OSPF · Capstone lab

Multi-area build and repair

Build the whole design, prove the policy and repair faults without broadening the configuration.

Understand

R1/R2 form the backbone and are the ABRs. R3’s area 1 owns two adjacent /24s to summarize. R4’s area 2 is NSSA and imports one connected external /24, excluding a second one. R2 translates the permitted Type 7 and supplies an NSSA default. Authenticate the backbone link with the same HMAC-SHA-256 key on both ends.

Requirement	Acceptance evidence
All three transit links Full	Neighbor and interface-area checks at both ABRs.
Branch summary only outside area 1	10.10.0.0/23 visible remotely; two /24s remain within area 1.
Controlled NSSA import	203.0.113.0/24 is Type 7 in area 2 and Type 5 outside; 198.51.100.0/24 absent remotely.
Authenticated backbone	Active key/algorithm and Full adjacency on R1/R2 Gi1.
Usable forwarding	Sourced pings to real configured loopback addresses and return-route checks.

Begin from fresh routers with the complete multi-area baseline below, then add the solution changes. Try satisfying the requirements before opening the solution. This is an original bounded capstone, not a recorded lab run.

Lab setup

Use a fresh lab for this lesson; changes from other lessons are not cumulative. All outputs are illustrative excerpts, not recorded router tests. Transit cost is explicitly 10 and Loopback0 cost is 1. Interface names may vary by image.

Lab topologyIllustrative topology

Solid lines are physical links, configured as point-to-point. Interfaces and areas are listed below. Router symbol: GNS3, GPL-2.0. Original layout.

Router	Interface	IPv4 address	Area
R1	Gi1	192.0.2.1/30	0
R2	Gi1	192.0.2.2/30	0
R2	Gi2	192.0.2.5/30	2
R4	Gi1	192.0.2.6/30	2
R1	Gi2	192.0.2.9/30	1
R3	Gi1	192.0.2.10/30	1

Loopback0 is 10.255.0.<router number>/32; area assignments: R1: area 0, R2: area 0, R3: area 1, R4: area 2.

Complete baseline configurations

R1

Configuration

configure terminal
hostname R1
router ospf 1
 router-id 10.255.0.1
 passive-interface Loopback0
 exit
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
 ip ospf 1 area 0
 ip ospf cost 1
 exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 ip ospf network point-to-point
 ip ospf cost 10
 ip ospf 1 area 0
 no shutdown
 exit
interface GigabitEthernet2
 ip address 192.0.2.9 255.255.255.252
 ip ospf network point-to-point
 ip ospf cost 10
 ip ospf 1 area 1
 no shutdown
 exit
end

R2

Configuration

configure terminal
hostname R2
router ospf 1
 router-id 10.255.0.2
 passive-interface Loopback0
 exit
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
 ip ospf 1 area 0
 ip ospf cost 1
 exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf cost 10
 ip ospf 1 area 0
 no shutdown
 exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 ip ospf network point-to-point
 ip ospf cost 10
 ip ospf 1 area 2
 no shutdown
 exit
end

R3

Configuration

configure terminal
hostname R3
router ospf 1
 router-id 10.255.0.3
 passive-interface Loopback0
 exit
interface Loopback0
 ip address 10.255.0.3 255.255.255.255
 ip ospf 1 area 1
 ip ospf cost 1
 exit
interface GigabitEthernet1
 ip address 192.0.2.10 255.255.255.252
 ip ospf network point-to-point
 ip ospf cost 10
 ip ospf 1 area 1
 no shutdown
 exit
end

R4

Configuration

configure terminal
hostname R4
router ospf 1
 router-id 10.255.0.4
 passive-interface Loopback0
 exit
interface Loopback0
 ip address 10.255.0.4 255.255.255.255
 ip ospf 1 area 2
 ip ospf cost 1
 exit
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 ip ospf network point-to-point
 ip ospf cost 10
 ip ospf 1 area 2
 no shutdown
 exit
end

Apply

Solution · additions to the complete baseline

R3 · branch components

Configuration

configure terminal
interface Loopback10
 ip address 10.10.0.1 255.255.255.0
 ip ospf network point-to-point
 ip ospf cost 1
 ip ospf 1 area 1
 exit
interface Loopback11
 ip address 10.10.1.1 255.255.255.0
 ip ospf network point-to-point
 ip ospf cost 1
 ip ospf 1 area 1
 exit
router ospf 1
 passive-interface Loopback10
 passive-interface Loopback11
end

R1 · branch summary and backbone authentication

Configuration

configure terminal
router ospf 1
 area 1 range 10.10.0.0 255.255.254.0 cost 20
 exit
key chain OSPF-LAB
 key 1
  key-string PacketLabLabOnly42
  cryptographic-algorithm hmac-sha-256
  exit
 exit
interface GigabitEthernet1
 ip ospf authentication key-chain OSPF-LAB
end

