Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

OSPF areas: Analysing an apprently redundant design - Cisco way

OSPF areas: Analysing an apprently redundant design - Cisco way

Ok. So we know a little bit about OSPF from previous articles. Here is a recap:

- All internal destinations within an area are advertised througy Type 1 LSA (Router LSA) in OSPF.
- These internal destinations reach the ABR (Area Border Router) and they are injected as type 3 LSA (Summary LSA) into area 0 (backbone area) from any non backbone area or in a non-backbone area only if origin area is backbone area (from any area into area 0 and from area 0 in any area). This is Cisco default. Juniper behaves a little differently. This behavior is described in RFC3509 and it is followed by Cisco and not by Juniper. Not a big problem imho because loops are still avoided.

Note: Why loops are still avoided ? What kind of loops are we talking about here ? Answer to q2: LSA loops. Answer to Q1 is complex: Although Cisco does not inject a destination from Area 10 (in Router LSA) into area 20 as summary LSA (workaround exists) and Juniper does it (Junos behaves as ABR if it has interfaces in two non-backbone areas), NEITHER cISCO NOR JUNIPER INJECT TYPE 3 SUMMARY LSA FROM A NON-BACKBONE AREA TO ANOTHER NON-BACKBONE AREA. THIS IS WHERE THE LOOP STOPS. The second part of the answer is that both Cisco and Juniper ignore type 3 Summary LSA received on non-backbone area when they have an adjacency in area 0. To my understanding at least.

In the newbie diagram, I have an apparently redundant OSPF area design.

From R6 (loopback 6.6.6.6) traceroute to R5 (loopback 5.5.5.5) goes via R2:


Why does R6 chose path via R2 in the above diagram ? The answer is not quite simple & obvious. Let's analyse:
R5 injects a type 1 router LSA into area 20:


R5's loopback is seen as a stub (last link ID).

In area 0 this destination is injected only by R2 (the only ABR of area 2 according to RFC3509). R3 not being tangent to area 0, will not inject a summary LSA into area 10 and even if it did, R1 would ignore the summary from R3 because it has adjacency with R6 oer area 0.


Type 3 LSA with ID 5.5.5.5 was injected by R2 only (advertising router 2.2.2.2).

What happens if link between R6 and R2 goes down ?
Of course, traffic will go outside the AS (assuming there's a default route to the internet) or dropped (assuming there is a null route aggregating organization assigned prefix space).

Ways to fix this ? Only few.
- Redundant ABRs for each area.
- Adding an area 0 link between R1 and R2. This of course doesn't offer resiliency should R2 router fail completely.
- A virtual link between R1 and R3.
- And possibly more.

Let's look at 3rd option:


What has changed ? Since R3 now has a virtual link to R1, it becomes an ABR. It will take the type 1 LSA from R5 and for all Link IDs, it will inject a Summary LSA in unicast (?) form to R1. R1 will forward this LSA to R6.