OSPF stub, totally stubby and NSSA areas explained with configuration

The idea behind stub areas

A branch area with one or two exits gains nothing from knowing every external route in the network: whichever route it picks, traffic leaves through the same ABR. A stub area tells the ABR to keep those details out and send a default route instead. The branch routers get smaller databases and routing tables, and less churn when something changes far away.

Stub and totally stubby

• Stub: no type 5 external LSAs and so no type 4 either. The ABR injects a default route as a type 3 LSA. Inter-area (type 3) routes still arrive.
• Totally stubby (a Cisco extension, now widely supported): blocks type 3 routes as well, except the default. Routers inside see only their own area plus 0.0.0.0/0.

! On every router in area 20
router ospf 1
 area 20 stub
!
! On the ABR only, to make it totally stubby
router ospf 1
 area 20 stub no-summary

The stub setting is carried in the hello packet, so every router in the area must agree or they will not form adjacencies. Area 0 can never be a stub, a stub area cannot contain an ASBR, and a stub area cannot carry a virtual link.

NSSA and totally NSSA

Sometimes a branch area needs to bring in external routes of its own. A typical case is a site that connects a partner network or an old system through a separate router, with routes redistributed into OSPF there. A plain stub area forbids that. A not-so-stubby area (NSSA) still blocks type 5 LSAs coming from the rest of the network, but lets a local ASBR advertise its own externals as type 7 LSAs. They appear as O N1 or O N2 routes inside the area.

! On every router in area 30
router ospf 1
 area 30 nssa
!
! On the ABR: totally NSSA (no type 3 except a default)
router ospf 1
 area 30 nssa no-summary
!
! On the ABR: plain NSSA does not create a default automatically
router ospf 1
 area 30 nssa default-information-originate

Note the difference: a stub area gets a default route automatically, but a plain NSSA does not. A totally NSSA area (with no-summary) does get one automatically.

Type 7 translation and the P-bit

Type 7 LSAs never leave the NSSA. At the boundary, an ABR translates each type 7 LSA into a type 5 LSA and floods that to the rest of the domain. If several ABRs serve the NSSA, only one does the translating: the one with the highest router ID.

Each type 7 LSA carries a P-bit (propagate bit). When it is set, the ABR translates the route; when it is clear, the route stays inside the NSSA. A local ASBR normally sets it. It is cleared in some cases, such as when the ASBR is itself an ABR and already advertises the route as type 5 into area 0, so it would be pointless to translate it again. If an NSSA external route is visible inside the area but missing everywhere else, check the P-bit with show ip ospf database nssa-external and check which ABR is translating.

Real-world example: a supermarket chain's stores

A supermarket chain ran each region's stores in an OSPF area. The core redistributed several thousand external routes from partner and cloud connections, and the small store routers were running low on memory holding them all. The team made each store area totally stubby, so stores saw only their regional routes and a default. One region was different: its distribution centre connected to a logistics partner through a separate router that redistributed the partner's routes. That area became an NSSA, so the partner routes entered as type 7, were translated to type 5 at the ABR, and reached the rest of the company, while the stores in that area still did not receive the core's external routes.