Open Shortest Path First (OSPF)

Covers OSPF LSA types, areas and area types, DR and BDR election, network and packet types, neighbor states, and authentication.

• OSPF’s complexity is due to its scalability
• OSPF uses IP protocol 89, (not TCP or UDP). This means if you are ever asked to configure an ACL that does something with OSPF, you are going to need to specify protocol 89
• OSPF routers send LSUs to each other. LSU contains different types of LSAs
• Each OSPF router creates a Router LSA (Type-1 LSA) containing the information of:
  • Operational interface
  • Associated cost
  • Connected IP network
  • show ip ospf database router
  • In type-1 LSA: LSID = RID
  • Type-1 LSA link types:
    • Type 1: Point-to-point: no information about routing but only used for SPF graph. Link ID = Neighbor router ID
    • Type 2: Connection to transit network. Link ID = IP address of DR
    • Type 3: Connection to stub network. Link ID = IP Network
    • Type 4: Virtual link: similar to point-to-point. Link ID = Neighbor router ID
• Each OSPF router floods its LSA to connected routers
• All OSPF routers end up with the link-state database (LSDB)
  • LSDB contains different types of LSAs
  • show ip ospf database
• With this map of the network, OSPF routers use Dijkstra shortest path first (SPF) algorithm to arrive at the same routing decisions
  • show ip route ospf
  • show ip ospf: shows how many times SPF algorithm is run for each area
• OSPFv2 has 7 different LSA types with varying amounts of information for serving in different purposes:
  • This is for scalability to minimize the size of LSDB
  • OSPF areas limit the propagation of LSAs
• OSPF routers ensure they have the latest information in their LSDB by the sequence number field inside the LSAs. When a router receives an LSA, first it checks its LSDB to see if it has already information about that LSA. If it does not have, it simply updates its LSDB; but if it has, here is where sequence number comes to play.
  • If sequence numbers are equal -> new LSA is ignored
  • If the new LSA’s sequence number is less than the sequence number of LSA in LSDB -> New LSA is ignored
    • Then the router sends an LSU containing its LSA in the LSDB to the sender saying that “you have old information, here is newer LSA”
  • If the new LSA’s sequence number is greater than what it has in its LSDB, the router updates its LSDB then sends an LSACK to the sender, then it updates its routing table and floods the new LSA
  • After that there is no LSA flooding in the area unless in the event of topology change
    • But keep in mind OSPF routers send LSA summary every 30 minutes.
      • Current OSPF behavior requires all LSAs, except DoNotAge LSAs, to be refreshed every 30 minutes.
• OSPF areas are implemented in a 2-level hierarchy
  • The area 0 backbone connects to all other areas
  • All other areas which are logically connected to area 0
  • Reduces the number of redundant paths
  • Some LSAs stay within an area while others are flooded to all routers
• To see the neighbors: show ip ospf neighbors
• To see interfaces participating in OSPF: show ip ospf interface

DR, BDR, DROTHER in multi access networks

• For fast convergence
• When a router senses a change in topology, it sends the change (Type-1 LSA) to 224.0.0.6 (DR and BDR listening to)
• Then DR sends the LSU (containing Type-2 LSA) to all OSPF routers (224.0.0.5)
  • show ip ospf database network to see Type-2 LSA
  • In type-2 LSA: \(\mathrm{LSID} = \mathrm{IP}_{\mathrm{DR}}\)
• The routers which are not DR nor BDR are DROTHERS
• DR and BDR is chosen by:
  1. bigger OSPF interface priority is DR: (config-if)#ip ospf priority [0-255] #show ip ospf neighbor
  2. Router ID (RID): bigger is DR router-id
  3. Biggest loopback interface IP (whether participating in OSPF or not)
  4. Biggest physical up/up interface IP address no matter if it participates in OSPF or not
• If any of these changes and we want to apply the change, we have to use #clear ip ospf process
• Type-1 and Type-2 LSAs stay within the area

Virtual Link

• If areas are not connected physically to area 0 (because it breaches OSPF 2-level hierarchy) like below example:
• (Rx)----Area0----(R1)----Area1----(R2)----Area2----(R3)----Area3----(R4)
• We have to connect them together logically
• Transit area should not be stub

  R1(config-router)# area 1 virtual-link 2.2.2.2
  R2(config-router)# area 1 virtual-link 1.1.1.1
  R2(config-router)# area 2 virtual-link 3.3.3.3
  R3(config-router)# area 2 virtual-link 2.2.2.2

• Remember that you have in the command the other ABR’s RID (1.1.1.1, 2.2.2.2, 3.3.3.3) not IP address
• show ip ospf database: DoNotAge bit (DNA) is set, to prevent LSA reflooding every 30 minutes
  • Current OSPF behavior requires all LSAs, except DoNotAge LSAs, to be refreshed every 30 minutes.
• How to change reference bandwidth:
  • (config-router)#auto-cost reference-bandwidth <1-4294967> Mib/sec
• We can change the cost at the interface level
  • (config-if)#ip ospf cost <1-65535>
  • show ip ospf interface gig0/0
• In fact you can also use GRE tunnel instead of Virtual Link

