OSPF default routes, summarisation and route filtering

Advertising a default route

Most networks have one or two routers that connect to the internet or a provider. Rather than giving every router a static default route, you let those edge routers advertise 0.0.0.0/0 into OSPF. The command is default-information originate, and it turns the router into an ASBR that floods a type 5 LSA for the default route.

ip route 0.0.0.0 0.0.0.0 203.0.113.1
!
router ospf 1
 default-information originate metric 10 metric-type 1

By default the router only advertises the default if it has one in its own routing table, so if the internet link fails the route is withdrawn and traffic moves to the other exit. Adding always advertises it regardless. Use always carefully: it can attract traffic to a router that has nowhere to send it. Using metric-type 1 makes each router prefer its nearest exit.

Summarisation: only at the edges

Inside an area every router must hold the same LSDB, so OSPF cannot summarise there. It can summarise in two places:

• Inter-area summarisation on an ABR with area X range. The ABR advertises one type 3 LSA for the range instead of one per subnet, as long as at least one subnet in the range exists.
• External summarisation on an ASBR with summary-address, which replaces many type 5 (or type 7) LSAs with one.

router ospf 1
 area 10 range 10.10.0.0 255.255.0.0
 summary-address 172.20.0.0 255.255.0.0

The router that summarises installs a discard route to Null0 for the summary. Traffic for unused addresses inside the range is dropped there instead of looping towards a default route. The CIDR calculator helps you check that a range covers exactly the subnets you mean. Summaries also hide instability: when one branch subnet flaps, the summary stays up, so routers elsewhere do not rerun calculations.

Tip: a summary that covers addresses used somewhere else in the network causes black holes. Summarise only blocks that live entirely behind that ABR.

Filtering routes

ip prefix-list NO-LAB seq 5 deny 10.99.0.0/16 le 32
ip prefix-list NO-LAB seq 10 permit 0.0.0.0/0 le 32
!
router ospf 1
 area 0 filter-list prefix NO-LAB in

The filter-list above stops the lab network 10.99.0.0/16 from being advertised into area 0 by this ABR. The distribute-list is the one people misunderstand: because it does not stop flooding, routers further on still learn the route, and a router that filters a route locally can black-hole traffic that others send to it.

Real-world example: a manufacturer's two internet exits

A manufacturer had internet links at its head office and at its main factory. Both edge routers used default-information originate always, which an earlier contractor had added. When the factory's fibre was cut by roadworks, the factory router kept advertising the default, and every site nearer the factory kept sending internet traffic to a dead end. The engineer removed always from both routers and tracked each static default route with IP SLA, so each default route, and therefore its OSPF advertisement, disappeared when the provider stopped answering. She also changed both to metric-type 1, so each site used its nearest working exit.