A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
! Modern approach — enable OSPF per interface (IOS 15.1+)R1(config)# router ospf 1R1(config-router)# router-id 10.255.255.1R1(config-router)# auto-cost reference-bandwidth 10000R1(config-router)# exitR1(config)# interface gigabitEthernet0/0R1(config-if)# ip ospf 1 area 0R1(config-if)# exitR1(config)# interface gigabitEthernet0/1R1(config-if)# ip ospf 1 area 0R1(config-if)# exit! Set loopback to advertise (common pattern)R1(config)# interface loopback0R1(config-if)# ip address 10.255.255.1 255.255.255.255R1(config-if)# ip ospf 1 area 0R1(config-if)# exit
Two ways to enable OSPF on Cisco: the interface command (`ip ospf 1 area 0`) or the classic `network` statement under the OSPF process. The interface method is clearer — you can see which interfaces are in OSPF with `show ip ospf interface brief` without reverse-engineering wildcard masks.
! Make user-facing interfaces passiveR1(config)# router ospf 1R1(config-router)# passive-interface gigabitEthernet0/2R1(config-router)# passive-interface gigabitEthernet0/3! Or make everything passive then enable specific interfacesR1(config-router)# passive-interface defaultR1(config-router)# no passive-interface gigabitEthernet0/0R1(config-router)# no passive-interface gigabitEthernet0/1
A passive interface advertises its network into OSPF but doesn't send or receive Hellos on that interface. Use it on every interface where no OSPF neighbor should exist — user VLANs, WAN handoffs to non-OSPF providers, management networks. It's a security and performance best practice.
The `passive-interface default` + explicit `no passive-interface` pattern is safer than adding passive per interface. It's deny-by-default: only interfaces you explicitly enable will form adjacencies. This prevents an attacker from plugging in a rogue OSPF router and forming an adjacency on an access port.
! Enable MD5 authentication on an interfaceR1(config)# interface gigabitEthernet0/0R1(config-if)# ip ospf authentication message-digestR1(config-if)# ip ospf message-digest-key 1 md5 MySecretKeyR1(config-if)# exit! SHA authentication (IOS 15.4+)R1(config)# interface gigabitEthernet0/1R1(config-if)# ip ospf authentication key-chain OSPF_KEYSR1(config-if)# exitR1(config)# key chain OSPF_KEYSR1(config-keychain)# key 1R1(config-keychain-key)# cryptographic-algorithm hmac-sha-256R1(config-keychain-key)# key-string MySecretKeyR1(config-keychain-key)# exit
MD5 authentication prevents rogue OSPF routers from joining the domain. SHA-256 key chains are stronger (MD5 is cryptographically broken) and are the modern standard. Configure authentication on every OSPF link in production — it's cheap insurance against route injection attacks.
`O` indicates an intra-area OSPF route. The `[110/2]` shows AD 110 (OSPF) and metric 2. Metrics increase as the path hops get further from the source — a route with metric 3 passes through two OSPF links, metric 20 passes through more. If a route shows `O IA`, it's inter-area (from another OSPF area via an ABR).
OSPF config is four things: enable OSPF on interfaces, set Router ID, configure reference bandwidth, and make user interfaces passive. Authentication is strongly recommended. Verify with `show ip ospf neighbor` and `show ip route ospf`. Next lesson covers OSPF troubleshooting.
Finish the lesson once you have worked through the material. This awards ★ 15 XP.