🔧 Lab 13.2 - OSPF Virtual Links & Advanced Filtering
Cisco CCNP 300-410 (ENARSI) - OSPF Virtual Links, Route Filtering with Prefix-List & Route-Map
🎯 Lab Objective
This advanced CCNP-level lab addresses a critical OSPF design challenge: Area 2 is not directly connected to Area 0 (broken backbone topology). You will configure OSPF Virtual Links to logically extend Area 0 through Area 1 (transit area). Additionally, you'll implement advanced route filtering using prefix-lists and route-maps to control route advertisement.
Upon completion, you will master:
- OSPF Virtual Links: Solving broken backbone topology
- Understanding transit areas and virtual link requirements
- Advanced Route Filtering: Using prefix-lists and route-maps
- Filtering specific networks from OSPF advertisement
- Troubleshooting virtual link issues and verification
- OSPF multi-area design with complex topologies
⚠️ Critical Design Issue:
Problem: B-1 is in Area 2, but Area 2 has NO direct connection to Area 0
Solution: Configure Virtual Link through Area 1 (transit area)
Without Virtual Link: B-1 cannot participate in OSPF (OSPF requires all areas connect to Area 0)
Problem: B-1 is in Area 2, but Area 2 has NO direct connection to Area 0
Solution: Configure Virtual Link through Area 1 (transit area)
Without Virtual Link: B-1 cannot participate in OSPF (OSPF requires all areas connect to Area 0)
🗺️ Network Topology
Topology Description:
- Core-1: Area 0 router (ABR to Area 1)
- S-A & S-Z: Area 1 routers (S-Z is ABR to Area 2)
- B-1: Area 2 router (NOT connected to Area 0 - requires Virtual Link)
- Design Challenge: Area 2 must reach Area 0 through Area 1 (transit area)
⚠️ Virtual Link Requirement:
Because Area 2 (B-1) is not directly connected to Area 0, we must create a Virtual Link between:
• S-Z (ABR between Area 1 and Area 2)
• Core-1 (ABR between Area 0 and Area 1)
• Transit Area: Area 1 (must be a normal area, not stub)
Because Area 2 (B-1) is not directly connected to Area 0, we must create a Virtual Link between:
• S-Z (ABR between Area 1 and Area 2)
• Core-1 (ABR between Area 0 and Area 1)
• Transit Area: Area 1 (must be a normal area, not stub)
📋 Device Information
| Device | Role | OSPF Areas | Router ID |
|---|---|---|---|
| Core-1 | ABR (Area 0 ↔ Area 1) | Area 0, Area 1 | 1.1.1.1 |
| S-A | Area 1 Internal Router | Area 1 | 2.2.2.2 |
| S-Z | ABR (Area 1 ↔ Area 2) + Virtual Link Endpoint | Area 1, Area 2, Virtual Link to Area 0 | 3.3.3.3 |
| B-1 | Area 2 Router (Isolated from Area 0) | Area 2 | 4.4.4.4 |
🌐 IP Addressing Table
| Device | Interface | IP Address | Subnet Mask | Connected To |
|---|---|---|---|---|
| Core-1 | G0/0 | 203.18.61.1 | 255.255.255.252 (/30) | S-A G0/0 |
| Core-1 | Loopback0 | 192.168.1.1 | 255.255.255.0 (/24) | Internal Network |
| S-A | G0/0 | 203.18.61.2 | 255.255.255.252 (/30) | Core-1 G0/0 |
| S-A | G0/1 | 203.18.62.1 | 255.255.255.252 (/30) | S-Z G0/1 |
| S-A | Loopback0 | 192.168.2.1 | 255.255.255.0 (/24) | Internal Network |
| S-Z | G0/1 | 203.18.62.2 | 255.255.255.252 (/30) | S-A G0/1 |
| S-Z | G1/0 | 203.18.63.5 | 255.255.255.252 (/30) | B-1 G1/0 |
