What Is an OSPF Metric?

Simply put, an OSPF metric is a numerical value that represents the cost of sending traffic across a specific interface or link. The lower the cost, the more desirable the path becomes. OSPF uses this cost system to build the most efficient route from point A to point B.

OSPF cost is typically based on bandwidth, meaning faster links receive lower costs, making them more likely to be selected as primary paths.


Why the OSPF Metric Matters for Network Stability

OSPF runs on the idea of predictable, stable routing. If the metric system were inaccurate or outdated, routers might choose inefficient paths or overwhelm slow links.

The OSPF metric:

  • Prevents congestion by preferring faster links

  • Helps balance traffic evenly

  • Ensures routing stays stable even as a network grows

  • Helps administrators control how data flows

Without accurate metrics, OSPF would struggle to deliver reliable performance.


How OSPF Metric Works in Real-World Networks

Cost-Based Path Selection Explained

OSPF calculates the cumulative cost of every possible route between two nodes. It sums the cost of each interface in the path, and the path with the lowest total cost wins.

For example:

Link SpeedDefault OSPF Cost (Cisco)
10 Mbps10
100 Mbps1
1 Gbps1
10 Gbps1

These values help routers pick the most efficient route.

OSPF Hello Packets and Metric Influence

While Hello packets establish neighbor relationships, they also support the exchange of metric information. Once routers become neighbors, they use LSAs (Link State Advertisements) to share cost values. This keeps every router updated on link speeds and costs.


Factors Affecting OSPF Metric Calculation

1. Reference Bandwidth

The reference bandwidth determines how OSPF converts link speeds into cost values. On Cisco devices, the default reference bandwidth is 100 Mbps, which causes modern links (1G/10G/40G/100G) to all show the same cost unless adjusted.

2. Link Speed and Interface Types

Different interface speeds impact cost significantly:

  • Fiber links → lower cost

  • Wireless links → higher cost

  • Tunnel interfaces → customizable cost

3. Custom Cost Configuration

Administrators can manually override interface cost for traffic engineering. This helps in scenarios like directing critical applications over specific links.


Default OSPF Metric Values

Different vendors assign different defaults:

Cisco Default Costs

Cisco uses:

Cost = Reference Bandwidth / Interface Bandwidth

With default reference at 100 Mbps, anything ≥100 Mbps becomes cost 1.

Other Vendor Defaults

  • Juniper often defaults to different bandwidth references

  • MikroTik allows easy cost modification through WinBox


Adjusting OSPF Metrics for Optimization

Using the “ip ospf cost” Command

Example:

interface GigabitEthernet0/1 ip ospf cost 15

This allows precise tuning.

Auto-Cost Reference Bandwidth Command

To modernize OSPF:

router ospf 1 auto-cost reference-bandwidth 100000

This supports up to 100 Gbps links.

Best Practices

  • Always adjust reference bandwidth on all routers

  • Keep costs consistent across same-speed links

  • Avoid overly complex cost values


Common Use Cases for OSPF Metric Tuning

1. Load Balancing

OSPF supports ECMP (equal-cost multipathing). By aligning costs, you can load-balance traffic.

2. Failover Optimization

By increasing cost on backup links, primary routes remain preferred.

3. Traffic Engineering

Control the flow of critical or heavy applications.


OSPF Metric vs Other Routing Protocol Metrics

OSPF vs EIGRP

OSPF uses cost, while EIGRP uses a more complex composite metric including bandwidth, delay, reliability, and load.

OSPF vs BGP

BGP doesn’t use cost—it uses path attributes.


Troubleshooting OSPF Metric Issues

Common Errors and Fixes

IssueCauseFix
Mismatched costsManual misconfigurationAlign costs
Slow failoverBackup costs too highReduce backup cost
Unexpected pathsIncorrect reference bandwidthStandardize reference

Tools for Metric Verification

  • show ip ospf interface

  • show ip route ospf

  • Wireshark (LSA analysis)


FAQs About OSPF Metric

1. What is the main purpose of the OSPF metric?

To determine the most efficient path through a network based on link cost.

2. How is OSPF cost calculated by default?

It’s based on bandwidth using a reference bandwidth divided by interface bandwidth.

3. Can I manually change the OSPF metric?

Yes—using commands like ip ospf cost.

4. Why do gigabit links show the same cost as 10-gigabit links?

Because the default reference bandwidth is outdated and must be increased.

5. Does OSPF support load balancing using metrics?

Yes—when costs are equal, OSPF uses equal-cost multipath (ECMP).

6. Are OSPF metrics the same across all router vendors?

No—different vendors use different defaults.

Rapid Spanning Tree Protocol (RSTP)

Rapid Spanning Tree Protocol (RSTP) is an evolution of the original STP (IEEE 802.1w) that dramatically reduces network convergence time from 30-50 seconds to under 6 seconds. 

This faster recovery is critical for modern networks where downtime must be minimized.

Key Improvements Over STP

Port States: RSTP simplifies five states (Disabled, Blocking, Listening, Learning, Forwarding) into three:

  • Discarding: Blocks traffic (replaces Disabled, Blocking, Listening)
  • Learning: Learns MAC addresses but doesn't forward
  • Forwarding: Fully operational

Port Roles: RSTP introduces new roles:

  • Root Port: Best path to root bridge
  • Designated Port: Forwards traffic on segment
  • Alternate Port: Backup to root port (instant failover)
  • Backup Port: Backup to designated port
  • Edge Port: Connects to end devices (PortFast equivalent)

Proposal/Agreement Handshake: RSTP uses active negotiation between switches instead of passive timer-based convergence, enabling rapid topology changes.

Practical Example

Consider this network topology:

         [Switch A - Root]
         Priority: 4096
            /        \
       Cost:4      Cost:4
          /            \
    [Switch B]=======[Switch C]
     Cost:19 (backup link)

RSTP Port Assignments:

# Switch A (Root Bridge) - All ports Designated
Port Gi0/1 → Switch B: Designated/Forwarding
Port Gi0/2 → Switch C: Designated/Forwarding

# Switch B
Port Gi0/1 → Switch A: Root Port/Forwarding (best path)
Port Gi0/2 → Switch C: Designated/Forwarding

# Switch C  
Port Gi0/1 → Switch A: Root Port/Forwarding (best path)
Port Gi0/2 → Switch B: Alternate Port/Discarding (backup)

Failover Scenario:

If the link between Switch A and Switch C fails:

# Traditional STP: 30-50 seconds
1. Detect failure (20 sec - MaxAge timer)
2. Listening state (15 sec)
3. Learning state (15 sec)
4. Forwarding state
Total: ~50 seconds downtime

# RSTP: Under 6 seconds
1. Detect failure (immediate)
2. Switch C's Alternate Port (Gi0/2) immediately transitions
3. Proposal/Agreement with Switch B (milliseconds)
4. Port enters Forwarding state
Total: 1-6 seconds downtime

Configuration Example

# Enable RSTP
Switch(config)# spanning-tree mode rapid-pvst

# Configure edge ports (end devices)
Switch(config)# interface range fa0/1-24
Switch(config-if-range)# spanning-tree portfast
Switch(config-if-range)# exit

# Verify RSTP operation
Switch# show spanning-tree summary
Switch is in rapid-pvst mode
Root bridge for: VLAN0001
PortFast Default: disabled

Benefits

  • Fast convergence: Sub-second failover for critical links
  • Backward compatible: Works with legacy STP switches
  • Efficient: Active negotiation vs. passive timers
  • Better redundancy: Alternate/Backup ports pre-calculated

RSTP is the modern standard for loop prevention, providing enterprise-grade reliability with minimal disruption during topology changes.

