Multi-area OSPF: configuration, ABRs, path selection and virtual links

Why split OSPF into areas

In a single area every router stores every router and network LSA and reruns SPF whenever anything changes. That is fine for a few dozen routers. With hundreds, the database grows, SPF runs often and one unstable link anywhere disturbs everyone. Areas put a boundary around that detail. Inside an area routers know the full topology; outside it they only see prefixes and costs.

An area border router (ABR) has interfaces in area 0 and at least one other area. It keeps a separate database for each area, runs SPF for each, and creates type 3 summary LSAs to describe each area's prefixes to the others. The rule that every area must touch area 0 prevents routing loops between areas.

Configuring several areas

The area is a property of each interface, not of the router. You can use network statements with wildcard masks, or the clearer interface method shown here for ABR 1 in Figure 2.

router ospf 1
 router-id 10.0.0.11
 passive-interface default
 no passive-interface GigabitEthernet0/0
 no passive-interface GigabitEthernet0/1
!
interface GigabitEthernet0/0
 description To core (backbone)
 ip ospf 1 area 0
!
interface GigabitEthernet0/1
 description To branch routers
 ip ospf 1 area 10
!
interface Loopback0
 ip address 10.0.0.11 255.255.255.255
 ip ospf 1 area 0

Check the result with show ip ospf (it states that the router is an area border router and lists each area), show ip ospf interface brief (area per interface) and show ip route ospf, where routes from other areas are marked O IA.

Tip: plan areas around the address plan. If each area uses one contiguous block, the ABR can summarise it into a single route, which is where most of the benefit of areas comes from.

How OSPF chooses a path

OSPF compares route types before it compares cost. A route inside your own area always beats a route through another area, and any internal route beats an external one. Only between routes of the same type does the lowest cost win.

• E2 (the default for redistributed routes) keeps the seed metric set by the ASBR, usually 20, all the way through the domain. If two ASBRs advertise the same E2 metric, routers break the tie with the cost to reach each ASBR.
• E1 adds the internal cost to the ASBR, so each router naturally prefers its nearest exit. Use it when you have several exits and want traffic to leave by the closest one.
• N1 and N2 are the same ideas for routes from an NSSA.

Virtual links

Sometimes an area cannot touch area 0 directly, for example after a merger or when a backbone link fails and splits area 0 in two. A virtual link is a logical link through a normal (transit) area that connects a distant ABR back to the backbone. It is configured on both ends, naming the transit area and the router ID of the other end.

router ospf 1
 area 10 virtual-link 10.0.0.12

The virtual link belongs to area 0, so any area 0 authentication must also be applied to it. The transit area cannot be a stub area. Treat virtual links as a temporary repair: they make the design harder to understand and troubleshoot. The lasting fix is a real backbone connection or a redesign of the areas.

Real-world example: a bank's branch network

A regional bank ran 180 branch routers and two data centres in a single OSPF area. Each time a branch's broadband link flapped, every router in the network reran SPF, and the oldest branch routers showed high CPU. The team moved each region's branches into their own area (10, 20, 30 and so on) behind a pair of ABRs, and gave each region one contiguous /16. The ABRs advertised one summary per region into area 0. Branch flaps then only caused SPF inside that region, the core routing table shrank from hundreds of branch subnets to a handful of summaries, and CPU alarms on the older routers stopped.