| S-Z | Loopback0 | 192.168.3.1 | 255.255.255.0 (/24) | Internal Network |
| B-1 | G1/0 | 203.18.63.6 | 255.255.255.252 (/30) | S-Z G1/0 |
| B-1 | Loopback0 | 192.168.4.1 | 255.255.255.0 (/24) | Internal Network |
🔌 Cable Connection Summary
| Connection | Network Subnet | Purpose | OSPF Area |
|---|---|---|---|
| Core-1 (G0/0) ↔ S-A (G0/0) | 203.18.61.0/30 | Area 0 to Area 1 | Area 0 / Area 1 |
| S-A (G0/1) ↔ S-Z (G0/1) | 203.18.62.0/30 | Area 1 Internal | Area 1 |
| S-Z (G1/0) ↔ B-1 (G1/0) | 203.18.63.4/30 | Area 1 to Area 2 | Area 1 / Area 2 |
🏗️ OSPF Design Architecture
| OSPF Area | Type | Routers | Networks | Special Notes |
|---|---|---|---|---|
| Area 0 | Backbone | Core-1 | 203.18.61.0/30 (Core-1 side) 192.168.1.0/24 |
Backbone area |
| Area 1 | Transit Area | Core-1, S-A, S-Z | 203.18.61.0/30 (S-A side) 203.18.62.0/30 192.168.2.0/24 192.168.3.0/24 |
Transit area for Virtual Link |
| Area 2 | Standard (Isolated) | S-Z, B-1 | 203.18.63.4/30 192.168.4.0/24 |
NOT connected to Area 0 - needs Virtual Link |
ℹ️ Virtual Link Explanation:
A Virtual Link is a logical tunnel that extends Area 0 through a transit area (Area 1) to reach a remote area (Area 2). It's configured between two ABRs:
• Core-1 (1.1.1.1) - ABR between Area 0 and Area 1
• S-Z (3.3.3.3) - ABR between Area 1 and Area 2
• The virtual link uses Router IDs, not IP addresses
• Area 1 becomes the transit area carrying virtual link traffic
A Virtual Link is a logical tunnel that extends Area 0 through a transit area (Area 1) to reach a remote area (Area 2). It's configured between two ABRs:
• Core-1 (1.1.1.1) - ABR between Area 0 and Area 1
• S-Z (3.3.3.3) - ABR between Area 1 and Area 2
• The virtual link uses Router IDs, not IP addresses
• Area 1 becomes the transit area carrying virtual link traffic
⚙️ Lab Configuration Tasks
ℹ️ Configuration Sequence: Complete tasks in order. Virtual Link must be configured AFTER basic OSPF.
📝 Task 1: Basic Interface Configuration
Objective: Configure all interfaces with correct IP addressing.
Step 1.1: Configure Core-1
Core-1(config)# hostname Core-1
Core-1(config)#
Core-1(config)# interface GigabitEthernet0/0
Core-1(config-if)# description ** Link to S-A - Area 0/1 Boundary **
Core-1(config-if)# ip address 203.18.61.1 255.255.255.252
Core-1(config-if)# no shutdown
Core-1(config-if)# exit
Core-1(config)#
Core-1(config)# interface Loopback0
Core-1(config-if)# description ** Core-1 Internal Network - Area 0 **
Core-1(config-if)# ip address 192.168.1.1 255.255.255.0
Core-1(config-if)# exit
Step 1.2: Configure S-A
S-A(config)# hostname S-A
S-A(config)#
S-A(config)# interface GigabitEthernet0/0
S-A(config-if)# description ** Link to Core-1 - Area 1 **
S-A(config-if)# ip address 203.18.61.2 255.255.255.252
S-A(config-if)# no shutdown
S-A(config-if)# exit
S-A(config)#
S-A(config)# interface GigabitEthernet0/1
S-A(config-if)# description ** Link to S-Z - Area 1 **
S-A(config-if)# ip address 203.18.62.1 255.255.255.252
S-A(config-if)# no shutdown
S-A(config-if)# exit
S-A(config)#
S-A(config)# interface Loopback0
S-A(config-if)# description ** S-A Internal Network - Area 1 **