Spanning Tree Protocol (STP)

Spanning Tree Protocol (STP) is a network protocol that prevents loops in Ethernet networks with redundant paths. 

When switches are connected in a mesh topology for redundancy, data packets can circulate infinitely, causing broadcast storms that crash the network. 

STP solves this by creating a loop-free logical topology.

How STP Works

STP automatically identifies and blocks redundant paths while keeping them as backup routes. It does this by:

  1. Electing a Root Bridge: All switches exchange Bridge Protocol Data Units (BPDUs). The switch with the lowest Bridge ID becomes the root bridge—the reference point for the spanning tree.

  2. Calculating Path Costs: Each switch calculates the shortest path to the root bridge based on link speeds. Lower cost = better path.

  3. Selecting Port Roles: Ports are assigned roles:

    • Root Port: Best path to root bridge
    • Designated Port: Forwards traffic on a segment
    • Blocked Port: Redundant path, blocks traffic
  4. Blocking Redundant Links: Ports that would create loops enter blocking state, preventing traffic but listening for topology changes.

Practical Example

Imagine three switches connected in a triangle:

        [Switch A - Root Bridge]
           /              \
          /                \
     [Switch B]----------[Switch C]

Port states after STP convergence:

  • Switch A (Root Bridge): All ports are Designated Ports (forwarding)
  • Switch B: Port to A = Root Port (forwarding), Port to C = Designated Port (forwarding)
  • Switch C: Port to A = Root Port (forwarding), Port to B = BLOCKED (prevents loop)

Without STP, a broadcast from Switch A would travel to B and C, then bounce between B and C indefinitely. With STP, the B-C link is blocked, creating this logical path:

        [Switch A]
           /      \
          /        \
     [Switch B]   [Switch C]

If the A-C link fails, STP detects the topology change (typically within 30-50 seconds), unblocks the B-C port, and traffic reroutes through B. Modern variants like Rapid STP (RSTP) converge in under 6 seconds.

Key Benefits

  • Prevents broadcast storms and network meltdowns
  • Provides redundancy through automatic failover
  • Works automatically without manual configuration

STP is fundamental to enterprise networks, ensuring reliability while maintaining redundant connections for fault tolerance.

STP Configuration Examples

Here are practical configuration examples for enabling and configuring Spanning Tree Protocol on Cisco switches:

Basic STP Configuration

# Enter global configuration mode
Switch> enable
Switch# configure terminal

# Enable Spanning Tree (enabled by default on Cisco)
Switch(config)# spanning-tree mode pvst
# Options: pvst (Per-VLAN STP), rapid-pvst, mst

# Set bridge priority to influence root bridge election
# Lower priority = more likely to become root (default: 32768)
Switch(config)# spanning-tree vlan 1 priority 4096
# Priority must be in increments of 4096 (0-61440)

# Or use shortcut to make this switch root
Switch(config)# spanning-tree vlan 1 root primary

# Configure port cost (influences path selection)
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# spanning-tree cost 4
Switch(config-if)# exit

# Configure port priority (lower = preferred)
Switch(config)# interface gigabitEthernet 0/2
Switch(config-if)# spanning-tree port-priority 64
Switch(config-if)# exit

Rapid STP (RSTP) Configuration

# Enable Rapid Per-VLAN Spanning Tree
Switch(config)# spanning-tree mode rapid-pvst

# Configure PortFast for access ports (skips listening/learning)
Switch(config)# interface fastEthernet 0/5
Switch(config-if)# spanning-tree portfast
Switch(config-if)# exit

# Enable BPDU Guard (shuts port if BPDU received)
Switch(config)# interface fastEthernet 0/5
Switch(config-if)# spanning-tree bpduguard enable
Switch(config-if)# exit

Verification Commands

# View spanning tree status
Switch# show spanning-tree

# View STP for specific VLAN
Switch# show spanning-tree vlan 1

# View brief summary
Switch# show spanning-tree summary

# View root bridge information
Switch# show spanning-tree root

# View interface STP details
Switch# show spanning-tree interface gigabitEthernet 0/1

# View STP topology changes
Switch# show spanning-tree detail

Sample Output

Switch# show spanning-tree vlan 1

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    4097
             Address     0019.e86a.6f80
             This bridge is the root
             
  Bridge ID  Priority    4097
             Address     0019.e86a.6f80
             
Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- ----
Gi0/1            Desg FWD 4         128.1    P2p
Gi0/2            Desg FWD 4         128.2    P2p

Key Status Codes:

  • FWD = Forwarding
  • BLK = Blocking
  • LRN = Learning
  • LIS = Listening

These configurations ensure your network has loop prevention while maintaining redundancy!

Layer 3 Forwarding in Network Switches

Layer 3 forwarding enables switches to route IP packets between different VLANs and subnets, combining traditional switching with routing capabilities. 

Layer 3 switches make forwarding decisions based on IP addresses rather than MAC addresses, providing faster inter-VLAN routing than external routers.

Key Characteristics

Layer 3 forwarding features include:

  • IP routing: Routes packets between different subnets/VLANs
  • Hardware-based: Uses ASICs for wire-speed routing
  • SVI (Switched Virtual Interfaces): Virtual interfaces for each VLAN
  • Routing protocols: Supports OSPF, EIGRP, BGP, and static routing

How Layer 3 Forwarding Works

The switch examines the destination IP address in the packet header, consults its routing table, and forwards the packet to the appropriate interface or VLAN. This process happens in hardware at line rate, making it much faster than traditional router-on-a-stick configurations.

Configuration Examples

Basic Inter-VLAN Routing

! Enable IP routing globally
Switch(config)# ip routing

! Create VLAN 10
Switch(config)# vlan 10
Switch(config-vlan)# name Sales
Switch(config-vlan)# exit

! Create VLAN 20
Switch(config)# vlan 20
Switch(config-vlan)# name Engineering
Switch(config-vlan)# exit

! Configure SVI for VLAN 10
Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit

! Configure SVI for VLAN 20
Switch(config)# interface vlan 20
Switch(config-if)# ip address 192.168.20.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit

Static Routing Configuration

! Add static route to remote network
Switch(config)# ip route 10.0.0.0 255.255.255.0 192.168.100.1

! Default route for internet access
Switch(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1

Dynamic Routing with OSPF

! Enable OSPF routing
Switch(config)# router ospf 1
Switch(config-router)# router-id 1.1.1.1
Switch(config-router)# network 192.168.10.0 0.0.0.255 area 0
Switch(config-router)# network 192.168.20.0 0.0.0.255 area 0
Switch(config-router)# exit

Layer 3 Physical Interface

! Configure routed port (no switching)
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# no switchport
Switch(config-if)# ip address 10.1.1.1 255.255.255.252
Switch(config-if)# no shutdown
Switch(config-if)# exit

Verification Commands

! Display routing table
Switch# show ip route

! Show interface IP configuration
Switch# show ip interface brief

! Verify routing protocols
Switch# show ip protocols

! Check CEF (Cisco Express Forwarding)
Switch# show ip cef

! Display ARP table
Switch# show ip arp

Common Use Cases

Layer 3 forwarding excels in:

  • Campus networks: Fast inter-VLAN routing in building distributions
  • Data centers: High-speed routing between server VLANs
  • Collapsed core designs: Combining routing and switching functions
  • Reducing latency: Hardware-based routing eliminates router bottlenecks

Best Practices

Use SVIs for VLAN routing and routed ports for WAN connections. Enable CEF for optimal performance. Implement routing protocols carefully to avoid loops. Always configure appropriate access lists for security between VLANs.

