Open Shortest Path First — a link-state interior gateway protocol (IGP) that uses Dijkstra’s SPF algorithm to calculate the shortest path tree within an autonomous system.
Key Characteristics
Property
Value
Type
Link-State IGP
Algorithm
Dijkstra / Shortest Path First (SPF)
Protocol Number
IP 89
Administrative Distance
110
Metric
Cost (reference bandwidth / interface bandwidth)
Multicast (AllSPFRouters)
224.0.0.5
Multicast (AllDRouters)
224.0.0.6
Hierarchical Design
Areas (Area 0 = backbone, required)
Authentication
Null, Plain Text, MD5, SHA (OSPFv3)
Standards
RFC 2328 (OSPFv2), RFC 5340 (OSPFv3)
Area Types
Area Type
Description
LSAs Allowed
Default Route
Backbone (Area 0)
Transit area — all other areas must connect to it
1, 2, 3, 4, 5
No
Standard
Normal non-backbone area
1, 2, 3, 4, 5
No
Stub
No external routes — ABR injects default route
1, 2, 3
Yes (Type 3)
Totally Stubby
No external or inter-area routes — only default
1, 2
Yes (Type 3)
NSSA
Allows limited external routes via Type 7 LSAs
1, 2, 3, 7
No (configurable)
Totally NSSA
NSSA + no inter-area summaries
1, 2, 7
Yes (Type 3)
When to use Stub/NSSA: Reduce LSDB size and SPF computation in areas that don’t need full external route knowledge (e.g., branch offices, remote sites behind a single ABR).
LSA Types
LSA Type
Name
Description
Example / Use Case
Type 1
Router LSA
Produced by every router. Describes the router’s interfaces and neighbors within a single area.
Seeing your Palo Alto’s directly connected interfaces in the Cisco LSDB.
Type 2
Network LSA
Produced by the DR (Designated Router) on multi-access segments (like Ethernet). Describes all routers attached to that segment.
A Cisco switch acting as DR representing a shared VLAN of multiple OSPF speakers.
Type 3
Summary LSA
Produced by the ABR (Area Border Router). Describes routes learned from one area and advertised into another.
Your Cisco Core (ABR) telling Area 1 about the subnets existing in Area 0.
Type 4
ASBR Summary
Produced by the ABR. Tells other areas how to reach the ASBR (Autonomous System Boundary Router).
The Cisco Core telling remote areas: “If you want to reach the Palo Alto (ASBR), come to me.”
Type 5
AS External
Produced by the ASBR. Describes routes redistributed into OSPF from another protocol (Static, BGP, Connected).
Palo Alto redistributing GlobalProtect VPN pools or Static ISP routes into the Cisco core.
Type 7
NSSA External
Produced by an ASBR within a Not-So-Stubby Area (NSSA).
A Palo Alto in an NSSA area redistributing routes (later converted to Type 5 by the ABR).
Type 8
Link LSA
(OSPFv3 / IPv6 only) Provides the link-local address of the router to all neighbors on that link.
An IPv6 adjacency between a Cisco ISR and a Palo Alto PA-400.
Request full LSA details for entries missing from local LSDB
Yes
4
Link-State Update (LSU)
Deliver full LSAs in response to LSR or during flooding
Yes (requires LSAck)
5
Link-State Acknowledgment (LSAck)
Acknowledge receipt of LSUs
N/A
Default Timers
Network Type
Hello
Dead
Wait
Retransmit
DR/BDR?
Broadcast
10s
40s
40s
5s
Yes
Point-to-Point
10s
40s
N/A
5s
No
NBMA
30s
120s
120s
5s
Yes
Point-to-Multipoint
30s
120s
N/A
5s
No
Dead timer = 4x Hello by default. Timers must match between neighbors or the adjacency will not form.
Neighbor State Machine
graph TD
Transitions with Packet Details
A -->|"Send/Recv Hello (Type 1)"| B
A -->|"Configured Neighbor (NBMA)"| A1
A1 -->|"Recv Unicast Hello"| B
B -->|"My Router ID in Hello List"| C
The Handshake
D -->|"Empty DBD (Type 2)<br/>[I, M, MS Flags established]"| E
E -->|"DBD (Type 2) Seq Match<br/>LSA Headers Exchanged"| F
F -->|"LSR (Type 3) -> LSU (Type 4)<br/>LSAck (Type 5)"| G
Styling
style G fill:#f9f,stroke:#333,stroke-width:4px
style A fill:#fff,stroke:#333,stroke-dasharray: 5 5
style A1 fill:#eef,stroke:#333,stroke-width:2px
style C_end fill:#efe,stroke:#333,stroke-width:2px
State Summary
State
What’s Happening
Down
No Hellos received from neighbor
Attempt
NBMA only — unicast Hellos sent to configured neighbor
Init
Hello received, but neighbor hasn’t listed our RID (one-way)
2-Way
Bidirectional — both sides see each other’s RID in Hellos. DR/BDR election happens here.