S-A(config-if)# ip address 192.168.2.1 255.255.255.0
S-A(config-if)# exit
Step 1.3: Configure S-Z
S-Z(config)# hostname S-Z
S-Z(config)#
S-Z(config)# interface GigabitEthernet0/1
S-Z(config-if)# description ** Link to S-A - Area 1 **
S-Z(config-if)# ip address 203.18.62.2 255.255.255.252
S-Z(config-if)# no shutdown
S-Z(config-if)# exit
S-Z(config)#
S-Z(config)# interface GigabitEthernet1/0
S-Z(config-if)# description ** Link to B-1 - Area 2 **
S-Z(config-if)# ip address 203.18.63.5 255.255.255.252
S-Z(config-if)# no shutdown
S-Z(config-if)# exit
S-Z(config)#
S-Z(config)# interface Loopback0
S-Z(config-if)# description ** S-Z Internal Network - Area 1 **
S-Z(config-if)# ip address 192.168.3.1 255.255.255.0
S-Z(config-if)# exit
Step 1.4: Configure B-1
B-1(config)# hostname B-1
B-1(config)#
B-1(config)# interface GigabitEthernet1/0
B-1(config-if)# description ** Link to S-Z - Area 2 **
B-1(config-if)# ip address 203.18.63.6 255.255.255.252
B-1(config-if)# no shutdown
B-1(config-if)# exit
B-1(config)#
B-1(config)# interface Loopback0
B-1(config-if)# description ** B-1 Internal Network - Area 2 **
B-1(config-if)# ip address 192.168.4.1 255.255.255.0
B-1(config-if)# exit
✅ Verification Task 1:
Core-1# show ip interface brief
Core-1# ping 203.18.61.2
S-A# ping 203.18.62.2
S-Z# ping 203.18.63.6
📝 Task 2: Configure OSPF (WITHOUT Virtual Link First)
Objective: Configure basic OSPF with proper area assignments. At this stage, Area 2 will NOT work properly.
⚠️ Expected Issue: After this task, B-1 (Area 2) will NOT see routes from Area 0 because Area 2 is not connected to Area 0. This is normal - we'll fix it in Task 3 with Virtual Link.
Step 2.1: Configure Core-1 (ABR: Area 0 ↔ Area 1)
Core-1(config)# router ospf 1
Core-1(config-router)# router-id 1.1.1.1
Core-1(config-router)# log-adjacency-changes
Core-1(config-router)#
Core-1(config-router)# ! Area 0 Network
Core-1(config-router)# network 192.168.1.0 0.0.0.255 area 0
Core-1(config-router)#
Core-1(config-router)# ! Area 1 Network
Core-1(config-router)# network 203.18.61.0 0.0.0.3 area 1
Core-1(config-router)#
Core-1(config-router)# passive-interface Loopback0
Core-1(config-router)# exit
Step 2.2: Configure S-A (Area 1 Internal Router)
S-A(config)# router ospf 1
S-A(config-router)# router-id 2.2.2.2
S-A(config-router)# log-adjacency-changes
S-A(config-router)#
S-A(config-router)# ! All networks in Area 1
S-A(config-router)# network 203.18.61.0 0.0.0.3 area 1
S-A(config-router)# network 203.18.62.0 0.0.0.3 area 1
S-A(config-router)# network 192.168.2.0 0.0.0.255 area 1
S-A(config-router)#
S-A(config-router)# passive-interface Loopback0
S-A(config-router)# exit
Step 2.3: Configure S-Z (ABR: Area 1 ↔ Area 2)
S-Z(config)# router ospf 1
S-Z(config-router)# router-id 3.3.3.3
S-Z(config-router)# log-adjacency-changes
S-Z(config-router)#
S-Z(config-router)# ! Area 1 Networks
S-Z(config-router)# network 203.18.62.0 0.0.0.3 area 1
S-Z(config-router)# network 192.168.3.0 0.0.0.255 area 1
S-Z(config-router)#
S-Z(config-router)# ! Area 2 Network
S-Z(config-router)# network 203.18.63.4 0.0.0.3 area 2