Trunk Ports in Layer 2 Switching

Trunk ports are switch ports configured to carry traffic for multiple VLANs simultaneously. 

They use VLAN tagging protocols to identify which VLAN each frame belongs to, making them essential for inter-switch communications and connecting to routers or servers that need access to multiple VLANs.

Key Characteristics

Trunk ports have these defining features:

  • Multiple VLAN support: Carry traffic for many VLANs on a single link
  • VLAN tagging: Use 802.1Q or ISL protocols to tag frames
  • Switch-to-switch connectivity: Primary method for connecting switches
  • Native VLAN: One VLAN remains untagged for backward compatibility

How Trunk Ports Work

When a frame enters a trunk port, the switch reads the VLAN tag to determine which VLAN it belongs to. Frames are tagged with a 4-byte 802.1Q header containing the VLAN ID. The native VLAN (default VLAN 1) sends untagged traffic, while all other VLANs are tagged.

Configuration Examples

Basic Cisco Trunk Configuration

! Enter interface configuration mode
Switch(config)# interface GigabitEthernet0/1

! Set port to trunk mode
Switch(config-if)# switchport mode trunk

! Specify trunking protocol (802.1Q)
Switch(config-if)# switchport trunk encapsulation dot1q

! Set native VLAN (optional, default is VLAN 1)
Switch(config-if)# switchport trunk native vlan 99

! Allow specific VLANs only
Switch(config-if)# switchport trunk allowed vlan 10,20,30,40

! Exit and save
Switch(config-if)# end
Switch# write memory

Advanced Trunk Configuration

! Configure trunk with VLAN pruning
Switch(config)# interface GigabitEthernet0/2

Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk encapsulation dot1q

! Allow VLANs 10-50 except 25
Switch(config-if)# switchport trunk allowed vlan 10-24,26-50

! Add VLANs to existing allowed list
Switch(config-if)# switchport trunk allowed vlan add 60,70

! Remove VLANs from allowed list
Switch(config-if)# switchport trunk allowed vlan remove 15

Verification Commands

! Show trunk status and VLANs
Switch# show interfaces trunk

! Detailed trunk information
Switch# show interfaces GigabitEthernet0/1 switchport

! Show native VLAN mismatches
Switch# show spanning-tree inconsistentports

Common Use Cases

Trunk ports are essential for:

  • Inter-switch links: Connecting multiple switches in a network
  • Router connections: Connecting to router subinterfaces for inter-VLAN routing
  • Virtualization servers: Connecting ESXi or Hyper-V hosts needing multiple VLANs
  • Wireless controllers: Distributing multiple SSIDs across VLANs

Best Practices

Always manually configure trunk ports rather than using DTP (Dynamic Trunking Protocol). Change the native VLAN from default VLAN 1 for security. Explicitly define allowed VLANs to reduce unnecessary broadcast traffic. Match native VLANs on both ends of trunk links to avoid connectivity issues.

Security Considerations

Disable DTP with switchport nonegotiate to prevent VLAN hopping attacks. Avoid using VLAN 1 as the native VLAN, and never allow all VLANs on trunks unnecessarily.

Access Ports

Access ports are switch ports configured to carry traffic for a single VLAN. They're the most common port type used to connect end devices like computers, printers, phones, and servers to a network switch.

Key Characteristics

Access ports operate at Layer 2 of the OSI model and have these defining features:

  • Single VLAN membership: Each access port belongs to only one VLAN
  • Untagged traffic: Frames leaving the port have no VLAN tag (the switch strips it)
  • End device connectivity: Designed for devices that don't understand VLAN tagging
  • Simple configuration: Minimal setup required compared to trunk ports

How Access Ports Work

When a frame arrives at an access port from a connected device, the switch adds the configured VLAN tag internally. When sending frames out an access port, the switch removes the VLAN tag, so the end device receives untagged Ethernet frames. This transparent operation allows devices to communicate within their VLAN without VLAN awareness.

Configuration Examples

Cisco IOS Configuration

! Enter interface configuration mode
Switch(config)# interface FastEthernet0/1

! Set port to access mode
Switch(config-if)# switchport mode access

! Assign to VLAN 10
Switch(config-if)# switchport access vlan 10

! Optional: Enable PortFast for faster connectivity
Switch(config-if)# spanning-tree portfast

! Exit and save
Switch(config-if)# end
Switch# write memory

Multiple Port Configuration

! Configure multiple ports simultaneously
Switch(config)# interface range FastEthernet0/1-24

Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 20
Switch(config-if-range)# spanning-tree portfast
Switch(config-if-range)# exit

Verification Commands

! Show interface switchport status
Switch# show interfaces FastEthernet0/1 switchport

! Display VLAN assignments
Switch# show vlan brief

! Check interface status
Switch# show interfaces status

Common Use Cases

Access ports are ideal for:

  • Connecting user workstations to departmental VLANs
  • Isolating guest WiFi access points
  • Segmenting IP phones onto voice VLANs
  • Connecting printers to management VLANs
  • Securing server connections to specific VLANs

Best Practices

Always explicitly configure ports as access ports rather than relying on defaults. Disable unused ports and assign them to an unused VLAN for security. Use PortFast on access ports to reduce convergence time, but never on ports connected to other switches.

Virtual LANs (VLANs)

A VLAN (Virtual Local Area Network) is a logical grouping of devices on different physical network segments into a single broadcast domain. 

VLANs provide network segmentation without requiring separate physical switches.

Why Use VLANs?

Benefits:

  • Security: Isolates sensitive traffic from general network
  • Performance: Reduces broadcast domain size, improving bandwidth
  • Flexibility: Logically groups users regardless of physical location
  • Cost-effective: No need for separate physical infrastructure
  • Simplified management: Easier moves, adds, and changes

How VLANs Work

Without VLANs, all ports on a switch belong to one broadcast domain. 

With VLANs, you create multiple isolated broadcast domains on a single switch.

Key Concepts:

  • VLAN 1: Default VLAN (native), cannot be deleted
  • Data VLANs: Carry user-generated traffic (VLAN 10-1005)
  • Voice VLANs: Dedicated for VoIP traffic
  • Management VLAN: Used for switch management

Configuration Example

Scenario: Office Network Segmentation

Requirements:

  • VLAN 10: Management (IT Department)
  • VLAN 20: Sales Department
  • VLAN 30: Finance Department
  • VLAN 40: Guest Network

Basic VLAN Configuration

Switch(config)# vlan 10
Switch(config-vlan)# name MANAGEMENT
Switch(config-vlan)# exit

Switch(config)# vlan 20
Switch(config-vlan)# name SALES
Switch(config-vlan)# exit

Switch(config)# vlan 30
Switch(config-vlan)# name FINANCE
Switch(config-vlan)# exit

Switch(config)# vlan 40
Switch(config-vlan)# name GUEST
Switch(config-vlan)# exit

Assigning Ports to VLANs (Access Ports)

Switch(config)# interface FastEthernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# exit

Switch(config)# interface range FastEthernet0/2-5
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 20
Switch(config-if-range)# exit

Switch(config)# interface range FastEthernet0/6-10
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 30
Switch(config-if-range)# exit

Switch(config)# interface range FastEthernet0/11-15
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 40

Verification Commands

Switch# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/16-24, Gi0/1-2
10   MANAGEMENT                       active    Fa0/1
20   SALES                            active    Fa0/2-5
30   FINANCE                          active    Fa0/6-10
40   GUEST                            active    Fa0/11-15
Switch# show interfaces FastEthernet0/2 switchport
Name: Fa0/2
Switchport: Enabled
Administrative Mode: access
Operational Mode: access
Access Mode VLAN: 20 (SALES)
Trunking Native Mode VLAN: 1 (default)

VLAN Trunking (Inter-Switch Communication)

To allow VLANs to span multiple switches, configure trunk ports using 802.1Q.

