Open Shortest Path First (OSPF) is the interior gateway protocol you are most likely to meet in an enterprise network, a branch WAN or a data center underlay. It is an open standard, every serious vendor implements it, and it punishes guesswork: a mismatched timer or an MTU difference can leave you staring at neighbors that never reach FULL. This guide walks through OSPF fundamentals the way you will actually use them: how the link-state database works, what areas and LSA types are for, how neighbors form, how the DR and BDR are elected, and how to write a clean Cisco IOS configuration you can verify with confidence.
How OSPF works: link-state routing in plain terms
OSPF version 2 is defined in RFC 2328 and carries IPv4 routes. OSPFv3, defined in RFC 5340, was built for IPv6 and can also carry IPv4 with address families. Both run directly over IP using protocol number 89, not over TCP or UDP. That detail matters when you write firewall rules or ACLs on links between routers.
Distance-vector protocols such as RIP tell their neighbors “here are the networks I know and how far away they are.” Link-state protocols work differently. Every OSPF router describes its own links, their state and their cost in small records called Link-State Advertisements (LSAs). Those LSAs are flooded to every router in the area, so every router ends up with an identical copy of the link-state database (LSDB). Each router then runs Dijkstra’s Shortest Path First (SPF) algorithm against that database, with itself as the root, to build a loop-free tree of best paths. The results go into the routing table with an administrative distance of 110.
The practical consequences are worth remembering:
- Every router in an area has the same map, so routing decisions are consistent and loops are avoided by design.
- A change in one place triggers flooding and an SPF run on every router in the area. Large, flat areas therefore cost CPU and memory, which is why areas exist.
- OSPF metrics are cost, derived from interface bandwidth, not hop count.
OSPF packet types
OSPF uses five packet types. You will see them in debugs and packet captures, so it pays to know them by name:
- Hello discovers neighbors, checks that parameters match and acts as a keepalive.
- Database Description (DBD or DD) summarizes the contents of the LSDB during adjacency formation.
- Link-State Request (LSR) asks a neighbor for specific LSAs that are missing or out of date.
- Link-State Update (LSU) carries the actual LSAs.
- Link-State Acknowledgment (LSAck) confirms that LSAs were received, because OSPF provides its own reliability.
Hellos go to the multicast address 224.0.0.5 (AllSPFRouters). On broadcast networks, updates sent toward the designated routers use 224.0.0.6 (AllDRouters). On broadcast and point-to-point networks the default hello interval is 10 seconds and the dead interval is 40 seconds; on NBMA networks the defaults are 30 and 120.
Cost and reference bandwidth
Cisco calculates cost as reference bandwidth divided by interface bandwidth, with a default reference of 100 Mbps. That means FastEthernet, 1 Gbps and 10 Gbps links all get a cost of 1. Fix it on day one with auto-cost reference-bandwidth (in Mbps), using the same value on every router.
| Interface speed | Cost with default reference (100 Mbps) | Cost with reference 100000 (100 Gbps) |
|---|---|---|
| 100 Mbps | 1 | 1000 |
| 1 Gbps | 1 | 100 |
| 10 Gbps | 1 | 10 |
| 40 Gbps | 1 | 2 |
| 100 Gbps | 1 | 1 |
OSPF areas and router roles
An area is a group of routers and links that share the same LSDB. Areas contain the cost of flooding and SPF: a link flapping in area 10 triggers a full SPF run only inside area 10. Other areas receive a summarized view and do much less work.
OSPF uses a two-level hierarchy. Area 0, the backbone, sits in the middle, and every other area must attach to it. Inter-area traffic passes through the backbone, which is also what prevents inter-area routing loops. If an area cannot physically touch area 0, a virtual link can patch it through a transit area, but treat that as a temporary fix rather than a design.
Router roles
- Internal router: all interfaces in a single area.
- Backbone router: at least one interface in area 0.
- Area Border Router (ABR): interfaces in area 0 and at least one other area. ABRs keep a separate LSDB per area and are where inter-area summarization happens.
- Autonomous System Boundary Router (ASBR): redistributes external routes into OSPF, for example static routes, a default route from an ISP, or routes from BGP or EIGRP.
