OSPF Cheat Sheet

1. OSPF at a glance

Open Shortest Path First (OSPFv2) is a link-state interior gateway protocol. Routers flood link-state information within their area, build an LSDB, and run SPF (Dijkstra) to select routes. It uses IP protocol number 89, not TCP/UDP port 89. Default Cisco administrative distance is 110; multicast 224.0.0.5 reaches all SPF routers and 224.0.0.6 targets DR/BDR on broadcast networks.

2. Understand the five-router enterprise lab

R1, R2, and R3 form backbone Area 0. R1 connects Area 10 to R4; R3 connects Area 20 to R5. The R1–R3 link provides an alternate backbone path. All numbered /30 links are point-to-point, with no DR/BDR election. VLAN 100 on the shared backbone broadcast segment illustrates a place where DR/BDR applies if two or more OSPF routers share it. R1 and R3 are ABRs. Loopbacks provide stable router IDs. The diagram is conceptual: add an OSPF-speaking router to VLAN 100 for an actual multi-router DR/BDR lab.

3. Essential facts and timers

Typical Ethernet broadcast OSPFv2 hello/dead timers are 10/40 seconds, subject to platform and network type. On point-to-point Ethernet use ip ospf network point-to-point to prevent DR election. Router IDs must be unique; areas must match on neighbors; authentication and compatible hello/dead intervals matter. IP MTU differences often cause adjacency problems during database exchange. On multiaccess networks, 2-Way can be normal between two DROTHER routers.

4. Neighbor states

Down → Init → 2-Way → ExStart → Exchange → Loading → Full. Attempt can appear on NBMA manually configured neighbors. ExStart negotiates master/slave and DBD sequencing; Exchange shares DBD summaries; Loading requests missing LSAs. On point-to-point links the expected stable state is FULL/-. On broadcast, FULL/DR, FULL/BDR, or FULL/DROTHER depends on election; 2-Way can be normal between DROTHERs.

5. LSAs you must recognize

Type 1 Router: generated by every router and restricted to its area. Type 2 Network: generated by DR for a broadcast transit network. Type 3 Summary: ABR distributes inter-area prefixes. Type 4 ASBR Summary: provides reachability to an ASBR when needed. Type 5 AS External: external routes except where prohibited (for example, stub areas). Type 7 NSSA External: introduced within an NSSA, with eligible routes translated by the ABR to Type 5. OSPFv3 has different LSAs and header fields—do not reuse OSPFv2 packet diagrams for OSPFv3.

6. Area design and route types

Backbone Area 0 interconnects other areas. Standard areas accept normal external routes. Stub areas block Type 5 external LSAs and use an ABR-provided default route; totally stubby is a Cisco extension reducing summary LSAs. NSSA permits external redistribution via Type 7 LSAs. In the route table: O = intra-area, O IA = inter-area, O E1/E2 = external, O N1/N2 = NSSA external. E1 combines internal cost toward ASBR and external metric; E2 normally compares external metric first.

7. Route cost, DR/BDR and redundancy

OSPF cost is configurable using ip ospf cost VALUE, or computed from a reference bandwidth divided by interface bandwidth (integer minimum 1). Set the same auto-cost reference-bandwidth on all routers, such as 100000 Mbps for 100-Gbps links. On a broadcast segment highest eligible OSPF interface priority becomes DR, then BDR, with router ID breaking ties. Priority 0 is ineligible. Existing DR/BDR elections are non-preemptive. No DR on point-to-point links.

8. Security and defensive design

Restrict OSPF neighbor formation to trusted routed links; use passive-interface default and enable only transit interfaces. Authenticate every adjacency. Where the platform supports it, use key-chain cryptographic authentication with HMAC-SHA-256 (example below); MD5 (ip ospf message-digest-key) remains only for compatibility with older peers. Filter unauthorized OSPF protocol 89 at untrusted boundaries; avoid indiscriminate redistribution; scope and summarize routes, monitor adjacency flaps and LSDB changes. Do not treat OSPF authentication as confidentiality or route authorization.

! Same key chain on both neighbors (e.g. R1 and R2)
key chain OSPF-KEYS
 key 1
  key-string REPLACE-WITH-STRONG-SECRET
  cryptographic-algorithm hmac-sha-256
!
interface GigabitEthernet0/0/0
 ip ospf authentication key-chain OSPF-KEYS

Replace the demonstration secret, keep it out of shared repositories, confirm support on your exact IOS XE release, and roll keys on both ends together. Verify with show ip ospf interface GigabitEthernet0/0/0, which reports the authentication in use.

9. Troubleshooting workflow

1) Check physical and L3 state (show ip interface brief). 2) Check OSPF participation (show ip ospf interface brief). 3) Verify area, network type, timers, subnet, MTU, authentication and router IDs (show ip ospf interface, show ip ospf neighbor detail). 4) Inspect database (show ip ospf database), then routing decisions (show ip route ospf). 5) Inspect logs before using debugs; debug ip ospf adj can be noisy, so use only in controlled maintenance.

10. Common failures and fixes

STUCK IN INIT: Unidirectional reachability or multicast/ACL filtering; verify bidirectional Hellos. STUCK EXSTART/EXCHANGE: investigate MTU mismatches and DBD exchange; do not use ip ospf mtu-ignore as a first fix. NEIGHBOR MISSING: wrong area/network type, interface passive, authentication mismatch, protocol 89 blocked. FULL BUT NO ROUTE: verify LSAs, area type, summarization, better administrative-distance route, and prefix visibility. UNSTABLE DR: priority changes alone do not preempt existing DR.

11. Operational best practices

Use clear interface descriptions, router-ID loopbacks, consistent reference bandwidth, point-to-point OSPF network types on dedicated routed links, defined area boundaries, stable ABRs, route and adjacency monitoring, and a tested change-backout plan. Avoid virtual links as a long-term backbone design; use them as exceptional transitional mechanisms.