Trunk Configuration

Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30,40
Switch(config-if)# switchport trunk native vlan 99
Switch(config-if)# exit

Verification:

Switch# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/1       on           802.1q         trunking      99

Port        Vlans allowed on trunk
Gi0/1       10,20,30,40

Port        Vlans allowed and active in management domain
Gi0/1       10,20,30,40

Inter-VLAN Routing (Router-on-a-Stick)

VLANs cannot communicate without a Layer 3 device (router or Layer 3 switch).

Router Configuration

Router(config)# interface GigabitEthernet0/0
Router(config-if)# no shutdown
Router(config-if)# exit

Router(config)# interface GigabitEthernet0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0
Router(config-subif)# exit

Router(config)# interface GigabitEthernet0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0
Router(config-subif)# exit

Router(config)# interface GigabitEthernet0/0.30
Router(config-subif)# encapsulation dot1Q 30
Router(config-subif)# ip address 192.168.30.1 255.255.255.0

Layer 3 Switch (SVI) Method

Switch(config)# ip routing
Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit

Switch(config)# interface vlan 20
Switch(config-if)# ip address 192.168.20.1 255.255.255.0
Switch(config-if)# no shutdown

Voice VLAN Example

Separates voice traffic from data traffic on the same port.

Switch(config)# interface FastEthernet0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 20
Switch(config-if)# switchport voice vlan 50
Switch(config-if)# mls qos trust cos

Result: PC traffic uses VLAN 20, IP phone uses VLAN 50.

Troubleshooting Commands

Switch# show vlan
Switch# show vlan id 20
Switch# show interfaces switchport
Switch# show interfaces trunk
Switch# show mac address-table vlan 20

Best Practices

  1. Don't use VLAN 1 for production traffic (security risk)
  2. Document VLAN assignments clearly
  3. Use descriptive names for VLANs
  4. Implement proper security with port-security
  5. Prune unnecessary VLANs from trunks
  6. Use native VLAN other than 1 on trunks
  7. Limit broadcast domains to reasonable sizes (250-500 hosts)

VLANs are essential for modern network design, providing logical segmentation, improved security, and efficient traffic management across enterprise networks.

Collision Domain in Cisco Switches

A collision domain is a network segment where data packets can collide with each other when being transmitted. Understanding collision domains is fundamental to network design and explains why switches are superior to hubs.

What is a Collision Domain?

When two devices transmit simultaneously on the same network segment, their signals collide, causing both transmissions to fail. The devices must then wait and retransmit using CSMA/CD (Carrier Sense Multiple Access with Collision Detection).

Key Concept: Each collision increases network latency and reduces throughput.

Hub vs Switch Behavior

Hub (Legacy Device)

Characteristics:

  • Operates at Layer 1 (Physical)
  • Creates ONE large collision domain
  • Broadcasts all traffic to all ports
  • Half-duplex operation only

Example Topology:

PC1 ----\
PC2 -----[HUB]---- PC4
PC3 ----/

Result: All 4 PCs share ONE collision domain. If PC1 and PC2 transmit simultaneously, collision occurs.

Performance Impact:

  • Maximum efficiency: ~40-60% bandwidth utilization
  • Frequent collisions with more devices
  • Network degradation as hosts increase

Switch (Modern Device)

Characteristics:

  • Operates at Layer 2 (Data Link)
  • Each port = separate collision domain
  • Forwards frames only to destination port
  • Supports full-duplex operation

Example Topology:

PC1 ----\
PC2 -----[SWITCH]---- PC4
PC3 ----/

Result: 4 separate collision domains (one per port). PC1 and PC2 can transmit simultaneously without collision.

Practical Configuration Example

Verifying Switch Port Status

Switch# show interfaces status

Port      Name       Status       Vlan       Duplex  Speed Type
Gi0/1     PC1        connected    1          a-full  a-1000 10/100/1000BaseTX
Gi0/2     PC2        connected    1          a-full  a-1000 10/100/1000BaseTX
Gi0/3     PC3        connected    1          a-half  a-100  10/100/1000BaseTX
Gi0/4     PC4        connected    1          a-full  a-1000 10/100/1000BaseTX

Analysis:

  • Gi0/1, Gi0/2, Gi0/4: Full-duplex = NO collision domain (simultaneous send/receive)
  • Gi0/3: Half-duplex = collision domain exists (cannot send and receive simultaneously)

Configuring Duplex Settings

Switch(config)# interface GigabitEthernet0/3
Switch(config-if)# duplex full
Switch(config-if)# speed 1000
Switch(config-if)# exit

Verification:

Switch# show interfaces GigabitEthernet0/3
GigabitEthernet0/3 is up, line protocol is up
  Hardware is Gigabit Ethernet, address is 0023.5678.9abc
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec
  Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
  
Switch# show interfaces GigabitEthernet0/3 | include collision
  0 collisions, 0 interface resets

Checking for Collisions

Switch# show interfaces GigabitEthernet0/3 counters errors

Port        Align-Err    FCS-Err   Xmit-Err    Rcv-Err  UnderSize  OutDiscards
Gi0/3               0          0          0          0          0            0

Port      Single-Col  Multi-Col   Late-Col  Excess-Col  Carri-Sen      Runts
Gi0/3              0          0          0           0          0          0

Collision Counters:

  • Single-Col: Frame collided once before successful transmission
  • Multi-Col: Frame collided multiple times
  • Late-Col: Collision after 64 bytes transmitted (duplex mismatch indicator)
  • Excess-Col: Frame dropped after 16 collision attempts

Duplex Mismatch Detection

Common Problem: One side configured full-duplex, other side half-duplex.

Switch# show interfaces GigabitEthernet0/3 | include duplex
  Full-duplex, 1000Mb/s

Switch# show interfaces GigabitEthernet0/3 | include collision|error
  5234 late collisions, 0 deferred
  125 input errors, 98 CRC, 0 frame

Symptoms:

  • High late collision count
  • Poor performance
  • Packet loss

Fix:

Switch(config)# interface GigabitEthernet0/3
Switch(config-if)# duplex auto
Switch(config-if)# speed auto

Modern Network Reality

Full-Duplex Advantage:

  • No collisions possible
  • Simultaneous send/receive
  • 100% bandwidth utilization
  • No CSMA/CD needed

Best Practices:

  1. Use auto-negotiation for most connections
  2. Manually configure critical uplinks for consistency
  3. Always use full-duplex when possible
  4. Monitor collision counters regularly
  5. Replace hubs with switches immediately

Summary Table

Device Collision Domains Broadcast Domains Performance
Hub 1 (all ports) 1 Poor
Switch (half-duplex) 1 per port 1 per VLAN Good
Switch (full-duplex) 0 (no collisions) 1 per VLAN Excellent

Modern Cisco switches effectively eliminate collision domains through microsegmentation and full-duplex operation, dramatically improving network performance compared to legacy hub-based networks.

Common OSPF Optimization Techniques

OSPF optimization improves network performance, reduces convergence time, and minimizes resource consumption. Here are essential optimization techniques with configuration examples.

