Nokia NRS II Composite (OSPF) cheat sheet

OSPF is a link-state IGP using Dijkstra SPF; each router floods LSAs describing its local topology and computes a loop-free shortest-path tree from the synchronized LSDB.

Administrative distance on Nokia SR OS: OSPF internal routes default 10, OSPF external routes default 150; static routes default 5, BGP 170.

Router ID selection order: explicit router-id, else highest loopback IPv4 address, else highest interface IPv4 address; a change requires OSPF restart to take effect.

Hello timers must match on a segment: default hello 10 s / dead 40 s on broadcast and point-to-point; hello 30 s / dead 120 s on NBMA and point-to-multipoint.

Area 0 is the backbone; all other areas must attach to it, either physically or via a virtual link, and inter-area traffic transits area 0.

Cost formula: interface cost = reference-bandwidth / interface bandwidth. SR OS default reference bandwidth is 100 Gbps (100000 Mbps), so 10G, 40G and 100G links all cost 1 unless changed.

OSPFv3 runs over IPv6 link-local addresses (fe80::/10) and uses a per-link model; OSPFv2 runs directly over IPv4 protocol number 89.

Router types: internal, area border router (ABR, attached to area 0 plus another area), backbone router (any interface in area 0), AS boundary router (ASBR, redistributes externals).

Five packet types: Hello (1), Database Description (2), Link State Request (3), Link State Update (4), Link State Acknowledgment (5).

Neighbor states in order: Down, Attempt (NBMA only), Init, 2-Way, ExStart, Exchange, Loading, Full.

2-Way is reached when the local router sees its own router ID in the neighbor's hello; on broadcast media non-DR/BDR pairs stay in 2-Way by design.

ExStart/Exchange negotiate master/slave via the DD sequence number; the higher router ID becomes master and controls the exchange.

MTU mismatch is a classic cause of neighbors stuck in ExStart/Exchange because the DD packet carries an interface MTU field; SR OS option interface mtu-check can be disabled to interoperate.

Hello packet carries: router ID, area ID, hello/dead intervals, options field, DR/BDR addresses, neighbor list, and (on NBMA) poll interval.

Duplicate router IDs prevent adjacency formation (neighbor state shows the conflict) and cause LSDB churn; verify with show router ospf neighbor.

On broadcast/NBMA networks, DR/BDR election uses priority (default 1, 0 = ineligible) then highest router ID; election is not preemptive unless the DR fails.

LSA types: 1 Router, 2 Network, 3 Summary, 4 ASBR Summary, 5 AS External, 7 NSSA External; OSPFv3 adds link (8) and intra-area prefix (9) LSAs.

Type 1 LSAs are flooded within one area only; type 3/4 are generated by ABRs and flooded across areas; type 5 is flooded domain-wide except into stub/NSSA areas.

LSA age increases in the LSDB and is flooded with the LSA; an LSA reaching MaxAge (3600 s) is reflooded and removed unless refreshed by its originator.

LSDB synchronization is verified by comparing the LSA count and checksum across neighbors with show router ospf database; identical checksums indicate a synchronized area.

Sequence numbers are 32-bit signed; the higher sequence wins, and a router receiving a newer LSA must install and reflood it.

Type 2 network LSA is generated by the DR of a broadcast/NBMA segment and lists all attached routers that reached at least 2-Way.

Type 4 ASBR summary is generated by ABRs to advertise reachability to an ASBR located in another area, so external routes can be resolved.

Standard area: accepts type 1, 2, 3, 4, 5. Stub: blocks type 5 and type 4, ABR injects a default summary (type 3) into the stub.

Totally stubby (SR OS: stub with no summaries / summary-default suppression): blocks type 3, 4, 5 except the ABR default; configure with the appropriate no-summary option.

NSSA: blocks type 5 but allows type 7 originated inside the area; the ABR translates type 7 to type 5 when exporting to the backbone unless the P-bit is clear.

Totally NSSA: blocks type 3, 4, 5 and allows type 7; ABRs inject a default type 3 (or type 7 default) into the area.

Type 7 to type 5 translation is done by the NSSA ABR with the highest router ID; the forwarding address in the type 7 is preserved in the type 5.

Stub and NSSA areas cannot be transit areas and cannot carry virtual links; area 0 can never be configured as stub or NSSA.

Area ranges (ABR summarization) aggregate type 3 LSAs; a range can be advertised as not-advertised to suppress specific prefixes.

External route types: E1 cost = external cost + internal path cost to ASBR; E2 cost = external cost only (default on SR OS), with a forwarding metric tie-break.

SPF runs per area: first build the shortest-path tree from type 1 and type 2 LSAs, then attach type 3 summaries, then resolve type 5/7 externals.

SPF is triggered by a change to a type 1 or type 2 LSA; a change to type 3, 4, 5 or 7 triggers only a partial (incremental) SPF.

SPF throttling on SR OS uses timers (spf-wait) with initial, secondary and maximum intervals to damp repeated calculations.

The router computes its own type 1 LSA with cost 0 as the root; stub networks are added as leaves with the interface cost of the advertising router.

Equal-cost paths are installed in the RTM up to the ECMP limit; SR OS supports up to 32 equal-cost next hops per prefix (configurable).

A router with no route to an ASBR cannot resolve type 5 LSAs; the external appears but is not installed in the routing table.

Area border routers run a separate SPF instance per attached area; type 3 LSAs are derived from the source area's SPF result.

