OSPF Commands Cheat Sheet
A dense, exam-ready reference for configuring and verifying OSPFv2 on Cisco IOS routers (CCNA/CCNP). Covers process setup, interface tuning, area types and summarization, MD5 authentication, and the key show commands — bookmark or print it for lab and troubleshooting work.
Part of the OSPF learning hub
1. Enable OSPF & Advertise Networks
Config-mode commands. Use EITHER network statements OR the per-interface form to enroll interfaces.
| Command | What it does |
|---|---|
router ospf <process-id> | Enter OSPF config; process-id (1-65535) is locally significant only. |
router-id <a.b.c.d> | Manually set the router ID (overrides highest loopback, then highest active interface IP). |
network <ip-address> <wildcard-mask> area <area-id> | Enroll every interface whose IP matches into the given area; wildcard = inverse mask (e.g. 0.0.0.255 for a /24). |
ip ospf <process-id> area <area-id> | Interface command: enroll THIS interface directly (alternative to network statements). |
clear ip ospf process | Privileged EXEC: restart the process so a newly set router-id takes effect. |
2. Interface Tuning
Applied under interface config, except passive-interface / auto-cost which live under router ospf.
| Command | What it does |
|---|---|
ip ospf cost <1-65535> | Set interface cost manually (overrides bandwidth-derived cost). |
auto-cost reference-bandwidth <mbps> | Under router ospf: change the reference (default 100) so cost = ref / link bandwidth resolves fast links. |
ip ospf priority <0-255> | DR/BDR election priority (default 1); 0 = never become DR/BDR. Highest wins on multi-access links. |
ip ospf hello-interval <seconds> | Hello timer (default 10s broadcast/P2P, 30s NBMA). Must match neighbor. |
ip ospf dead-interval <seconds> | Dead timer (default 4x hello = 40s). Must match neighbor. |
passive-interface <interface> | Under router ospf: advertise the subnet but suppress hellos out that interface (use on LAN/edge). |
passive-interface default | Under router ospf: make all interfaces passive; re-enable with no passive-interface <interface>. |
ip ospf network point-to-point | Force P2P network type (no DR/BDR); useful on P2P links to speed adjacency. |
3. Areas & Summarization
Stub/NSSA flags go under router ospf; no-summary (totally stubby) is set ONLY on the ABR.
| Command | What it does |
|---|---|
area <area-id> stub | Make the area a stub (blocks external LSA-5; ABR injects a default route). |
area <area-id> stub no-summary | Totally stubby (blocks external + inter-area LSA-3); configure on the ABR only. |
area <area-id> nssa | Not-So-Stubby Area — allows external routes via LSA-7 while blocking LSA-5. |
area <area-id> range <ip-address> <mask> | Inter-area (LSA-3) summarization on the ABR for the given area's networks. |
summary-address <ip-address> <mask> | Summarize redistributed external (LSA-5) routes on the ASBR. |
default-information originate [always] | Inject a default route into OSPF; needs an existing default unless always is used. |
4. Authentication (MD5 / Plaintext)
Per-interface keys, or enable area-wide under router ospf. Key ID and key must match the neighbor.
| Command | What it does |
|---|---|
ip ospf authentication message-digest | Interface: enable MD5 (cryptographic) authentication. |
ip ospf message-digest-key <key-id> md5 <key-string> | Interface: define the MD5 key-id (1-255) and shared key. |
area <area-id> authentication message-digest | Under router ospf: enable MD5 for the whole area (no per-interface authentication line needed). |
ip ospf authentication | Interface: enable simple (plaintext) authentication. |
ip ospf authentication-key <password> | Interface: set the plaintext password (max 8 chars). |
5. Verification (show commands)
Privileged EXEC. Start with neighbor + interface brief when adjacencies fail to form.
| Command | What it does |
|---|---|
show ip ospf neighbor | List neighbors, state (FULL/2WAY), DR/BDR, and dead timer — the first stop for adjacency issues. |
show ip ospf interface brief | Per-interface area, cost, state, and neighbor count in one table. |
show ip ospf interface <interface> | Detailed timers, network type, cost, and auth for one interface. |
show ip route ospf | OSPF-learned routes (O intra-area, O IA inter-area, O E1/E2 external). |
show ip protocols | Process ID, router-id, networks advertised, passive interfaces, and neighbors. |
show ip ospf database | The LSDB — LSA types (1 router, 2 network, 3 summary, 5 external, 7 NSSA). |
Quick Reference: Defaults & Cost
Cost = reference-bandwidth (default 100 Mbps) / interface bandwidth, minimum 1.
| Item | Default / Value |
|---|---|
Cost formula | 10^8 / bandwidth(bps) = 100 Mbps / link Mbps |
Reference bandwidth | 100 (Mbps) |
Hello / Dead (broadcast, P2P) | 10 s / 40 s |
Hello / Dead (NBMA) | 30 s / 120 s |
Interface priority | 1 (0 = never DR/BDR) |
Administrative distance | 110 |
Router-ID order | manual > highest loopback IP > highest active interface IP |
Backbone area | area 0 (all areas must touch it) |
Frequently asked questions
What's the difference between the network command and the interface ip ospf <pid> area <n> form?
Both enroll an interface into OSPF. Under router ospf, network <ip> <wildcard> area <n> matches interfaces by IP range using a wildcard mask, so one line can cover many interfaces. The interface form, ip ospf <process-id> area <area-id>, is applied directly on a single interface and is more explicit — handy when addresses don't summarize neatly. You can mix both; do not enroll the same interface into two different areas.
How do I change the OSPF router ID after the process is already running?
Set it under the process with router-id <a.b.c.d>, but the new ID does NOT take effect until the process restarts. Run clear ip ospf process in privileged EXEC (or reload). Manual router-id always wins over the highest loopback and highest active interface IP, so configuring it explicitly is best practice to keep the ID stable.
Why won't my OSPF neighbors reach the FULL state?
Adjacencies require matching parameters on the shared link: same area ID, same subnet/mask, matching hello and dead intervals, matching authentication (type and key), compatible network types, and matching MTU. Also confirm the interface isn't passive and that a valid, unique router-id exists. Use show ip ospf neighbor to see where it sticks (e.g. stuck in EXSTART/EXCHANGE usually points to an MTU mismatch), and show ip ospf interface <interface> to compare timers and area.
Stop memorizing — practice on real Cisco IOS
A cheat sheet gets you unstuck; a graded lab makes it stick. Start with the free sample.