1. Tuning SPF Timers

SPF calculations consume CPU resources. Tuning timers prevents excessive recalculations during network instability.

Default Behavior:

  • SPF delay: 5 seconds
  • SPF holdtime: 10 seconds

Configuration:

R1(config)# router ospf 1
R1(config-router)# timers throttle spf 1000 5000 10000

Explanation:

  • First value (1000ms): Initial SPF delay
  • Second value (5000ms): Minimum hold time between calculations
  • Third value (10000ms): Maximum wait time

Benefits: Reduces CPU load during network flapping while maintaining fast convergence.

2. Stub Area Configuration

Stub areas reduce LSA flooding and routing table size by blocking Type-5 external LSAs.

Total Stub Area:

R1(config)# router ospf 1
R1(config-router)# area 1 stub

Totally Stubby Area (Cisco proprietary):

R1(config)# router ospf 1
R1(config-router)# area 1 stub no-summary

Not-So-Stubby Area (NSSA):

R1(config)# router ospf 1
R1(config-router)# area 2 nssa
R1(config-router)# area 2 nssa no-summary

Benefits:

  • Reduces memory usage (fewer LSAs)
  • Faster convergence (smaller LSDB)
  • Lower bandwidth consumption

3. LSA Throttling

Controls LSA generation rate to prevent flooding during topology changes.

R1(config)# router ospf 1
R1(config-router)# timers throttle lsa all 100 1000 5000

Parameters:

  • Start interval: 100ms
  • Hold interval: 1000ms
  • Max interval: 5000ms

4. Passive Interface Configuration

Prevents unnecessary Hello packets and adjacency formation on interfaces without OSPF neighbors.

R1(config)# router ospf 1
R1(config-router)# passive-interface default
R1(config-router)# no passive-interface GigabitEthernet0/0
R1(config-router)# no passive-interface GigabitEthernet0/1

Benefits: Reduces CPU usage, bandwidth, and security risks.

5. Route Summarization

Aggregates multiple routes into single summary routes at area boundaries.

R1(config)# router ospf 1
R1(config-router)# area 1 range 10.1.0.0 255.255.252.0
R1(config-router)# summary-address 192.168.0.0 255.255.0.0

Benefits:

  • Smaller routing tables
  • Reduced LSA flooding
  • Improved convergence time
  • Topology change isolation

6. Reference Bandwidth Adjustment

Ensures accurate cost calculation for high-speed interfaces (>100Mbps).

R1(config)# router ospf 1
R1(config-router)# auto-cost reference-bandwidth 100000

Explanation: Sets reference to 100Gbps (100,000 Mbps). Must be consistent across all routers.

7. Demand Circuit Configuration

Suppresses periodic Hello and LSA refresh on expensive links (satellite, ISDN).

R1(config)# interface Serial0/0
R1(config-if)# ip ospf demand-circuit

Benefits: Reduces link utilization on costly circuits.

8. Incremental SPF (iSPF)

Performs partial SPF calculations instead of full recalculations.

R1(config)# router ospf 1
R1(config-router)# ispf

Benefits: Faster convergence with reduced CPU usage.

9. Fast Hello Packets

Achieves subsecond failure detection.

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip ospf dead-interval minimal hello-multiplier 4

Explanation: Sends 4 Hellos per second (250ms intervals). Dead interval = 1 second.

Warning: Increases CPU and bandwidth usage.

10. LSA Pacing

Controls timing of LSA transmission, grouping, and aging.

R1(config)# router ospf 1
R1(config-router)# timers pacing flood 10
R1(config-router)# timers pacing lsa-group 100
R1(config-router)# timers pacing retransmission 100

Verification Commands

R1# show ip ospf
R1# show ip ospf statistics
R1# show ip ospf interface
R1# show processes cpu | include OSPF
R1# show ip ospf database database-summary

Best Practices

  1. Implement hierarchical design - proper area structure
  2. Use summarization wherever possible
  3. Configure stub areas for edge networks
  4. Tune timers carefully - balance convergence vs stability
  5. Monitor CPU/memory after changes
  6. Document all optimizations for troubleshooting
  7. Test in lab before production deployment

Proper OSPF optimization significantly improves network scalability, stability, and performance while reducing resource consumption.

OSPF Troubleshooting Examples

OSPF issues typically involve neighbor adjacency failures, routing problems, or configuration mismatches. Here are common scenarios with troubleshooting commands and solutions.

Problem 1: Neighbors Not Forming Adjacency

Symptom:

R1# show ip ospf neighbor
(No output or neighbor stuck in INIT/2WAY state)

Troubleshooting Steps:

R1# show ip ospf interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet Address 10.1.1.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST
  Timer intervals configured, Hello 10, Dead 40, Wait 40
  
R1# debug ip ospf adj
OSPF-1 ADJ Gi0/0: Rcv pkt from 10.1.1.2 : Mismatched hello parameters from 10.1.1.2
OSPF-1 ADJ Gi0/0: Dead timer mismatch

Common Causes and Solutions:

Issue: Mismatched Hello/Dead Timers

R1# show ip ospf interface brief
Interface    PID   Area   IP Address      Cost  State Nbrs
Gi0/0        1     0      10.1.1.1/24     1     DR    0

R2# show ip ospf interface brief
Interface    PID   Area   IP Address      Cost  State Nbrs
Gi0/0        1     0      10.1.1.2/24     1     BDR   0

Fix on R2:

R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip ospf hello-interval 10
R2(config-if)# ip ospf dead-interval 40

Issue: Area Mismatch

R1 in Area 0, R2 in Area 1:

R1# show ip ospf interface Gi0/0 | include Area
  Internet Address 10.1.1.1/24, Area 0

R2# show ip ospf interface Gi0/0 | include Area
  Internet Address 10.1.1.2/24, Area 1

Fix on R2:

R2(config)# router ospf 1
R2(config-router)# no network 10.1.1.0 0.0.0.255 area 1
R2(config-router)# network 10.1.1.0 0.0.0.255 area 0

Issue: Authentication Mismatch

R1# debug ip ospf adj
OSPF-1 ADJ Gi0/0: Send with youngest Key 1
OSPF-1 ADJ Gi0/0: Rcv pkt from 10.1.1.2 : Mismatch Authentication type

Fix on R2:

R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip ospf message-digest-key 1 md5 SECRET_PASS
R2(config-if)# ip ospf authentication message-digest

Problem 2: Routes Not Appearing in Routing Table

Symptom:

R1# show ip route ospf
(Missing expected routes)

Troubleshooting:

R1# show ip ospf database

            OSPF Router with ID (1.1.1.1)
            
            Router Link States (Area 0)
Link ID         ADV Router      Age   Seq#       Checksum
1.1.1.1         1.1.1.1         345   0x80000005 0x00A8B3
2.2.2.2         2.2.2.2         123   0x80000003 0x009A45

R1# show ip ospf database router 2.2.2.2
(Check if expected networks are advertised)

Issue: Network Statement Missing

R2# show ip protocols
Routing Protocol is "ospf 1"
  Router ID 2.2.2.2
  Routing for Networks:
    10.1.1.0 0.0.0.255 area 0
  (Missing 10.2.2.0 network)

Fix on R2:

R2(config)# router ospf 1
R2(config-router)# network 10.2.2.0 0.0.0.255 area 0

Issue: Passive Interface Blocking Adjacency

R1# show ip ospf interface
GigabitEthernet0/0 is up, line protocol is up
  OSPF not enabled on this interface

Check and Fix:

