JNCIS-SP: Totally Stubby Area Blocks the Customer's Redistributed Routes

Totally Stubby Area Blocks the Customer's Redistributed Routes

A provider runs OSPF with area 0 in the core and area 51 for a managed customer edge. Two ABRs, PE-A and PE-B, sit between area 0 and area 51. Area 51 was configured as a totally stubby area to keep the LSDB small; it holds 41 routers with a 900-route LSDB. Last month the customer added a firewall, CE-FW, inside area 51 that redistributes 12 static routes into OSPF. The customer's NOC, which lives in area 0, needs to see those 12 prefixes as OSPF externals for its reporting tool. Since the change, the redistributed routes never appear on core routers, and CE-FW reports it is receiving a default route from both ABRs. Core engineers insist area 51 must stay as stub-like as possible.

1. Explain why the 12 redistributed prefixes never leave area 51, and specify the minimal area change that keeps the LSDB small while making the prefixes visible in area 0. Include what must be verified on the ABRs.

Read the worked answer

Cause. A stub or totally stubby area cannot carry type-5 LSAs. The ABRs drop type-5 LSAs at the area boundary, so the routes CE-FW originates as externals are never flooded into area 51, and nothing is ever passed up to area 0. CE-FW is effectively an ASBR inside an area that forbids ASBR behaviour.

Change. Convert area 51 from stub to NSSA:

set protocols ospf area 51 nssa

Type-7 LSAs are flooded inside the NSSA and the ABR translates them to type-5 into area 0. To keep the LSDB small, add no-summaries so the ABRs still inject only a default and suppress type-3 summaries:

set protocols ospf area 51 nssa no-summaries
set protocols ospf area 51 nssa default-information-originate

The second line matters: an NSSA ABR does not originate a default on its own, so without it the 41 routers lose their default and the area becomes less usable than before.

Verify on the ABRs.

Translator election: the ABR with the highest router ID translates type-7 to type-5. Confirm only one is translating, otherwise you get duplicate type-5s and churn on every type-7 change.
show ospf database nssa on PE-A/PE-B and show ospf database external on a core router.
Confirm CE-FW still has a default so its own return traffic is not blackholed.

2. With `no-summaries`, both ABRs now inject a default into area 51. Describe the forwarding consequence for the 41 internal routers and recommend a deterministic design.

Read the worked answer

Two default routes with equal cost and equal preference are installed as ECMP on every internal router, so traffic to area 0 and beyond is hashed per flow across PE-A and PE-B. That is usually acceptable for capacity, but it produces asymmetric return paths whenever the customer's firewall or a stateful device sits on one side, and it makes troubleshooting ambiguous because a flow can change ABR only when a session or a prefix disappears.

Recommended:

Keep both defaults but set the metric so one ABR is primary and the other is a real backup: on PE-A (primary) originate the default with a low metric, on PE-B with a higher metric. Internal routers then install one default and one floating default.
If the design intent is load sharing, keep ECMP but make the customer aware that stateful inspection between the two paths will break sessions; in that case pin the customer's stateful flows.
Do not solve this by using the same cost and relying on SPF tie-breaks; ties in OSPF are not stable under topology change.

Check with show ospf route and show route protocol ospf on an internal router: you want one default with a clearly better metric, or an ECMP set you deliberately chose.

3. The area currently converges in about 40 seconds after an ABR uplink failure. The core team wants sub-second detection but is worried about instability. Recommend a convergence design and state what you would not change.

Read the worked answer

Detection vs. convergence are different problems. Forty seconds is OSPF dead-interval behaviour (4 x 10 s hellos). Fix detection with BFD on the two ABR uplinks rather than by shrinking OSPF timers on all 41 routers:

set protocols ospf area 51 interface xe-0/0/0 bfd-liveness-detection minimum-interval 300
set protocols ospf area 51 interface xe-0/0/0 bfd-liveness-detection multiplier 3

BFD gives ~900 ms detection on the two links that matter, without making every adjacency in the area fragile. Aggressive hellos on 41 routers multiply the chance of false positives during control-plane load.

Keep. Standard hello/dead timers, and LSA/SPF throttling defaults. Sub-second hellos across the whole area trade a rare 40 s event for frequent flaps.

Also worth doing.

Make sure BFD is only on the ABR uplinks, not on every access link, so a flapping customer link cannot trigger area-wide SPF.
Confirm the two ABRs are not both Type-7 translators after the failover; a translator change adds an extra LSA round trip that BFD alone will not fix.
Test with a real link pull, not a shutdown, since a shutdown is signalled instantly and hides detection problems.