S-Z(config-router)#
S-Z(config-router)# passive-interface Loopback0
S-Z(config-router)# exit
Step 2.4: Configure B-1 (Area 2 Router)
B-1(config)# router ospf 1
B-1(config-router)# router-id 4.4.4.4
B-1(config-router)# log-adjacency-changes
B-1(config-router)#
B-1(config-router)# ! All networks in Area 2
B-1(config-router)# network 203.18.63.4 0.0.0.3 area 2
B-1(config-router)# network 192.168.4.0 0.0.0.255 area 2
B-1(config-router)#
B-1(config-router)# passive-interface Loopback0
B-1(config-router)# exit
⚠️ Verification Task 2 - Observe the Problem:
! On Core-1 (Area 0)
Core-1# show ip ospf neighbor
! Should see S-A as neighbor
Core-1# show ip route ospf
! Will NOT see 192.168.4.0/24 (B-1's network)
! On B-1 (Area 2)
B-1# show ip route ospf
! Will NOT see 192.168.1.0/24 (Core-1's Area 0 network)
! This is because Area 2 is NOT connected to Area 0
! On S-Z (ABR)
S-Z# show ip ospf border-routers
! Will show Core-1 as unreachable for Area 0
🔴 Expected Problem: Area 2 cannot communicate with Area 0 because there's no direct connection. Virtual Link is required!
📝 Task 3: Configure OSPF Virtual Link (Fix Broken Backbone)
Objective: Create a virtual link through Area 1 (transit area) to logically connect Area 2 to Area 0.
ℹ️ Virtual Link Requirements:
1. Both endpoints must be ABRs
2. Transit area (Area 1) must be a normal area (not stub)
3. Configuration uses Router IDs (not IP addresses)
4. Must be configured on BOTH endpoints
1. Both endpoints must be ABRs
2. Transit area (Area 1) must be a normal area (not stub)
3. Configuration uses Router IDs (not IP addresses)
4. Must be configured on BOTH endpoints
Step 3.1: Configure Virtual Link on S-A
Core-1(config)# router ospf 1
S-A(config-router)# ! Virtual Link through Area 1 to S-Z (3.3.3.3)
S-A(config-router)# area 1 virtual-link 3.3.3.3
S-A(config-router)# exit
! Explanation:
! - "area 1" = Transit area
! - "virtual-link 3.3.3.3" = S-Z's Router ID (the other endpoint)
! - This creates a logical tunnel through Area 1
Step 3.2: Configure Virtual Link on S-Z
S-Z(config)# router ospf 1
S-Z(config-router)# ! Virtual Link through Area 1 to S-A (2.2.2.2)
S-Z(config-router)# area 1 virtual-link 2.2.2.2
S-Z(config-router)# exit
! Explanation:
! - "area 1" = Transit area (must match S-A)
! - "virtual-link 2.2.2.2" = S-A's Router ID
! - Both sides must have matching configuration
✅ Verification Task 3 - Virtual Link Should Work:
! On S-A
S-A# show ip ospf virtual-links
! Should show virtual link to 3.3.3.3 in UP state
! On S-Z
S-Z# show ip ospf virtual-links
! Should show virtual link to 2.2.2.2 in UP state
! On S-A
S-A# show ip route ospf
! Should NOW see 192.168.4.0/24 (B-1's network) via virtual link
! On B-1
B-1# show ip route ospf
! Should NOW see 192.168.1.0/24 (Core-1's Area 0 network)
! Test end-to-end connectivity
B-1# ping 192.168.1.1 source 192.168.4.1
! Should succeed via virtual link
📝 Task 4: Configure Advanced Route Filtering
Objective: Use prefix-list and route-map to filter specific networks from OSPF advertisement.
Scenario: We want to prevent 192.168.2.0/24 (S-A's loopback) from being advertised to Area 0.