Area types
Special area types reduce the number of LSAs an area has to carry, which is useful for branch sites with a single exit:
| Area type | Blocks | Gets instead | Typical use |
|---|---|---|---|
| Standard (normal) | Nothing | Full intra-area, inter-area and external routes | Default for most areas |
| Stub | Type 5 (and type 4) | Default route from the ABR as a type 3 | Branches with one exit, no local redistribution |
| Totally stubby (Cisco) | Types 3, 4 and 5 | Only a default route from the ABR | Small branches that need nothing but a way out |
| Not-So-Stubby Area (NSSA) | Type 5 | Local externals as type 7, translated to type 5 at the ABR | Stub-like site that must redistribute something local |
| Totally NSSA | Types 3, 4 and 5 | Default route plus local type 7 externals | Small site with a local external connection |
LSA types you need to know
LSAs are the building blocks of the database. Each type describes something different and is flooded with a different scope. When you run show ip ospf database, the output is grouped by these types, so reading it fluently is a core troubleshooting skill.
| Type | Name | Generated by | Flooding scope | Describes |
|---|---|---|---|---|
| 1 | Router LSA | Every router | Within its area | The router’s own links, their states and costs |
| 2 | Network LSA | The DR on a multi-access segment | Within its area | The transit network and all routers attached to it |
| 3 | Summary LSA | ABR | Into other areas | Networks from another area (inter-area routes, shown as O IA) |
| 4 | ASBR Summary LSA | ABR | Into other areas | How to reach an ASBR located in another area |
| 5 | AS External LSA | ASBR | Entire OSPF domain except stub and NSSA areas | External routes (O E1 or O E2) |
| 7 | NSSA External LSA | ASBR inside an NSSA | Within the NSSA only | External routes, converted to type 5 by the ABR (O N1 or O N2) |
E1 versus E2 external routes
External routes come in two flavors. E2, the default on Cisco, keeps the metric that was set at redistribution and ignores the internal cost to reach the ASBR. E1 adds the internal cost, which makes it the better choice when you have two ASBRs advertising the same prefix and you want each router to use the closer one. When both exist for the same prefix, OSPF prefers E1 over E2 regardless of metric.
OSPF neighbor states and adjacency formation
Two routers do not simply “become neighbors.” They walk through a defined state machine, and knowing where a pair is stuck tells you almost exactly what is wrong.
| State | What is happening | If it is stuck here, check |
|---|---|---|
| Down | No hellos received from the neighbor within the dead interval | Physical link, interface shutdown, ACLs blocking protocol 89, passive interface |
| Attempt | NBMA only: the router is sending unicast hellos to a configured neighbor | The neighbor statement and reachability on Frame Relay-style networks |
| Init | A hello was received, but it does not list this router’s ID yet | One-way communication, ACL or filter on one side, multicast problems |
| 2-Way | Both routers see each other in hellos; DR/BDR election happens here | Normal for DROTHER to DROTHER on broadcast segments |
| ExStart | Routers negotiate master/slave and the starting DBD sequence number | MTU mismatch, duplicate router IDs |
| Exchange | Routers exchange DBD packets that summarize their databases | MTU mismatch (very common), packet loss |
| Loading | Routers request and receive missing LSAs with LSR and LSU packets | Corrupted or very large LSAs, packet loss |
| Full | Databases are synchronized; the adjacency is complete | Nothing, this is the goal |
Parameters that must match
Before two routers move beyond Init, their hellos must agree on several values. If any of these differ, the neighbor never forms and IOS will usually tell you why in debug ip ospf adj or the log:
- Area ID, and the area type flags (stub, NSSA) for that area
- Subnet and subnet mask on broadcast and NBMA networks
- Hello and dead intervals
- Authentication type and key
- Unique router IDs (duplicates cause flapping and odd database behavior)
- Compatible network types, for example both point-to-point or both broadcast
MTU is not checked in the hello, but it is checked in DBD packets, which is why an MTU mismatch shows up later as a neighbor stuck in ExStart or Exchange. If you need a refresher on matching masks and subnet boundaries, the guide to subnetting made simple covers the math.
ip ospf mtu-ignore will bring a stuck adjacency to FULL, but it hides a real problem. Large LSUs can still be dropped or fragmented later. Fix the MTU on the interfaces instead.DR and BDR election
On a multi-access segment such as an Ethernet VLAN with five routers, a full mesh of adjacencies would mean ten adjacencies and a lot of duplicate flooding. OSPF avoids this by electing a Designated Router (DR) and a Backup Designated Router (BDR). Every other router, called a DROTHER, forms a FULL adjacency only with the DR and BDR. DROTHERs send updates to 224.0.0.6, and the DR re-floods them to everyone on 224.0.0.5. The DR also generates the type 2 network LSA for the segment.