OSPF Metric

• \(\text{metric} = \mathrm{BW}_{\text{reference}} / \mathrm{BW}_{\text{interface}}\)
• To change the reference bandwidth: (config-router)#auto-cost reference-bandwidth 1000

OSPF Area Types

• Normal area: Contain LSA types 1, 2, 3, 4, and 5
• Stub area: Contains type 1 and 2 and receives type-3 summary LSA from other areas
  • has a default route for external prefixes
  • (config-router)#area 23 stub
• Totally stubby area
  • Like Stub area but does not receive type 3 LSAs
  • Only has a default route
  • (config-router)#area 23 stub no-summary
• Not-so-stubby area (NSSA)
  • Generally used to inject external prefixes into OSPF routing domain
  • No need for a default route
  • type 1, 2, 3, and 7
  • (config-router)#area 23 nssa
• Totally not-so-stubby area
  • Like NSSA but has a default route

Note

• Intra-area routes (routes within an area) are always preferred over inter-area routes
• Inter-area routes (routes outside the area) are always preferred over external routes

Type-3 LSA (Network Summary LSA)

• Is made by ABR
• Carries subnets listed by Type-1 and Type-2 LSA from one area to another along with their costs
  • Does NOT carry topology information
• Is not flooded to Totally stubby and totally NSSA as these areas are Cisco proprietary
• show ip ospf database summary
• LSID = Summary Network Number
• \(\text{Cost} = \text{Cost}_{\text{LSA-1 or LSA-2}} + \text{Cost}_{\text{LSA-3}}\)

Type-5 LSA (AS External LSA)

• Generated by ASBR
  • ASBR: Redistributes from another IGP into OSPF
• Describes the external prefix and the gateway to reach it
• Flooded to all normal areas
• show ip ospf database external
• LSID = External Network Number

Type-4 LSA (ASBR Summary)

• Similar to type-3 LSA
• Generated by an ABR bordering an area containing an ASBR
  • Tells all OSPF routers about ASBR
• The ABR converts the ASBR’s type-1 LSA into a type 4 ASBR summary LSA
• show ip ospf database asbr-summary
• \(\mathrm{LSID} = \mathrm{ID}_{\mathrm{ASBR}}\)

Type-7 LSA (NSSA External)

• Appears in NSSA
• ASBR creates a type 7 external stub LSA
• ABR converts type-7 to type-5 AS external LSA and floods it to the rest of OSPF areas
• Why do we not use type-5 LSA? Because type-5 LSAs are not allowed into NSSA

Network Types in OSPF

• Broadcast: This is the default value for ethernet interfaces
• Point-to-Point: This is the default value of serial interfaces
• Loopback:
• Non-Broadcast MultiAccess (NBMA)
  • We do not have dynamic discovery of neighbors since hellos cannot be sent to multicast address, we have to use unicast address of the neighbor using neighbor ospf router subcommand
• Point to multipoint
• Point to multipoint nonbroadcast

Packet types in OSPF

• debug ip ospf packet
• t1 or Hello: Neighbor discovery
  • In Broadcast and point-to-point is sent every 10 seconds
  • In all other network types is sent every 30 seconds
  • Dead timer is 4x the hello interval
  • debug ip ospf hello
• t2 or Database Description (DD or DBD): To check if the LSDBs between 2 routers are identical or not
• t3 or Link-state request (LSR): to request a particular LSA from the neighbor
• t4 or Link-state update (LSU): In response to LSR. LSU contains LSAs
• t5 or LSACK: This is an ack to LSU

OSPF neighbor states

• All OSPF routers start off with the down state. In this state routers send hello
• In init state, the router received hello but cannot see its RID in the hello received
• In 2-way state, the routers have ack in the hello message they received. (Now they can see their RID)
  • Now, DR and BDR are elected
  • This is the state between a pair of routers if both are DROTHERS in broadcast networks
• ExStart: the goal is to identify the master router and sequence number
• Exchange: to exchange the DD which contains LSA headers (not the full LSAs)
• Loading: to exchange full LSA
• Full: Fully adjacent. Normal state for most OSPF routers

Type-6 LSA (Multicast LSA)

• Not supported and not used

OSPF Authentication

• Area authentication
  • Requires OSPF router to authenticate before joining an area
• Interface authentication
  • Requires authentication for adjacent routers
  • In below example, we only need to configure the same as what we configured for area authentication but at the interface level
• MD5

    (config-router)#area 12 authentication message-digest
    (config-if)#ip ospf message-digest-key 89 md5 cisco

• Plain text

    (config-router)#area 12 authentication
    (config-if)#ip ospf authentication-key cisco