R1# show ip protocols
Routing Protocol is "ospf 1"
  Passive Interface(s):
    GigabitEthernet0/0

R1(config)# router ospf 1
R1(config-router)# no passive-interface GigabitEthernet0/0

Problem 3: Stuck in EXSTART State

Symptom:

R1# show ip ospf neighbor
Neighbor ID     Pri   State      Dead Time   Interface
2.2.2.2          1    EXSTART    00:00:35    Gi0/0

Cause: MTU mismatch

Troubleshooting:

R1# show interfaces GigabitEthernet0/0 | include MTU
  MTU 1500 bytes

R2# show interfaces GigabitEthernet0/0 | include MTU
  MTU 1400 bytes

Fix on R2:

R2(config)# interface GigabitEthernet0/0
R2(config-if)# mtu 1500

Alternative (ignore MTU mismatch):

R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip ospf mtu-ignore

Problem 4: Duplicate Router IDs

R1# show ip ospf
 Routing Process "ospf 1" with ID 1.1.1.1
 
%OSPF-4-DUP_RTRID: Duplicate router ID 1.1.1.1 detected

Fix:

R2(config)# router ospf 1
R2(config-router)# router-id 2.2.2.2
R2(config-router)# end
R2# clear ip ospf process
Reset ALL OSPF processes? [no]: yes

Essential Troubleshooting Commands

R1# show ip ospf neighbor
R1# show ip ospf interface
R1# show ip ospf database
R1# show ip route ospf
R1# show ip protocols
R1# debug ip ospf adj
R1# debug ip ospf hello
R1# debug ip ospf packet

Quick Checklist

  1. ✓ Interface up/up status
  2. ✓ IP addresses in same subnet
  3. ✓ Area ID matches
  4. ✓ Hello/Dead timers match
  5. ✓ Authentication configured identically
  6. ✓ Network types compatible
  7. ✓ MTU values match
  8. ✓ Router IDs unique
  9. ✓ ACLs not blocking OSPF (protocol 89)
  10. ✓ Not configured as passive interface

Systematic troubleshooting using these commands resolves most OSPF issues efficiently.

OSPFv3 (OSPF for IPv6)

OSPFv3 is the IPv6 version of OSPF, designed to support IPv6 routing while maintaining OSPF's link-state characteristics. 

It runs independently from OSPFv2 (IPv4) and can operate simultaneously on the same router.

Key Differences from OSPFv2

Major Changes:

  • Per-link configuration - enabled on interfaces, not under router process
  • Uses link-local addresses - neighbor discovery uses IPv6 link-local
  • Runs over IPv6 - uses IPv6 as transport protocol
  • Multiple instances per link - supports instance IDs
  • Flooding scope - Link-local, area, and AS-wide LSAs
  • Authentication removed - relies on IPsec for security
  • New LSA types - Link-LSA, Intra-Area-Prefix-LSA

Similarities:

  • Same areas concept (Area 0 backbone requirement)
  • Same neighbor states and adjacency formation
  • Same SPF algorithm
  • Same network types (broadcast, point-to-point, NBMA)

Configuration Example

Basic OSPFv3 Configuration

Topology:

R1 (2001:DB8:1::1/64) --- R2 (2001:DB8:1::2/64)

R1 Configuration:

R1(config)# ipv6 unicast-routing
R1(config)# ipv6 router ospf 1
R1(config-rtr)# router-id 1.1.1.1
R1(config-rtr)# exit
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ipv6 address 2001:DB8:1::1/64
R1(config-if)# ipv6 ospf 1 area 0
R1(config-if)# exit
R1(config)# interface Loopback0
R1(config-if)# ipv6 address 2001:DB8:10::1/128
R1(config-if)# ipv6 ospf 1 area 0

R2 Configuration:

R2(config)# ipv6 unicast-routing
R2(config)# ipv6 router ospf 1
R2(config-rtr)# router-id 2.2.2.2
R2(config-rtr)# exit
R2(config)# interface GigabitEthernet0/0
R2(config-if)# ipv6 address 2001:DB8:1::2/64
R2(config-if)# ipv6 ospf 1 area 0
R2(config-if)# exit
R2(config)# interface Loopback0
R2(config-if)# ipv6 address 2001:DB8:20::1/128
R2(config-if)# ipv6 ospf 1 area 0

Key Points:

  • ipv6 unicast-routing enables IPv6 routing globally
  • Router ID still uses IPv4 format (mandatory)
  • ipv6 ospf 1 area 0 enables OSPFv3 on interface
  • No network command needed

Multi-Area OSPFv3

R1 (ABR) Configuration:

R1(config)# ipv6 router ospf 1
R1(config-rtr)# router-id 1.1.1.1
R1(config-rtr)# exit
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ipv6 address 2001:DB8:1::1/64
R1(config-if)# ipv6 ospf 1 area 0
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ipv6 address 2001:DB8:2::1/64
R1(config-if)# ipv6 ospf 1 area 1

OSPFv3 with Authentication (IPsec)

R1(config)# ipv6 router ospf 1
R1(config-rtr)# area 0 authentication ipsec spi 256 md5 1234567890ABCDEF1234567890ABCDEF
R1(config-rtr)# exit
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ipv6 ospf authentication ipsec spi 500 sha1 ABCDEF1234567890ABCDEF1234567890ABCDEF12

Explanation:

  • spi = Security Parameter Index (must match on neighbors)
  • Supports MD5, SHA1 authentication algorithms
  • Can be configured per-interface or per-area

Route Summarization

R1(config)# ipv6 router ospf 1
R1(config-rtr)# area 1 range 2001:DB8:10::/48
R1(config-rtr)# summary-prefix 2001:DB8:100::/48

Verification Commands

R1# show ipv6 ospf
R1# show ipv6 ospf neighbor
R1# show ipv6 ospf interface
R1# show ipv6 ospf database
R1# show ipv6 route ospf

Sample Output:

R1# show ipv6 ospf neighbor
Neighbor ID     Pri   State      Dead Time   Interface
2.2.2.2          1    FULL/DR    00:00:35    GigabitEthernet0/0
R1# show ipv6 route ospf
O   2001:DB8:20::1/128 [110/10]
     via FE80::2, GigabitEthernet0/0

Best Practices

  1. Always configure Router ID manually
  2. Use link-local addresses for neighbor communication
  3. Implement IPsec for authentication
  4. Plan addressing with summarization in mind
  5. Monitor LSA flooding - OSPFv3 has more LSA types
  6. Test dual-stack environments carefully

OSPFv3 provides robust IPv6 routing with familiar OSPF principles while leveraging IPv6's advanced features.

OSPF Route Redistribution

Route redistribution allows OSPF to exchange routing information with other routing protocols (RIP, EIGRP, BGP) or static routes. 

The router performing redistribution becomes an Autonomous System Boundary Router (ASBR) and advertises external routes using Type-5 LSAs.

Key Concepts

External Route Types:

  • E1 (Type-1 External) - Cost includes internal OSPF cost + external cost
  • E2 (Type-2 External) - Only considers external cost (default)

Metric: OSPF doesn't automatically convert metrics from other protocols. Default redistributed metric is 20 (except BGP = 1).