ExStart
Master/Slave negotiation via empty DBDs (higher RID = Master)
Exchange
DBD exchange — LSA headers compared
Loading
Missing LSAs requested (LSR) and received (LSU)
Full
LSDBs synchronized — adjacency fully operational
Adjacency Formation
sequenceDiagram
autonumber
participant R1 as Cisco Router (Higher RID)
participant R2 as Palo Alto FW (Lower RID)
Note over R1,R2: PHASE 1: NEIGHBOR DISCOVERY (Type 1: Hello)
R1->>R2: Hello (Area 0, MTU 1500, Auth: None)
R2->>R1: Hello (I see your RID 1.1.1.1)
Note over R1,R2: 2-WAY STATE: DR/BDR Election Occurs
Note over R1,R2: PHASE 2: ADJACENCY NEGOTIATION (Type 2: DBD)
R1->>R2: DBD [I=1, M=1, MS=1] Seq: 5000 (I am Master)
R2->>R1: DBD [I=1, M=1, MS=1] Seq: 2000 (No, I am Master)
Note over R1,R2: EXSTART STATE: High RID (Cisco) wins Master
R2->>R1: DBD [I=0, M=1, MS=0] Seq: 5000 (ACK, you are Master)
Note over R1,R2: MTU Check: Palo Alto must match or be smaller than Cisco
Note over R1,R2: PHASE 3: DATABASE SUMMARY (Type 2: DBD)
R1->>R2: DBD [M=1, MS=1] Seq: 5001 + LSA Headers
R2->>R1: DBD [M=1, MS=0] Seq: 5001 + LSA Headers
Note over R1,R2: EXCHANGE STATE: Comparing LSA Headers
R1->>R2: DBD [M=0, MS=1] Seq: 5002 (I'm done)
R2->>R1: DBD [M=0, MS=0] Seq: 5002 (I'm done too)
Note over R1,R2: PHASE 4: LSDB SYNCHRONIZATION (Type 3 & 4)
Note right of R2: R2 realizes it's missing Net-LSA 10.1.1.0/24
R2->>R1: LSR (Type 3): Give me details for 10.1.1.0/24
Note over R1,R2: LOADING STATE
R1->>R2: LSU (Type 4): Here is the full LSA for 10.1.1.0/24
Note over R1,R2: PHASE 5: ACKNOWLEDGEMENT (Type 5: LSAck)
R2->>R1: LSAck (Type 5): Got it, thanks.
Note over R1,R2: FULL STATE: Adjacency established
DR/BDR Election
The Designated Router (DR) and Backup Designated Router (BDR) reduce the number of adjacencies on multi-access networks (broadcast and NBMA).
Rule
Detail
When
Election occurs at 2-Way state on broadcast/NBMA segments
Priority
Highest priority (1-255) wins. Priority 0 = will not participate.
Tiebreaker
Highest Router ID wins if priority is tied
Non-preemptive
A higher-priority router joining later does NOT take over DR/BDR
DR failure
BDR promotes to DR, new BDR election occurs
DROther behavior
Non-DR/BDR routers form Full adjacency only with DR and BDR (stay 2-Way with each other)
Troubleshooting
Symptom
Likely Cause
What to Check
Stuck in Init
One-way communication — neighbor doesn’t see our Hello
ACLs blocking multicast 224.0.0.5, interface in wrong area, passive interface
Stuck in ExStart/Exchange
MTU mismatch between neighbors
show interface on both sides — MTU must match (common PAN/Cisco issue)
Neighbor flapping
Unstable link, CPU overload causing missed Hellos
Interface error counters, CPU utilization, Hello/Dead timer tuning
Area mismatch
Interfaces in different areas
show ospf interface — both sides must be in the same area
Auth mismatch
Mismatched authentication type or key
Verify auth type (none/md5) and key on both sides
Subnet mismatch
Different subnets on shared link
show ip interface — must be same subnet for adjacency
Duplicate Router ID
Two routers with same RID
Check router-id config or highest loopback/physical IP
Routes missing from other areas
ABR not generating Type 3 LSAs
Verify ABR has interface in Area 0 and the target area