OSPF Configuration
Step 1 Enter OSPF configuration mode for a particular OSPF process using the global command:
router ospf process-id
Step 2 (Optional) Configure the OSPF router ID by:
a. Configuring the router subcommand:
router-id id-value
b. Configuring an IP address on a loopback interface
Step 3 Configure one or more router subcommands:
network ip-address wildcard-mask area area id
with any matched interfaces being added to the listed area.
Step 4 (Optional) Change the interface Hello and Dead intervals using interface subcommands:
- ip ospf hello-interval time
- ip ospf dead-interval time
Step 5 (Optional) Impact routing choices by tuning interface cost as follows:
a. Configure costs directly using the interface subcommand:
ip ospf cost value
b. Change the interface bandwidths using the interface subcommand:
bandwidth value
c. Change the numerator in the formula to calculate the cost based on the interface bandwidth using the router subcommand:
Auto-cost reference-bandwidth value
Step 6 (Optional) Configure OSPF authentication:
a. On a per-interface basis using the interface subcommand:
ip ospf authentication
b. For all interfaces in an area using the router subcommand:
area authentication
Step 7 (Optional) Configure support for multiple equal-cost routes using the router subcommand:
maximum-paths number
OSPF Single-Area Configuration
OSPF configuration is somewhat similar to RIP configuration in a single OSPF area configuration.
Example:
interface ethernet 0/0
ip address 10.1.1.1 255.255.255.0
interface serial 0/0
ip address 10.1.4.1 255.255.255.0
interface serial 0/1
ip address 10.1.6.1 255.255.255.0
!
router ospf 1
network 10.0.0.0 0.255.255.255 area 0
- The router ospf 1 global command puts the user in OSPF configuration mode.
- You may sometimes run multiple process in a single router, therefore you use a process-id to distinguish between the processes.
- The process-id does not have to match on each router, and it can be any integer between 1 and 65,535.
- The network command tells a router to:
- Enable OSPF on each matched interface
- Discover neighbors on that interface
- Assign the interface to that area
- Advertise the subnet connected to each interface
- The wild-card style mask uses the style like the ones used for IP ACLs
- The OSPF wildcard mask must have only one string of consecutive binary 1s and one string of binary 0s.
0.0.255.255 – good
0.255.255.0 – no good
Another Example:
interface ethernet 0/0
ip address 10.1.1.1 255.255.255.0
interface serial 0/0
ip address 10.1.4.1 255.255.255.0
interface serial 0/1
ip address 10.1.6.1 255.255.255.0
!
router ospf 1
network 10.1.1.1 0.0.0.0 area 0
network 10.1.4.1 0.0.0.0 area 0
network 10.1.6.1 0.0.0.0 area 0
- The configuration also enables OSPF on every interface.
- In this case, the IP address for each interface is matched with a different network command.
- The wildcard mask of 0.0.0.0 means that all 32 bits must be compared, and they must match
- so the network commands include the specific IP address of each interface, respectively
- Many people prefer this style of configuration in production environment because it removes any ambiguity about the interfaces on which OSPF is running.
OSPF Configuration with Multiple Areas
- The configuration syntax is the same as the single area configuration
- What you need to keep in mind when configuring is what area a certain interface in a router should be placed (ex. Area 0 or Area 1)
network 10.1.4.1 0.0.0.0 area 1
network 10.1.6.1 0.0.0.0 area 0
|
Show ip route ospf
|
Lists OSPF-learned routes, as opposed to the entire IP routing table
|
Note examine the results of show ip route and show ip route ospf commands. Pay special attention to the O designation and IA designation on each route and how they are interpreted.
Configuring the OSPF Router ID
- OSPF-speaking routers must have a Router ID (RID) for proper operation.
- Process for router to find RID
-
- If the router-id rid OSPF subcommand is configured, use the value.
- If any loopback interfaces have an IP address configured and the interface has a line and protocol status of up/up, the router picks the highest numeric IP address among the up/up loopback interfaces.
- the router picks the highest numeric IP address from all other working (up/up) interfaces.
- To configure loopback interfaces:
interface loopback interface-number
- a loopback interface is a virtual interface that is always “up and up” unless administratively placed in shutdown state.
- Each router chooses its OSPF RID when OSPF is initialized.
- Initialization happens during the initial load of IOS.
- If OSPF comes up and later other interfaces come up that happen to have higher IP address, the OSPF RID does not change until the OSPF process is restarted.
- OSPF can be restarted with the command:
clear ip ospf process
|
show ip ospf neighbor
|
The command to list the Router ID of the neighbor
|
|
show ip ospf
|
Lists the router’s own RID
|
OSPF Hello and Dead Timers
A mismatch on either Hello and Dead timers will cause two potential neighbors to never become neighbors
show ip ospf interface – Can be used to see the current settings of the timers, as well as other relevant configuration on the specific OSPF interfaces. For instance, this command lists the area number, OSPF cost, and any neighbors known on each interface.
To configure the Hello and Dead interval, us the following interface subcommands:
ip ospf hello-interval value
ip ospf dead-interval value
Interestingly, if the Hello interval is configured, IOS automatically reconfigures the interface’s dead interval to be 4 times the Hello interval.
OSPF Metrics (Cost)
- To calculate, OSPF adds up the costs for each outgoing interface OSPF costs.
- The OSPF cost for an interface can be configured, or a router can calculate cost based on the interface’s bandwidth settings.
- The bandwidth setting on an interface can be configured with the interface subcommand:
bandwidth
- On Ethernet interfaces, the bandwidth reflects the current negotiated speed:
- 10,000 for 10Mbps
- 100,000 for 100mbps
- For serial interfaces, the bandwidth defaults to:
- 1544 for 1.544Mbps, or T1 speed.
IOS chooses an interface’s cost based on the following rules:
1. Explicitly set the cost, to a value between 1 and 65,535, using the interface subcommand:
ip ospf cost x
2. IOS can calculate a value based on the generic formula Ref-BW / Int-BW, where Ref-BW is a reference bandwidth that defaults to 100Mbps, and Int-BW is the interface’s bandwidth setting.
3. The reference bandwidth can be configured from its default setting of 100 (100 Mbps) using the router OSPF subcommand auto-cost reference-bandwidth ref-bw, which in turn affects the calculation of the default interface cost.
Note of some potentially confusing part when considering the formulas above:
· The Ethernet interface bandwidth defaults to use kbps
· The reference bandwidth defaults a Mbps value
For instance:
· Ethernet interfaces uses bandwidth = 10,000 (meaning 10,000 kbps)
· The reference bandwidth defaults to a value = 100 (meaning 100 Mbps)
Therefore, when we convert both to use Mbps:
Ref-BW 100Mbps
———- = ————
Int-Bw 10Mbps
OSPF Authentication
- The lack of authentication opens the network to attacks in which an attacker connects a router to the network, with the legitimate routers believing the OSPF data from the rogue router
- As a result the attacker can easily cause a denial-of-service attack by making all routers remove the legitimate routes to all subnets, instead installing routes the forward packets to the attacking router.
- The attacker can also perform a reconnaissance attack, learning information about the network by listening for and interpreting the OSPF messages.
OSPF Authentication Types
|
Type
|
Meaning
|
Command to Enable Authentication
|
When the Password is Configured With
|
|
0
|
None
|
ip ospf authentication null
|
—–
|
|
1
|
Clear Text
|
ip ospf authentication
|
ip ospf authentication-key key-value
|
|
2
|
MD5
|
ip ospf authentication message-digest
|
ip ospf message-digest-key key number Md5 key-vlaue
|