Interface cost = reference-bandwidth / bandwidth, rounded down, minimum 1; set explicitly with interface cost under the OSPF interface context.

SR OS reference bandwidth is configurable (reference-bandwidth) in Mbps; raising it above 100000 gives 100G and 400G links distinct costs.

ECMP installs multiple equal-cost next hops when the total path cost ties; unequal-cost multipath is not supported by OSPF.

SR OS ECMP limit: config ecmp under router context, default 16, maximum 32 per prefix.

Bandwidth-aware metrics can be applied via TE or by manual cost; OSPF itself does not use bandwidth dynamically.

Changing an interface cost changes the router's type 1 LSA and triggers a full SPF in that area.

For external routes, E2 cost ignores internal cost, so ECMP across ASBRs uses only the external metric unless the type is E1.

A virtual link connects an area to the backbone through a transit area; both endpoints must be ABRs with an interface in the transit area.

Configuration is on the ABR: area virtual-link ; the remote router ID must be reachable via the transit area.

The virtual link is treated as an unnumbered point-to-point link in area 0 and carries type 1 LSAs for the backbone.

The transit area must have full routing information (cannot be stub or NSSA) and must not be the backbone itself.

Hello/dead timers on the virtual link default to the standard values; they must match on both endpoints.

Virtual links are a workaround for a partitioned backbone; they do not forward multicast and add complexity, so physical area 0 connectivity is preferred.

Verify with show router ospf virtual-link and confirm the interface state is up and the neighbor reaches Full.

Redistribution into OSPF is configured with export policies referencing the routing protocol; SR OS uses policy-based export, not a simple redistribute statement.

Redistributed routes become type 5 LSAs (or type 7 inside NSSA); the ASBR must have a route to the external network in the RTM.

Default route injection: default-inject in the OSPF instance, or originate-default in an export policy; use metric and metric-type to control E1/E2.

Stub areas receive a default from the ABR automatically; NSSA ABRs inject a default only if configured (e.g., default-inject in the NSSA area context).

Type 7 LSAs have the P-bit (propagate) set by the originating ASBR; the translating ABR clears it when the forwarding address is unreachable.

Redistributed connected and static routes must be matched explicitly in the export policy; an empty policy matches nothing.

Loop prevention: never redistribute OSPF into OSPF; use route tags on redistributed routes and filter tagged routes on re-injection.

Enable OSPF: configure router ospf with router-id, then interface "system" and interface "to-x" area 0.0.0.0.

OSPFv3 is configured with ospf3 and IPv6 interfaces; it uses link-local addresses and a separate LSDB from OSPFv2.

Interface-level knobs: interface-type (broadcast, point-to-point, nbma, point-to-multipoint), priority, cost, hello-interval, dead-interval, authentication.

Area-level knobs: area stub, nssa, area-range, virtual-link, interface.

Verify with show router ospf neighbor, show router ospf interface, show router ospf database, show router ospf routes.

MD5 authentication: interface authentication-key hash-key (or authentication-type md5); OSPFv3 uses IPsec AH/ESP instead of native auth.

Graceful restart: configure graceful-restart under the OSPF instance to preserve forwarding during control-plane restart.

OSPFv2 supports null, simple password (type 1) and MD5 (type 2); SHA-based key chains are supported on SR OS via authentication-key hash-key.

Authentication must match on both ends of a link; a mismatch keeps neighbors in Down or Init and generates authentication failure counters.

OSPFv3 has no native authentication field; it relies on IPv6 IPsec (AH/ESP) or upper-layer checksum protection.

Passive interfaces (interface passive) advertise the network without forming adjacencies, preventing rogue OSPF on access ports.

Use interface-type point-to-point on point-to-point links to skip DR election and speed convergence.

Filter type 3 LSAs with area-range not-advertised or export policies to limit prefix propagation between areas.

BGP/OSPF interaction: set the OSPF router ID and use route tags to prevent feedback loops when redistributing mutually.

LFA (loop-free alternate) precomputes a backup next hop per prefix using the inequality: distance(N, D) < distance(N, S) + distance(S, D).

SR OS enables LFA with config router ospf loopfree-alternate; verify with show router ospf route detail (shows LFA next hops).

Remote LFA uses a tunnel to a PQ node to cover topologies where no local LFA exists; TI-LFA uses segment routing to build the repair path.

TI-LFA requires segment routing (SR-OSPF) enabled on the interfaces; the repair path is a label stack computed from the post-convergence SPF.

Bidirectional Forwarding Detection (BFD) accelerates failure detection; configure bfd-liveness under the OSPF interface with a short interval.

SPF and LSA throttling (spf-wait, lsa-generate) prevent CPU overload during flapping; tune the initial and maximum intervals.

Graceful restart (helper and restarting router) maintains forwarding while the control plane restarts, using grace LSAs.

Neighbor stuck in Init: hello received but local router ID not in the neighbor's hello - check bidirectional reachability and ACLs.

Neighbor stuck in ExStart/Exchange: MTU mismatch, duplicate router ID, or unicast filtering of DD packets.

Neighbor stuck in Loading: LS request not answered - check for missing LSAs, max-lsa limits, or filtered updates.

show router ospf neighbor detail shows state, DR/BDR, dead timer, and options; use it first for adjacency issues.

show router ospf database detail shows LSA age, sequence, checksum, and advertising router; compare checksums across routers.

show router ospf routes and show router route-table protocol ospf confirm what SPF installed versus what the RTM selected.

debug router ospf packet and debug router ospf event provide packet-level and state-machine traces; enable with care on production.