Election rules
- The router with the highest OSPF interface priority wins. The default is 1, the range is 0 to 255, and a priority of 0 means the router will never become DR or BDR.
- If priorities tie, the highest router ID wins.
- The election is non-preemptive. If a better router boots later, it does not take over. The current DR keeps the role until it fails, at which point the BDR is promoted and a new BDR is elected.
Because the election is non-preemptive, the router that boots first often becomes DR. To make a specific core router the DR, raise its priority, set priority 0 on routers that should never be DR, and clear the OSPF process during a maintenance window to force a fresh election. Set router IDs manually too, so the tie-breaker is predictable.
On a link that only ever has two routers, such as a routed uplink between a core switch and a distribution switch, skip the election entirely by setting the network type to point-to-point. Adjacencies form faster, there is no type 2 LSA, and the database is smaller.
R1# show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface
2.2.2.2 1 FULL/DR 00:00:36 10.0.0.2 GigabitEthernet0/1
3.3.3.3 1 FULL/BDR 00:00:33 10.0.0.3 GigabitEthernet0/1
4.4.4.4 1 2WAY/DROTHER 00:00:38 10.0.0.4 GigabitEthernet0/1In this output R1 is itself a DROTHER. It is FULL with the DR and BDR and sits in 2-Way with the other DROTHER, which is exactly what you want to see.
Configuring OSPF on Cisco IOS
Here is a practical two-area example. R1 is an ABR with an uplink in area 0 and a user LAN in area 1. The configuration uses a fixed router ID, a sensible reference bandwidth, passive interfaces by default, and point-to-point network type on the router-to-router link.
interface Loopback0
ip address 1.1.1.1 255.255.255.255
!
interface GigabitEthernet0/0
description Uplink to CORE-R2 (area 0)
ip address 10.0.12.1 255.255.255.252
ip ospf network point-to-point
!
interface GigabitEthernet0/1
description Users VLAN (area 1)
ip address 192.168.10.1 255.255.255.0
!
router ospf 1
router-id 1.1.1.1
auto-cost reference-bandwidth 100000
passive-interface default
no passive-interface GigabitEthernet0/0
network 1.1.1.1 0.0.0.0 area 0
network 10.0.12.0 0.0.0.3 area 0
network 192.168.10.0 0.0.0.255 area 1
area 1 range 192.168.8.0 255.255.252.0A few notes on this configuration:
- The process ID (1) is locally significant. Neighbors do not need matching process IDs.
- The
networkcommand uses a wildcard mask and does not advertise a network directly. It enables OSPF on any interface whose address matches, and OSPF then advertises that interface’s subnet. passive-interface defaultstops hellos on every interface, then you re-enable only the links where you expect neighbors. The user VLAN is still advertised, but no one on that VLAN can form an adjacency with your router.area 1 rangeon the ABR summarizes area 1 subnets 192.168.8.0 through 192.168.11.255 into a single type 3 LSA toward area 0.
Interface-level configuration
Many engineers prefer enabling OSPF directly on the interface. It is explicit and easier to read in a running configuration:
interface GigabitEthernet0/0
ip ospf 1 area 0
!
interface GigabitEthernet0/1
ip ospf 1 area 1Authentication
Always authenticate OSPF on links you do not fully control. Classic MD5 authentication is widely supported; newer IOS XE releases also support HMAC-SHA authentication through key chains (RFC 5709), which you should prefer where every router supports it.
key chain OSPF-KEYS
key 1
key-string Str0ngSharedSecret
cryptographic-algorithm hmac-sha-256
!
interface GigabitEthernet0/0
ip ospf authentication key-chain OSPF-KEYSDefault route and stub areas
An edge router that has a static default route toward the internet can inject it into OSPF with default-information originate. Add the always keyword only if you want the default advertised even when the router has no default route itself. To make area 2 totally stubby, configure area 2 stub on every router in the area and add area 2 stub no-summary on the ABR.
ip route 0.0.0.0 0.0.0.0 203.0.113.1
!
router ospf 1
default-information originate
area 2 stub no-summaryIf you want to practice all of this without touching production, a virtual topology in a home network lab is the fastest way to break and fix adjacencies safely.
