External metrics and route tags

Understand

For an E1 route, the metric includes internal cost to the forwarding address or ASBR plus the external seed. For E2, external metric is compared first; internal cost breaks equal external-metric ties. E2 therefore does not mean “ignore internal topology.” Both need a reachable forwarding address/ASBR.

For the same prefix, internal routes outrank external routes; external Type 1 is preferred over Type 2. NSSA N1/N2 belong to their corresponding external metric classes. Do not use a simplistic universal N1/E1 ranking independent of metric and implementation; RFC 3101 selection and tie-breaking apply.

The 32-bit external route tag is policy metadata, not the metric or authentication. Define tags consistently at every redistribution boundary. An inbound OSPF route filter does not generally stop area-wide LSA flooding; filter at the correct origination/redistribution boundary when that is the goal.

Lab setup

Use a fresh lab for this lesson; changes from other lessons are not cumulative. All outputs are illustrative excerpts, not recorded router tests. Transit cost is explicitly 10 and Loopback0 cost is 1. Interface names may vary by image.

Loopback0 is 10.255.0.<router number>/32; area assignments: R1: area 0, R2: area 0, R3: area 1.

configure terminal
hostname R1
router ospf 1
 router-id 10.255.0.1
 passive-interface Loopback0
 exit
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
 ip ospf 1 area 0
 ip ospf cost 1
 exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 ip ospf network point-to-point
 ip ospf cost 10
 ip ospf 1 area 0
 no shutdown
 exit
end

configure terminal
hostname R2
router ospf 1
 router-id 10.255.0.2
 passive-interface Loopback0
 exit
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
 ip ospf 1 area 0
 ip ospf cost 1
 exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf cost 10
 ip ospf 1 area 0
 no shutdown
 exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 ip ospf network point-to-point
 ip ospf cost 10
 ip ospf 1 area 1
 no shutdown
 exit
end

configure terminal
hostname R3
router ospf 1
 router-id 10.255.0.3
 passive-interface Loopback0
 exit
interface Loopback0
 ip address 10.255.0.3 255.255.255.255
 ip ospf 1 area 1
 ip ospf cost 1
 exit
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 ip ospf network point-to-point
 ip ospf cost 10
 ip ospf 1 area 1
 no shutdown
 exit
end

Apply

R1 · establish E1 baseline

configure terminal
ip route 198.51.100.0 255.255.255.0 Null0
ip route 203.0.113.0 255.255.255.0 Null0
ip prefix-list OSPF-IMPORT seq 5 permit 198.51.100.0/24
route-map STATIC-IN permit 10
 match ip address prefix-list OSPF-IMPORT
 set tag 100
 exit
router ospf 1
 redistribute static subnets metric 20 metric-type 1 route-map STATIC-IN
end

Record R3’s E1 metric 40, then replace the redistribution statement with E2 using the same allowlist and seed. These are sequential alternatives, not two simultaneous policies.

R1 · switch to E2

configure terminal
router ospf 1
 no redistribute static
 redistribute static subnets metric 20 metric-type 2 route-map STATIC-IN
end

Verify and interpret

R3# show ip route 198.51.100.0
Routing entry for 198.51.100.0/24
  Known via "ospf 1", distance 110, metric 20, type extern 2
  Route tag 100
  * 192.0.2.5, via GigabitEthernet1

The displayed E2 metric is 20, while internal cost still resolves the path and matters for equal external candidates.

For a future reverse redistribution boundary, this route-map explicitly rejects the incoming tag and permits only a separate approved prefix set. It is a policy fragment, not attached to an unconfigured second protocol in this lab.

ip prefix-list RETURN-ALLOW seq 5 permit 203.0.113.0/24
route-map RETURN-EXPORT deny 10
 match tag 100
route-map RETURN-EXPORT permit 20
 match ip address prefix-list RETURN-ALLOW

Routes matching tag 100 hit deny before the allowlist. All unmatched routes are also denied. In a real dual-boundary design, apply the policy to the actual reverse redistribution command and verify both boundaries after failures.

Technical references

OSPFv2 standard · Router configuration guide