IntermediatePublished 2026-06-23
CCNA: OSPF Passive Interfaces & Default Origination
Bundle lab
Deploy OSPFv2 across a 3-router, 2-LAN branch/core/edge topology. Mark LAN-facing interfaces as passive so they do not send OSPF hellos or form adjacencies. Originate a default route only from the edge router and verify default propagation end-to-end using real client traffic. Includes realistic troubleshooting around missing adjacencies, non-propagating defaults, and unreachable external destinations.
Learning objectives
- Configure OSPFv2 on a 3-router branch-core-edge topology using assigned addresses
- Mark stub/LAN interfaces as passive to suppress OSPF hellos and adjacencies
- Originate a default route from the edge router into OSPF
- Verify OSPF neighbor adjacencies and learned default routes with end-to-end tests
- Troubleshoot non-forming adjacencies and missing default routes
Troubleshooting focus
- No OSPF neighbor forms on a transit: check
show ip ospf neighboron both ends. Confirm both sit in 10.0.12.0/30 (or 10.0.23.0/30) and area 0, that MTU and hello/dead timers match, and that the transit interface is not passive. - Verify the EDGE1-to-CORE1 adjacency is up and that EDGE advertises only the transit and Loopback0, not 203.0.113.1.
- CLIENT-USER or SRV-APP cannot ping 203.0.113.1: confirm each host reaches its gateway, that OSPF has converged and 0.0.0.0/0 is present on RTR-BR1 and RTR-CORE1, and that Loopback1 is up on RTR-EDGE1 but not advertised into OSPF.
tcpdump -i eth0 -n 'ip proto 89'on a host still shows OSPF hellos: the LAN is not passive.show ip ospf interface briefshould list the LANs as passive.
Topology
Subscribe to preview this lab's topology.
See plansGrade your work
How this lab is graded
- Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with
access-class, are stated in the guide and do have to match. - Addresses, modes and protocol keywords are exact. An IP address, a subnet mask,
switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide. - Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
- You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
- Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.
Create a free account to submit your lab for grading.
Create a free accountFound a problem with this lab?
Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.