Verifying and troubleshooting OSPF
A configuration you have not verified is only a hypothesis. These are the commands you will use most, in roughly the order you will use them:
show ip ospf interface brief
show ip ospf neighbor
show ip ospf interface GigabitEthernet0/0
show ip ospf database
show ip ospf database router 2.2.2.2
show ip route ospf
show ip protocols
debug ip ospf adjshow ip ospf interface briefconfirms which interfaces are running OSPF, in which area, their cost, state (DR, BDR, DROTHER, P2P) and neighbor count. If an interface is missing here, your network statement or interface command did not match.show ip ospf interfaceshows timers, network type, priority and whether the interface is passive.show ip ospf databasetells you whether LSAs are actually arriving. If a route is missing from the routing table but its LSA is present, look at SPF, summarization or a distribute-list. If the LSA is missing, look at flooding, area design or filtering at the ABR.show ip route ospfshows codes O (intra-area), O IA (inter-area), O E1 and O E2 (external), and O N1 and O N2 (NSSA external).
A repeatable checklist for a missing neighbor
- Is the interface up/up and can you ping the neighbor’s interface address?
- Is OSPF enabled on the interface, and is it not passive?
- Do area IDs, subnet masks, timers, network types and authentication match?
- Is an ACL or firewall dropping IP protocol 89 or the 224.0.0.5 multicast?
- If the neighbor is stuck in ExStart or Exchange, compare the IP MTU on both sides.
- Are the router IDs unique across the domain?
This is a direct application of the bottom-up approach described in the structured network troubleshooting methodology: prove the lower layers before blaming the protocol.
log-adjacency-changes detail under the OSPF process and send them to a syslog server. A neighbor that flaps every few hours is easy to miss in the console but obvious in a centralized log, as explained in Network Monitoring 101.OSPF design best practices
Most OSPF problems in production are design problems. A handful of habits prevents most of them:
- Keep it simple. Start with a single area 0 and add areas when the network grows or when you need to isolate unstable links.
- Use loopbacks and fixed router IDs. Loopbacks never go down, so management and BGP peering stay stable, and fixed IDs make every output readable.
- Plan your addressing for summarization. Give each area a contiguous block so the ABR can advertise one summary instead of dozens of subnets. This is where good IP planning pays off.
- Use point-to-point network type on any link with exactly two routers.
- Make passive the default and only enable hellos where you expect neighbors.
- Authenticate every adjacency, ideally with SHA-based key chains.
- Set the reference bandwidth consistently across every router before you go live.
- Document areas, router IDs and costs alongside your diagrams so the next engineer does not have to reverse-engineer the design.
If you are on the path from administering networks to engineering them, OSPF is one of the first protocols where design decisions start to matter more than syntax. When your network needs to reach the internet over more than one provider, the next step is BGP basics for network admins.
Key takeaways
- OSPF is a link-state protocol (RFC 2328 for OSPFv2) running over IP protocol 89, with an administrative distance of 110 and a cost-based metric.
- Areas contain flooding and SPF work; every area must connect to area 0, and many networks are best served by a single area.
- Type 1 and 2 LSAs describe an area, type 3 and 4 cross area boundaries, and type 5 and 7 carry external routes.
- Neighbors walk through Down, Init, 2-Way, ExStart, Exchange, Loading and Full; the state where they stop points to the cause.
- DR/BDR election uses priority, then router ID, and is non-preemptive. Use point-to-point network type on two-router links.
- Set router IDs, reference bandwidth, passive interfaces and authentication deliberately, then verify with show commands before you call it done.
Want a second set of eyes on your routing design, or a clear picture of how OSPF is really behaving in your network today? A Network Health Assessment reviews your routing, adjacencies and redundancy and gives you a prioritized fix list. If you are studying for your certification, the 1:1 CCNA Mentorship Program covers OSPF hands-on, lab by lab. Questions about your specific setup? Get in touch.
