OSPF multi area routing, the core commands

why a routing protocol is a security tool too

ospf gets taught like it's pure networking trivia, memorize the commands, pass the exam, move on. but if you're the person responsible for a network, ospf is also part of your attack surface. every interface that speaks ospf is a door that a rogue device could walk through and start injecting fake routes. understanding the core commands isn't just about getting routes to converge, it's about knowing exactly where those doors are so you can lock the ones that don't need to be open.

setting a stable router id

ospf needs a router id, a 32-bit number that uniquely identifies each router in the ospf domain. if you don't set one manually, the router will grab the highest ip on a loopback or physical interface, which means your router id can silently change if an interface goes down or a new one comes up. that's a headache for troubleshooting and it also means you might not immediately recognize your own router in the topology.

router ospf 1
 router-id 1.1.1.1

set it manually, make it predictable, and document it. when you're staring at a neighbor table trying to figure out if something looks wrong, you want to instantly know which id is you and which id is not supposed to be there.

network statements and area boundaries

this is where you tell ospf which interfaces actually participate and which area they belong to.

network 10.0.0.0 0.0.0.3 area 0
network 10.1.1.0 0.0.0.255 area 1

the wildcard mask is the inverse of a subnet mask, it tells the router which bits to match. area 0 is the backbone, area 1 is a regular area hanging off it. from a defensive standpoint, area design matters because it limits blast radius. if something goes wrong or gets compromised in area 1, a well designed multi area setup keeps that mess from flooding link state advertisements across your entire backbone. flat, single area networks are easier to set up and easier to break in ways that spread everywhere.

passive interface, your best free security control

this is the command people skip and shouldn't.

router ospf 1
 passive-interface GigabitEthernet0/1

passive-interface tells ospf "advertise this network, but don't send or accept ospf hellos on it." use it on any interface where you know there's no legitimate ospf neighbor, like a lan segment full of end user devices or servers. why does this matter for defense? because if you leave ospf actively speaking on a segment with no real neighbor, you've left a door open. anyone who plugs a device into that segment and configures ospf can potentially form an adjacency and start advertising routes into your network, including routes that redirect traffic somewhere they control. passive-interface shuts that door on every segment that doesn't need it open. a good habit is to make everything passive by default and only enable active ospf on the specific links where real neighbors live.

router ospf 1
 passive-interface default
 no passive-interface GigabitEthernet0/0

that flips the default so you have to explicitly turn ospf on for a link, instead of explicitly turning it off. much harder to accidentally leave a door unlocked.

checking neighbor state, the health check

show ip ospf neighbor

this shows every device your router currently sees as an ospf neighbor, along with the state of that adjacency. you want to see FULL. that means both routers have fully exchanged their link state databases and route exchange is actually happening. states like 2WAY or EXSTART stuck in a loop usually mean a mismatch, wrong area, wrong subnet, mtu mismatch, or an authentication problem.

as a defender, run this command regularly and know your baseline. if you see a neighbor router id you don't recognize, or a neighbor forming on an interface that should be passive, that's your signal something unauthorized is trying to join your routing domain. treat an unexpected ospf neighbor the same way you'd treat an unexpected device on your network, investigate it immediately.

the takeaway

ospf isn't just plumbing, it's a trust relationship between routers. set a stable router id so you always know what's you, use areas to contain damage, default to passive-interface everywhere and only open up the links that need real neighbors, add md5 or sha authentication on your ospf links if your gear supports it, and check show ip ospf neighbor like you'd check a firewall log, regularly and with a baseline in mind. dynamic routing is convenient. convenient things need locks too.