Step 4.1: Create Prefix-List on Core-1
Core-1(config)# ! Create prefix-list to identify network to filter
Core-1(config)# ip prefix-list FILTER_SA_NETWORK seq 5 deny 192.168.2.0/24
Core-1(config)# ip prefix-list FILTER_SA_NETWORK seq 10 permit 0.0.0.0/0 le 32
Core-1(config)#
Core-1(config)# ! Explanation:
Core-1(config)# ! seq 5: DENY 192.168.2.0/24 (S-A's loopback)
Core-1(config)# ! seq 10: PERMIT all other routes (0.0.0.0/0 le 32 = any route)
Step 4.2: Create Route-Map on Core-1
Core-1(config)# ! Create route-map using the prefix-list
Core-1(config)# route-map OSPF_FILTER_IN deny 10
Core-1(config-route-map)# match ip address prefix-list FILTER_SA_NETWORK
Core-1(config-route-map)# exit
Core-1(config)#
Core-1(config)# route-map OSPF_FILTER_IN permit 20
Core-1(config-route-map)# exit
Core-1(config)#
Core-1(config)# ! Explanation:
Core-1(config)# ! Sequence 10: DENY routes matching FILTER_SA_NETWORK (192.168.2.0/24)
Core-1(config)# ! Sequence 20: PERMIT all other routes
Step 4.3: Apply Route-Map to OSPF
Core-1(config)# router ospf 1
Core-1(config-router)# ! Apply route-map to filter routes from Area 1 into Area 0
Core-1(config-router)# distribute-list route-map OSPF_FILTER_IN in
Core-1(config-router)# exit
! Explanation:
! - "distribute-list route-map OSPF_FILTER_IN in"
! - Filters routes ENTERING the routing table from OSPF
! - 192.168.2.0/24 will be filtered from Core-1's routing table
✅ Verification Task 4 - Route Filtering:
! On Core-1 - Verify prefix-list
Core-1# show ip prefix-list FILTER_SA_NETWORK
! Should show deny 192.168.2.0/24 and permit 0.0.0.0/0 le 32
! On Core-1 - Verify route-map
Core-1# show route-map OSPF_FILTER_IN
! Should show the route-map with prefix-list match
! On Core-1 - Check routing table
Core-1# show ip route ospf | include 192.168.2
! Should NOT show 192.168.2.0/24 (filtered)
! On Core-1 - Check OSPF database
Core-1# show ip ospf database | include 192.168.2
! May still appear in OSPF database (LSA) but not in routing table
! On S-A - Verify route is still advertised
S-A# show ip route | include 192.168.2
! Should still show 192.168.2.0/24 (only filtered on Core-1)
⚠️ Important Note - Filtering Behavior:
• distribute-list in: Filters routes from entering the routing table (local router only)
• distribute-list out: Filters routes from being advertised to neighbors
• The filtered route (192.168.2.0/24) still exists in OSPF LSDB but won't be installed in Core-1's routing table
• distribute-list in: Filters routes from entering the routing table (local router only)
• distribute-list out: Filters routes from being advertised to neighbors
• The filtered route (192.168.2.0/24) still exists in OSPF LSDB but won't be installed in Core-1's routing table
📝 Task 5: Alternative Filtering - Filter at ABR (Advanced)
Objective: Filter routes at the ABR boundary to prevent Type 3 LSA generation.
Scenario: Prevent 192.168.3.0/24 (S-Z's loopback) from being advertised into Area 0.