Configuration Examples

Example 1: Redistributing RIP into OSPF

Topology:

RIP Domain (192.168.x.x) --- R1 (ASBR) --- OSPF Domain (10.x.x.x)

R1 Configuration:

R1(config)# router ospf 1
R1(config-router)# network 10.1.1.0 0.0.0.255 area 0
R1(config-router)# redistribute rip subnets metric 50 metric-type 1
R1(config-router)# exit
R1(config)# router rip
R1(config-router)# version 2
R1(config-router)# network 192.168.1.0
R1(config-router)# redistribute ospf 1 metric 5

Explanation:

  • subnets keyword includes subnetted routes (essential!)
  • metric 50 sets seed metric for redistributed routes
  • metric-type 1 makes routes E1 instead of E2
  • RIP receives OSPF routes with metric 5 (hop count)

Example 2: Redistributing Static Routes

R1 Configuration:

R1(config)# ip route 172.16.0.0 255.255.0.0 Null0
R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1
R1(config)# router ospf 1
R1(config-router)# network 10.0.0.0 0.0.0.255 area 0
R1(config-router)# redistribute static subnets
R1(config-router)# default-information originate always

Explanation:

  • redistribute static injects static routes into OSPF
  • default-information originate advertises default route (0.0.0.0/0)
  • always keyword advertises even if default route isn't in routing table

Example 3: Redistributing EIGRP into OSPF

R1 Configuration:

R1(config)# router ospf 1
R1(config-router)# network 10.1.1.0 0.0.0.255 area 0
R1(config-router)# redistribute eigrp 100 subnets metric 100 metric-type 2
R1(config-router)# exit
R1(config)# router eigrp 100
R1(config-router)# network 192.168.0.0
R1(config-router)# redistribute ospf 1 metric 1000 100 255 1 1500

Explanation:

  • EIGRP requires 5 metric values: bandwidth, delay, reliability, load, MTU
  • OSPF receives EIGRP routes with metric 100 as E2 routes

Example 4: Filtering During Redistribution

R1 Configuration:

R1(config)# access-list 10 permit 192.168.1.0 0.0.0.255
R1(config)# access-list 10 deny any
R1(config)# route-map RIP-TO-OSPF permit 10
R1(config-route-map)# match ip address 10
R1(config-route-map)# set metric 75
R1(config-route-map)# exit
R1(config)# router ospf 1
R1(config-router)# redistribute rip subnets route-map RIP-TO-OSPF

Explanation:

  • Route-map filters which routes are redistributed
  • Only 192.168.1.0/24 is redistributed with metric 75

Verification Commands

R1# show ip ospf
R1# show ip ospf database external
R1# show ip route ospf
R1# show ip protocols

Sample Output:

R1# show ip route ospf
O E1 192.168.1.0/24 [110/70] via 10.1.1.2
O E2 192.168.2.0/24 [110/20] via 10.1.1.2

Common Issues

  1. Missing subnets keyword - only classful networks redistributed
  2. Routing loops - use distribute-lists or route-maps
  3. Suboptimal routing - choose appropriate metric-type
  4. Administrative distance conflicts

Best Practices

  1. Use route-maps for controlled redistribution
  2. Tag routes to prevent loops: route-map TAG set tag 100
  3. Filter carefully - avoid redistributing everything
  4. Choose E1 vs E2 based on design requirements
  5. Document all redistribution points

Redistribution requires careful planning to avoid routing loops and ensure optimal path selection across protocol boundaries.

OSPF Route Summarization

Route summarization (or aggregation) combines multiple contiguous network addresses into a single summary route, reducing routing table size, memory usage, and CPU overhead. In OSPF, summarization can only be performed on Area Border Routers (ABRs) and Autonomous System Boundary Routers (ASBRs).

Types of Summarization

1. Inter-Area Summarization

Performed on ABRs to summarize routes between OSPF areas using Type-3 LSAs.

2. External Route Summarization

Performed on ASBRs to summarize external routes (redistributed from other protocols) using Type-5 LSAs.

Benefits

  • Reduces routing table size - fewer entries to process
  • Improves stability - specific route flaps don't affect other areas
  • Decreases LSA flooding - less control traffic
  • Faster convergence - smaller routing tables mean faster SPF calculations
  • Saves bandwidth and memory - fewer routes to advertise

Configuration Examples

Inter-Area Summarization (ABR)

Topology:

Area 1: 10.1.0.0/24, 10.1.1.0/24, 10.1.2.0/24, 10.1.3.0/24
   |
  R1 (ABR)
   |
Area 0 (Backbone)

Before Summarization: R1 advertises four separate routes to Area 0.

R1 Configuration:

R1(config)# router ospf 1
R1(config-router)# network 10.1.0.0 0.0.255.255 area 1
R1(config-router)# network 172.16.0.0 0.0.0.255 area 0
R1(config-router)# area 1 range 10.1.0.0 255.255.252.0

Explanation:

  • area 1 range command summarizes routes FROM Area 1 TO Area 0
  • Summary: 10.1.0.0/22 covers 10.1.0.0/24 through 10.1.3.0/24
  • R1 automatically creates a Null0 route to prevent routing loops

Verification:

R1# show ip route ospf
O    10.1.0.0/22 is a summary, Null0

R2# show ip route ospf
O IA 10.1.0.0/22 [110/20] via 172.16.0.1

External Route Summarization (ASBR)

Topology:

RIP Domain: 192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24
   |
  R1 (ASBR)
   |
OSPF Domain

R1 Configuration:

R1(config)# router ospf 1
R1(config-router)# network 10.0.0.0 0.0.0.255 area 0
R1(config-router)# redistribute rip subnets
R1(config-router)# summary-address 192.168.0.0 255.255.252.0
R1(config-router)# exit
R1(config)# router rip
R1(config-router)# network 192.168.0.0
R1(config-router)# redistribute ospf 1 metric 5

Explanation:

  • summary-address summarizes external routes redistributed into OSPF
  • Summary: 192.168.0.0/22 covers all four subnets
  • Creates Type-5 LSA with summary route only

Advanced Example with Multiple Summaries

R1(config)# router ospf 1
R1(config-router)# area 1 range 10.1.0.0 255.255.248.0
R1(config-router)# area 2 range 10.2.0.0 255.255.248.0
R1(config-router)# summary-address 172.16.0.0 255.255.0.0
R1(config-router)# summary-address 192.168.0.0 255.255.0.0 not-advertise

Note: not-advertise keyword suppresses the summary advertisement.

Verification Commands

R1# show ip ospf summary-address
R1# show ip route
R1# show ip ospf database summary
R1# show ip protocols

Best Practices

  1. Plan summarization carefully - use proper IP addressing schemes
  2. Summarize at area boundaries for maximum benefit
  3. Avoid over-summarization - can cause suboptimal routing
  4. Monitor Null0 routes - ensure they're created automatically
  5. Document summary ranges for troubleshooting

Route summarization is essential for large OSPF deployments, providing scalability and improved network performance.

OSPF Authentication in Cisco

OSPF authentication prevents unauthorized routers from joining the OSPF domain and protects against malicious routing updates. Cisco supports three authentication types: Null (Type 0), Plain Text (Type 1), and MD5 (Type 2).

Authentication Types

1. Null Authentication (Type 0)

Default setting - no authentication required. Not recommended for production networks.

2. Plain Text Authentication (Type 1)

Uses clear-text passwords. Not secure as passwords are visible in packet captures.

3. MD5 Authentication (Type 2)

Uses MD5 hashing algorithm. Most secure option - password never transmitted, only the hash.

