf 1
 area 2 nssa default-information-originate

Verify:

R4# show ip ospf database nssa-external
R4# show ip route ospf
R2# show ip ospf database nssa-external
R1# show ip ospf database external
R1# show ip route 10.44.0.0

On R4 you see its own type 7 LSAs for 10.44.0.0/24 and 10.44.1.0/24, and O*N2 0.0.0.0/0 from R2. R1 shows type 5 LSAs for the 10.44.x routes with R2's router ID as the advertising router, because R2 is the translator. If there are two ABRs in the NSSA, the one with the highest router ID translates.

Step 5: Summarization

There are two kinds, and they run in different places.

Inter-area summarization happens on an ABR with area range. R2 summarizes the four loopbacks of area 2 when advertising them into area 0.

! R2
router ospf 1
 area 2 range 10.2.0.0 255.255.252.0

External summarization happens where external routes enter: on an ASBR with summary-address, or on the NSSA ABR when it translates type 7 to type 5. Here R2 is the translator, so it summarizes the two 10.44 routes.

! R2
router ospf 1
 summary-address 10.44.0.0 255.255.252.0

Verify on R1:

R1# show ip route ospf
R2# show ip route 10.2.0.0
R2# show ip route 10.44.0.0

R1 should show a single O IA 10.2.0.0/22 and a single O E2 10.44.0.0/22. The four /24s and the two /24 externals are gone from area 0. R2 installs a discard route to Null0 for each summary, with administrative distance 110 for the inter-area range and 254 for the external summary. These discard routes prevent loops when the summary covers addresses that are not all reachable.

Cost of an area range is the highest cost among the contributing routes unless you override it with area 2 range ... cost N. Adding not-advertise suppresses the range and its components entirely.

Warning

Summarization hides failures. If one of the four loopbacks goes down, the summary stays up as long as one component remains. This is useful for stability and dangerous if you expect the routing table to tell you about the outage.

Step 6: Authentication

OSPFv2 authentication is configured per interface or per area. The common options are plain text (type 1, do not use), MD5 (type 2) and HMAC-SHA with a key chain (RFC 5709, supported on current IOS XE).

Use MD5 on area 0 with the area-level command for authentication mode and an interface key:

! R1 and R2, area 0 link
router ospf 1
 area 0 authentication message-digest
interface GigabitEthernet2
 ip ospf message-digest-key 1 md5 LabKey123

Use a key chain with SHA-256 on the area 1 link:

! R1 and R3
key chain OSPF-A1
 key 1
  key-string LabKey456
  cryptographic-algorithm hmac-sha-256
! R1 Gi3 and R3 Gi2
interface GigabitEthernet3
 ip ospf authentication key-chain OSPF-A1

Use the right interface on each router. Verify:

R1# show ip ospf interface GigabitEthernet2
R1# show ip ospf interface GigabitEthernet3
R1# show ip ospf neighbor
R1# debug ip ospf adj

The interface output reports the authentication type in use, for example message digest with the youngest key ID, or cryptographic authentication with the key chain name. If you mistype the key on one side, the neighbour goes down after the dead interval and debug ip ospf adj reports an authentication failure or mismatched key. Turn debugging off afterwards with undebug all.

Note

Authentication protects the adjacency from rogue or misconfigured routers. It does not encrypt LSAs. If the area uses area-level authentication, every interface in that area needs a matching key, including interfaces to routers you do not control.

Reading the LSDB

Know which LSA type you are looking at.

Type Name Originated by Flooding scope
1 Router Every router Within the area
2 Network DR Within the area
3 Summary ABR Into other areas (blocked in totally stubby areas)
4 ASBR summary ABR Into other areas, not in stub or NSSA
5 External ASBR Whole domain except stub and NSSA
7 NSSA external ASBR in NSSA Within the NSSA only

Useful commands: show ip ospf database, show ip ospf database summary, show ip ospf border-routers and show ip ospf. The ABR and ASBR flags appear in show ip ospf as "It is an area border router" and "It is an autonomous system boundary router".

Final check

After all steps, R3 should have a default route and local networks only. R4 should have the default plus inter-area routes (R4 is in the NSSA and no-summary was not applied). R1 and R2 should show the summaries described above. Save configs, then break things on purpose: change the area type on one side only, mismatch authentication, or shut the R2-R4 link and watch what the summaries do.

For the exam-focused view of OSPF, use the CCNP home page and the study plan. Next, the BGP lab covers the exterior side.

References