Step 5.1: Configure Area Filtering on Core-1
Core-1(config)# ! Create prefix-list for S-Z's network
Core-1(config)# ip prefix-list FILTER_SZ_NETWORK seq 5 deny 192.168.3.0/24
Core-1(config)# ip prefix-list FILTER_SZ_NETWORK seq 10 permit 0.0.0.0/0 le 32
Core-1(config)#
Core-1(config)# ! Apply filter at ABR boundary (Area 1 to Area 0)
Core-1(config)# router ospf 1
Core-1(config-router)# area 1 filter-list prefix FILTER_SZ_NETWORK in
Core-1(config-router)# exit
! Explanation:
! - "area 1 filter-list prefix FILTER_SZ_NETWORK in"
! - Filters Type 3 LSAs coming FROM Area 1 INTO Area 0
! - This is ABR-specific filtering (only works on ABRs)
ℹ️ Difference: distribute-list vs area filter-list:
distribute-list:
• Filters routes from entering local routing table
• LSAs still exist in OSPF database
• Works on any OSPF router
area filter-list:
• Prevents Type 3 LSA generation at ABR boundary
• LSAs are NOT created/advertised to other areas
• Only works on ABRs (Area Border Routers)
distribute-list:
• Filters routes from entering local routing table
• LSAs still exist in OSPF database
• Works on any OSPF router
area filter-list:
• Prevents Type 3 LSA generation at ABR boundary
• LSAs are NOT created/advertised to other areas
• Only works on ABRs (Area Border Routers)
✅ Verification Task 5:
! On Core-1 - Check routing table
Core-1# show ip route ospf | include 192.168.3
! Should NOT show 192.168.3.0/24 (filtered at ABR)
! On Core-1 - Check OSPF database for Type 3 LSAs
Core-1# show ip ospf database summary | include 192.168.3
! Should NOT show Type 3 LSA for 192.168.3.0/24
! On S-Z - Verify route is still in Area 1
S-Z# show ip route | include 192.168.3
! Should still show 192.168.3.0/24 (only filtered from Area 0)
📝 Task 6: Complete Verification
Objective: Verify all OSPF features including virtual link and filtering.
Step 6.1: Verify Virtual Link Status
S-A# show ip ospf virtual-links
Virtual Link OSPF_VL0 to router 3.3.3.3 is up
Run as demand circuit
DoNotAge LSA allowed.
Transit area 1, via interface GigabitEthernet0/0
Topology-MTID Cost Disabled Shutdown Topology Name
0 1 no no Base
Transmit Delay is 1 sec, State POINT_TO_POINT,
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
Step 6.2: Verify Virtual Link Status
S-Z# show ip ospf virtual-links
Virtual Link OSPF_VL0 to router 2.2.2.2 is up
Run as demand circuit
DoNotAge LSA allowed.
Transit area 1, via interface GigabitEthernet0/0
Topology-MTID Cost Disabled Shutdown Topology Name
0 1 no no Base
Transmit Delay is 1 sec, State POINT_TO_POINT,
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
Step 6.3: Test End-to-End Connectivity
! From B-1 (Area 2) to Core-1 (Area 0)
B-1# ping 192.168.1.1 source 192.168.4.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.4.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
! Traceroute to see path
B-1# traceroute 192.168.1.1 source 192.168.4.1
1 203.18.63.5 1 msec 1 msec 1 msec ! S-Z
2 203.18.62.1 1 msec 1 msec 1 msec ! S-A
3 192.168.1.1 1 msec * 1 msec ! Core-1 (via virtual link)
📄 Complete Device Configurations
ℹ️ Complete Configurations: Copy-paste ready configurations for all devices.
Core-1 Complete Configuration:
hostname Core-1
!
interface GigabitEthernet0/0
description ** Link to S-A - Area 0/1 Boundary **
ip address 203.18.61.1 255.255.255.252
no shutdown
!
interface Loopback0
description ** Core-1 Internal Network - Area 0 **
ip address 192.168.1.1 255.255.255.0
!
! Prefix-list for filtering S-A's network
ip prefix-list FILTER_SA_NETWORK seq 5 deny 192.168.2.0/24
ip prefix-list FILTER_SA_NETWORK seq 10 permit 0.0.0.0/0 le 32
!
! Prefix-list for filtering S-Z's network at ABR
ip prefix-list FILTER_SZ_NETWORK seq 5 deny 192.168.3.0/24
ip prefix-list FILTER_SZ_NETWORK seq 10 permit 0.0.0.0/0 le 32
!
