OSPF router ID, hello and dead timers, passive interfaces and cost tuning

The router ID

Each OSPF router needs a unique 32-bit router ID (RID), written like an IPv4 address. It names the router in every LSA it creates, so it must never be duplicated. A Cisco router chooses it in this order:

1. The value set with the router-id command.
2. Otherwise, the highest IPv4 address on an up loopback interface.
3. Otherwise, the highest IPv4 address on any other up interface.

The RID is chosen when the process starts and does not change on its own. If you change it, run clear ip ospf process (in a maintenance window, as it drops all adjacencies). Good practice is to set it to the router's management loopback address so the RID, DNS name and loopback all agree.

Hello and dead intervals

Hellos keep the adjacency alive. If no hello arrives within the dead interval, the neighbour is declared down and routes through it are recalculated. Defaults are 10 and 40 seconds on broadcast and point-to-point links, 30 and 120 seconds on non-broadcast and point-to-multipoint. Both values must match between neighbours, or they will not form an adjacency.

interface GigabitEthernet0/1
 ip ospf hello-interval 5
 ip ospf dead-interval 20

Changing the hello interval on IOS also sets the dead interval to four times the hello, unless you set it explicitly. Shorter timers detect failure faster but cost more CPU and can drop adjacencies on busy routers. For sub-second detection, BFD (Bidirectional Forwarding Detection) is a better tool: it runs a lightweight hello in hardware and tells OSPF immediately when a link fails, while the OSPF timers stay at their defaults.

interface GigabitEthernet0/1
 bfd interval 300 min_rx 300 multiplier 3
 ip ospf bfd

Passive interfaces

A passive interface still has its subnet advertised into OSPF, but sends and accepts no hellos, so no adjacency can form on it. Use it on every interface facing users, servers and printers. It saves a little processing and, more importantly, stops a laptop running routing software from becoming a neighbour and injecting false routes.

router ospf 1
 router-id 10.0.0.1
 passive-interface default
 no passive-interface GigabitEthernet0/1
 no passive-interface GigabitEthernet0/2

The passive-interface default approach is safer than listing passive ports one by one, because any new interface starts passive until you choose otherwise.

Reference bandwidth and interface cost

OSPF cost is the reference bandwidth divided by the interface bandwidth. With the old default of 100 Mbit/s, every link of 100 Mbit/s or faster costs 1, so OSPF cannot tell 1 Gbit/s from 100 Gbit/s. Raise the reference bandwidth (in Mbit/s) to above your fastest link, on every router, otherwise routers calculate inconsistent costs.

router ospf 1
 auto-cost reference-bandwidth 400000
!
interface GigabitEthernet0/3
 description Backup path, avoid unless needed
 ip ospf cost 500

The ip ospf cost command overrides the calculation on one interface. It is the cleanest way to make one path a backup. Changing the bandwidth command also changes cost, but it affects other features such as QoS and EIGRP too, so prefer setting the cost directly.

Verify everything with show ip ospf (RID, reference bandwidth), show ip ospf interface brief (cost and state of each interface) and show ip protocols (passive interfaces).

Real-world example: the router that changed its name

A retailer's regional router had no router ID set, so it used the highest loopback, 10.255.0.9. During a tidy-up an engineer added a new loopback, 10.255.0.200, for a monitoring tool. Nothing happened until the next reboot weeks later, when the router came up with the new RID. Monitoring dashboards that tracked OSPF neighbours by RID raised alarms, and one script that filtered routes by advertising router stopped matching. The fix was to set router-id 10.255.0.9 explicitly and clear the process in a maintenance window. Their build standard now sets the RID on every router from day one.