Configuration Methods

Authentication can be configured at two levels:

  • Interface level - applies to specific interface
  • Area level - applies to all interfaces in that area

Configuration Examples

Plain Text Authentication (Interface Level)

R1:

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 10.1.1.1 255.255.255.0
R1(config-if)# ip ospf authentication
R1(config-if)# ip ospf authentication-key CISCO123
R1(config-if)# exit
R1(config)# router ospf 1
R1(config-router)# network 10.1.1.0 0.0.0.255 area 0

R2:

R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip address 10.1.1.2 255.255.255.0
R2(config-if)# ip ospf authentication
R2(config-if)# ip ospf authentication-key CISCO123
R2(config-if)# exit
R2(config)# router ospf 1
R2(config-router)# network 10.1.1.0 0.0.0.255 area 0

MD5 Authentication (Area Level)

R1:

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 10.1.1.1 255.255.255.0
R1(config-if)# ip ospf message-digest-key 1 md5 SECRET_PASS
R1(config-if)# exit
R1(config)# router ospf 1
R1(config-router)# network 10.1.1.0 0.0.0.255 area 0
R1(config-router)# area 0 authentication message-digest

R2:

R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip address 10.1.1.2 255.255.255.0
R2(config-if)# ip ospf message-digest-key 1 md5 SECRET_PASS
R2(config-if)# exit
R2(config)# router ospf 1
R2(config-router)# network 10.1.1.0 0.0.0.255 area 0
R2(config-router)# area 0 authentication message-digest

Key Points:

  • Key ID (1 in example) must match on both routers
  • Password must be identical
  • Multiple keys can be configured for key rotation

MD5 Authentication (Interface Level)

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip ospf authentication message-digest
R1(config-if)# ip ospf message-digest-key 1 md5 MY_PASSWORD

Verification Commands

R1# show ip ospf interface GigabitEthernet0/0
R1# show ip ospf neighbor
R1# debug ip ospf adj

Expected Output:

R1# show ip ospf interface Gi0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet Address 10.1.1.1/24, Area 0
  Message digest authentication enabled
    Youngest key id is 1

Troubleshooting

Common Issues:

  • Mismatched passwords - neighbors won't form adjacency
  • Different key IDs - authentication fails
  • Mixed authentication types - adjacency fails
  • Missing configuration on one side - neighbor stuck in INIT state

Error Message Example:

R1# %OSPF-4-ERRRCV: Received invalid packet: mismatch authentication type

Best Practices

  1. Always use MD5 authentication in production
  2. Use area-level authentication for consistency
  3. Encrypt passwords in configuration: service password-encryption
  4. Plan key rotation using multiple key IDs
  5. Document passwords securely

Authentication is critical for OSPF security and should never be overlooked in enterprise deployments.

OSPF Packet Types

OSPF uses five packet types to establish neighbor relationships, exchange routing information, and maintain network convergence. All OSPF packets share a common 24-byte header and use IP protocol number 89.

1. Hello Packet (Type 1)

Purpose: Discovers neighbors, establishes adjacencies, and maintains neighbor relationships.

Key Functions:

  • Sent every 10 seconds (broadcast/point-to-point) or 30 seconds (NBMA)
  • Contains Router ID, Area ID, timers, and neighbor list
  • Dead interval (default 40 seconds) determines when a neighbor is considered down

Example: Router R1 sends Hello packets on interface Gi0/0 to multicast address 224.0.0.5. If R2 receives the Hello and parameters match (area ID, timers, authentication), they become neighbors.

2. Database Description (DBD/DDP) Packet (Type 2)

Purpose: Exchanges summary information about the link-state database during adjacency formation.

Key Functions:

  • Contains LSA headers (not full LSAs)
  • Uses master/slave relationship for synchronization
  • Sequence numbers ensure reliable exchange

Example: After R1 and R2 become neighbors, they exchange DBD packets. R1 sends headers of all LSAs in its database. R2 compares these with its own database to identify missing or outdated information.

3. Link State Request (LSR) Packet (Type 3)

Purpose: Requests specific LSAs from a neighbor.

Key Functions:

  • Sent after examining DBD packets
  • Requests complete LSAs that are missing or outdated

Example: R2 discovers from R1's DBD packet that R1 has a newer LSA for network 10.1.1.0/24. R2 sends an LSR packet requesting the complete LSA for that network.

4. Link State Update (LSU) Packet (Type 4)

Purpose: Carries complete LSAs to neighbors.

Key Functions:

  • Response to LSR packets
  • Floods new or updated routing information
  • Contains one or multiple LSAs
  • Requires acknowledgment

Example: R1 responds to R2's LSR by sending an LSU packet containing the complete LSA for 10.1.1.0/24. When R1 detects a topology change (interface goes down), it generates a new LSA and floods it via LSU packets to all neighbors.

5. Link State Acknowledgment (LSAck) Packet (Type 5)

Purpose: Acknowledges receipt of LSU packets.

Key Functions:

  • Ensures reliable flooding
  • Contains LSA headers of acknowledged LSAs
  • May acknowledge multiple LSAs in one packet

Example: After receiving R1's LSU packet, R2 sends an LSAck packet confirming receipt. If R1 doesn't receive acknowledgment within the retransmission interval (5 seconds), it resends the LSU.

Packet Flow Example

Neighbor Formation:

  1. Hello → Hello (establish neighbors)
  2. DBD → DBD (exchange database summaries)
  3. LSR → LSU → LSAck (synchronize databases)

Steady State: Hello packets maintain relationships; LSU/LSAck occur only during topology changes.

This efficient packet structure enables OSPF's fast convergence and scalability in enterprise networks.

Virtual Links in OSPF

A virtual link is a logical connection in OSPF that allows you to connect a non-backbone area to Area 0 (the backbone area) through a transit area when direct physical connectivity to Area 0 is not possible.

Why Virtual Links Are Needed

OSPF has a strict architectural requirement: all areas must be directly connected to Area 0 (the backbone area). However, in some network scenarios, this isn't physically possible, so virtual links provide a workaround.

Common Use Cases

  1. Connecting a remote area that cannot physically connect to Area 0
  2. Repairing a partitioned backbone when Area 0 becomes split
  3. Temporary solutions during network migrations or redesigns

How Virtual Links Work

  • A virtual link is created between two Area Border Routers (ABRs)
  • The link traverses through a transit area (an intermediate area)
  • The transit area must have full routing information (cannot be a stub area)
  • Virtual links are point-to-point connections using the Router IDs of the endpoints

Configuration Example

Network Topology:

Area 0 (Backbone)
    |
  [R1] ABR
    |
Area 1 (Transit Area)
    |
  [R2] ABR
    |
Area 2 (Remote Area)

Area 2 cannot directly connect to Area 0, so we create a virtual link through Area 1.

Configuration on R1 (connects Area 0 and Area 1):

router ospf 1
 area 1 virtual-link 2.2.2.2

Configuration on R2 (connects Area 1 and Area 2):

router ospf 1
 area 1 virtual-link 1.1.1.1

Key points:

  • 1.1.1.1 = Router ID of R1
  • 2.2.2.2 = Router ID of R2
  • area 1 = The transit area through which the virtual link passes
  • Both routers must reference the same transit area

Verification Commands

show ip ospf virtual-links
show ip ospf neighbor
show ip route ospf

Important Considerations

Disadvantages:

  • Adds complexity to network design
  • Can make troubleshooting more difficult
  • Considered a temporary or last-resort solution
  • Performance overhead due to encapsulation

Best Practice: Whenever possible, redesign your network topology to allow direct physical connections to Area 0 rather than relying on virtual links.

Requirements:

  • Transit area cannot be a stub area
  • Both ABRs must be configured with matching parameters
  • The transit area must have full connectivity between the two ABRs

Would you like me to elaborate on any specific aspect of virtual links, such as authentication configuration or troubleshooting scenarios?