R2 · NSSA/default and backbone authentication

Configuration

configure terminal
router ospf 1
 area 2 nssa default-information-originate metric 10 metric-type 1
 exit
key chain OSPF-LAB
 key 1
  key-string PacketLabLabOnly42
  cryptographic-algorithm hmac-sha-256
  exit
 exit
interface GigabitEthernet1
 ip ospf authentication key-chain OSPF-LAB
end

R4 · NSSA ASBR and allowlisted connected import

Configuration

configure terminal
interface Loopback100
 ip address 203.0.113.1 255.255.255.0
 exit
interface Loopback101
 ip address 198.51.100.1 255.255.255.0
 exit
ip prefix-list CAP-IMPORT seq 5 permit 203.0.113.0/24
route-map CAP-IN permit 10
 match ip address prefix-list CAP-IMPORT
 set tag 400
 exit
router ospf 1
 area 2 nssa
 redistribute connected subnets metric 20 metric-type 1 route-map CAP-IN
end

R4 Loopback100 is deliberately not enabled natively in OSPF: it is imported as an external. Loopback101 provides the denied-prefix test. These are real configured lab endpoints, unlike the discard-only statics in earlier control-plane exercises.

Verify and interpret

Illustrative output · excerpt

R2# show ip route ospf | include 10.10.
O IA 10.10.0.0/23 [110/30] via 192.0.2.1, GigabitEthernet1
R3# show ip route ospf | include 203.0.113
O E1 203.0.113.0/24 [110/51] via 192.0.2.9, GigabitEthernet1
R3# show ip route 198.51.100.0
% Network not in table
R4# show ip route ospf | include 0.0.0.0
O*N1 0.0.0.0/0 [110/20] via 192.0.2.5, GigabitEthernet1

Summary metric is 10+20=30 at R2. The external sample assumes forwarding address 10.255.0.4: R3’s internal 31 plus seed 20 gives 51. Inspect actual forwarding-address selection before comparing metrics.

Illustrative output · excerpt

R3# ping 203.0.113.1 source Loopback10
!!!!!
R4# ping 10.10.1.1 source Loopback100
!!!!!

Both endpoints exist. R4’s return path uses the branch summary; R3’s path uses the translated external. An installed /24 alone would not prove these replies.

Independent fault	Evidence before repair	Minimal repair and successful state
Remove R1 area range	R2 receives individual /24 Type 3s instead of /23.	Restore area 1 range with cost 20; R2 again shows /23 at cost 30.
Wrong HMAC secret on R2	Backbone adjacency expires; R3 loses the area-2 path.	Restore the expected R2 secret; Gi1 returns Full with authentication enabled.
Remove CAP-IMPORT permit	Type 7 and translated Type 5 for 203.0.113.0 withdraw.	Restore exact permit; verify LSA, route and sourced ping.
Shut only R3 Loopback10	The /23 persists because Loopback11 survives; ping to failed .0.1 cannot succeed.	Restore Loopback10; both component endpoint pings succeed.

Inject only one fault at a time, save the before/after evidence, then restore the full working solution. For example:

R2 · isolated authentication fault

Configuration

configure terminal
key chain OSPF-LAB
 key 1
  key-string WrongLabSecret
end

Illustrative output · excerpt

R1# show ip ospf neighbor
Neighbor ID     Pri State   Dead Time Address      Interface
10.255.0.3        0 FULL/-  00:00:35  192.0.2.10  GigabitEthernet2

After backbone expiry only the branch adjacency remains at R1.

R2 · repair

Configuration

configure terminal
key chain OSPF-LAB
 key 1
  key-string PacketLabLabOnly42
end

Illustrative output · excerpt

R1# show ip ospf neighbor
Neighbor ID     Pri State   Dead Time Address      Interface
10.255.0.2        0 FULL/-  00:00:38  192.0.2.2   GigabitEthernet1
10.255.0.3        0 FULL/-  00:00:36  192.0.2.10  GigabitEthernet2

Both adjacencies recover. Repeat policy negative tests and forwarding checks; restoring Full alone does not close the capstone.

Completion record: interface areas and costs, authenticated neighbors, Type 3 summary, NSSA Type 7/translated Type 5 with tag 400, denied prefix absence, both sourced pings, and one documented fault/repair. No live results are supplied here.

Technical references

OSPFv2 standard · Router configuration guide · NSSA standard · OSPFv2 authentication

Key Takeaways

Build and validate the backbone before adding policy.
Summarize branch prefixes only at the source-area ABR.
NSSA import needs a narrow allowlist and working translation.
Verify excluded prefixes and real endpoint forwarding.
Close each repair with policy and forwarding checks, not just Full.