! Route-map for distribute-list filtering
route-map OSPF_FILTER_IN deny 10
match ip address prefix-list FILTER_SA_NETWORK
!
route-map OSPF_FILTER_IN permit 20
!
router ospf 1
router-id 1.1.1.1
log-adjacency-changes
area 1 filter-list prefix FILTER_SZ_NETWORK in
passive-interface Loopback0
network 192.168.1.0 0.0.0.255 area 0
network 203.18.61.0 0.0.0.3 area 1
distribute-list route-map OSPF_FILTER_IN in
!
end
S-A Complete Configuration:
hostname S-A
!
interface GigabitEthernet0/0
description ** Link to Core-1 - Area 1 **
ip address 203.18.61.2 255.255.255.252
no shutdown
!
interface GigabitEthernet0/1
description ** Link to S-Z - Area 1 **
ip address 203.18.62.1 255.255.255.252
no shutdown
!
interface Loopback0
description ** S-A Internal Network - Area 1 **
ip address 192.168.2.1 255.255.255.0
!
router ospf 1
router-id 2.2.2.2
log-adjacency-changes
passive-interface Loopback0
area 1 virtual-link 3.3.3.3
network 203.18.61.0 0.0.0.3 area 1
network 203.18.62.0 0.0.0.3 area 1
network 192.168.2.0 0.0.0.255 area 1
!
end
S-Z Complete Configuration:
hostname S-Z
!
interface GigabitEthernet0/1
description ** Link to S-A - Area 1 **
ip address 203.18.62.2 255.255.255.252
no shutdown
!
interface GigabitEthernet1/0
description ** Link to B-1 - Area 2 **
ip address 203.18.63.5 255.255.255.252
no shutdown
!
interface Loopback0
description ** S-Z Internal Network - Area 1 **
ip address 192.168.3.1 255.255.255.0
!
router ospf 1
router-id 3.3.3.3
log-adjacency-changes
area 1 virtual-link 2.2.2.2
passive-interface Loopback0
network 203.18.62.0 0.0.0.3 area 1
network 192.168.3.0 0.0.0.255 area 1
network 203.18.63.4 0.0.0.3 area 2
!
end
B-1 Complete Configuration:
hostname B-1
!
interface GigabitEthernet1/0
description ** Link to S-Z - Area 2 **
ip address 203.18.63.6 255.255.255.252
no shutdown
!
interface Loopback0
description ** B-1 Internal Network - Area 2 **
ip address 192.168.4.1 255.255.255.0
!
router ospf 1
router-id 4.4.4.4
log-adjacency-changes
passive-interface Loopback0
network 203.18.63.4 0.0.0.3 area 2
network 192.168.4.0 0.0.0.255 area 2
!
end
✅ Lab Verification Checklist
- ☐ All interfaces up/up (show ip interface brief)
- ☐ Ping connectivity between direct neighbors
- ☐ OSPF process running on all routers
- ☐ Explicit Router IDs configured
- ☐ OSPF neighbors in FULL state
- ☐ Virtual link UP between Core-1 and S-Z
- ☐ Virtual link neighbor appears in "show ip ospf neighbor"
- ☐ B-1 can see Area 0 routes (192.168.1.0/24)
- ☐ Core-1 can see Area 2 routes (192.168.4.0/24)
- ☐ 192.168.2.0/24 filtered from Core-1 routing table
- ☐ 192.168.3.0/24 filtered at ABR (not in Area 0)
- ☐ Prefix-lists configured correctly
- ☐ Route-maps configured and applied
- ☐ End-to-end ping successful (B-1 to Core-1)
- ☐ Traceroute shows path through virtual link
- ☐ No OSPF errors in logs
🔍 Verification Commands Reference
| Command | Purpose |
|---|---|
| show ip ospf virtual-links | Verify virtual link status and state |
| show ip ospf neighbor | Verify OSPF adjacencies (including virtual link) |
| show ip ospf border-routers | View ABR information and reachability |
| show ip route ospf | View OSPF routes (check filtering) |
| show ip prefix-list | Verify prefix-list configuration and matches |
| show route-map | Verify route-map configuration |
| show ip ospf database summary | View Type 3 LSAs (inter-area routes) |
| show ip protocols | View OSPF configuration and filters |
| debug ip ospf adj | Debug OSPF adjacency formation |
🔧 Troubleshooting Guide
⚠️ Common Issues: Systematic troubleshooting for virtual links and filtering.
