Passive interfaces

Understand

A passive OSPF interface remains part of the advertised topology, but does not send Hellos or form adjacencies. This is useful for user LANs and loopbacks. OSPF must still be enabled on the interface: passive status alone does not originate a prefix.

A deny-by-default policy uses passive-interface default, then explicitly activates only intended transit interfaces with no passive-interface. It limits accidental neighbor formation when a new interface joins OSPF. This does not encrypt traffic or replace control-plane filtering and authentication.

Lab setup

Use a fresh lab for this lesson; changes from other lessons are not cumulative. All outputs are illustrative excerpts, not recorded router tests. Transit cost is explicitly 10 and Loopback0 cost is 1. Interface names may vary by image.

Loopback0 is 10.255.0.<router number>/32; area assignments: R1: area 0, R2: area 0.

configure terminal
hostname R1
router ospf 1
 router-id 10.255.0.1
 passive-interface Loopback0
 exit
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
 ip ospf 1 area 0
 ip ospf cost 1
 exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 ip ospf network point-to-point
 ip ospf cost 10
 ip ospf 1 area 0
 no shutdown
 exit
end

configure terminal
hostname R2
router ospf 1
 router-id 10.255.0.2
 passive-interface Loopback0
 exit
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
 ip ospf 1 area 0
 ip ospf cost 1
 exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf cost 10
 ip ospf 1 area 0
 no shutdown
 exit
end

Apply

Apply passive-by-default to both baseline routers; explicitly exempt Gi1. Add a simulated edge LAN on R1 Loopback10. Point-to-point loopback network type is used only to advertise the configured /24 rather than the usual loopback /32; passive operation prevents any neighbor discovery there.

R1

configure terminal
router ospf 1
 passive-interface default
 no passive-interface GigabitEthernet1
 exit
interface Loopback10
 ip address 10.10.10.1 255.255.255.0
 ip ospf network point-to-point
 ip ospf cost 1
 ip ospf 1 area 0
end

R2

configure terminal
router ospf 1
 passive-interface default
 no passive-interface GigabitEthernet1
end

Verify and interpret

R1# show ip ospf interface Loopback10
  Internet Address 10.10.10.1/24, Area 0
  No Hellos (Passive interface)
R2# show ip route ospf
O 10.10.10.0/24 [110/11] via 192.0.2.1, GigabitEthernet1
O 10.255.0.1/32 [110/11] via 192.0.2.1, GigabitEthernet1

The prefix remains reachable even though there is no adjacency on the edge interface.

As an isolated fault, remove the Gi1 exception on R1. The adjacency expires but Loopback10 remains in R1’s own LSDB. Restore no passive-interface GigabitEthernet1, then verify Full and the /24 at R2. Advertising a prefix and transmitting it to another router are separate requirements.

Technical references

OSPFv2 standard · Router configuration guide