Issue 1: Virtual Link Not Coming Up
| Problem | Cause | Solution |
|---|---|---|
| Virtual link down | Incorrect Router IDs | Verify Router IDs match configuration (show ip ospf) |
| Virtual link not forming | Transit area mismatch | Both sides must use same transit area number |
| Virtual link unreachable | No connectivity through transit area | Verify OSPF in transit area (Area 1) is working |
| Virtual link neighbor missing | Transit area is stub | Transit area CANNOT be stub/NSSA |
Virtual Link Troubleshooting Commands:
! Check virtual link status
show ip ospf virtual-links
! Verify Router IDs
show ip ospf | include Router ID
! Check OSPF neighbors (virtual link appears as neighbor)
show ip ospf neighbor
! Check ABR status
show ip ospf border-routers
! Enable debugging
debug ip ospf adj
debug ip ospf virtual-links
! Disable debugging
undebug all
Issue 2: Route Filtering Not Working
| Problem | Cause | Solution |
|---|---|---|
| Route still appears | Prefix-list not matching | Verify prefix-list with "show ip prefix-list" |
| All routes filtered | Missing permit statement | Add "permit 0.0.0.0/0 le 32" to prefix-list |
| Filter not applied | distribute-list not configured | Verify with "show ip protocols" |
| ABR filter not working | Wrong area specified | Check area number in filter-list command |
Filtering Troubleshooting Commands:
! Check prefix-list matches
show ip prefix-list FILTER_SA_NETWORK
show ip prefix-list detail
! Verify route-map
show route-map OSPF_FILTER_IN
! Check if filters are applied
show ip protocols | section ospf
! View routing table
show ip route ospf
! Check OSPF database
show ip ospf database summary
! Test prefix-list match
show ip prefix-list FILTER_SA_NETWORK 192.168.2.1
Issue 3: Area 2 Cannot Reach Area 0
! On B-1 (Area 2)
B-1# show ip route ospf
! Should see Area 0 routes
! If missing, check virtual link on S-Z
S-Z# show ip ospf virtual-links
! Must be UP
! Check S-Z is ABR for both Area 1 and Area 2
S-Z# show ip ospf | include Area
! Verify Area 1 is normal area (not stub)
Core-1# show ip ospf | include Area
S-Z# show ip ospf | include Area
! Check OSPF database on S-Z
S-Z# show ip ospf database
! Should see LSAs from all areas
🎓 Key Learning Points
1. OSPF Virtual Links
- Purpose: Connect areas that cannot directly reach Area 0
- Requirement: Must transit through a normal area (not stub)
- Configuration: Uses Router IDs, not IP addresses
- Topology: Logical tunnel between two ABRs
- Best Practice: Virtual links are temporary solutions - redesign topology if possible
2. OSPF Route Filtering
- distribute-list in: Filters routes from entering routing table (local)
- distribute-list out: Filters routes from being advertised
- area filter-list: Prevents Type 3 LSA creation at ABR (inter-area)
- Prefix-lists provide flexible matching (exact, range, subnet)
- Route-maps add conditional logic to filtering
3. Prefix-Lists
- Syntax:
ip prefix-list NAME [seq #] {permit|deny} A.B.C.D/length [le #] [ge #] - le (less than or equal): Match up to specified prefix length
- ge (greater than or equal): Match from specified prefix length
- 0.0.0.0/0 le 32: Matches any route (any prefix, any length)
- Processed sequentially (like ACLs)
4. Route-Maps
- Provide if-then-else logic for routing policies
- Can match prefix-lists, ACLs, route-types, metrics
- Can set metrics, tags, next-hop, etc.
- Used with distribute-list for advanced filtering
5. OSPF Area Design Rules
- Rule 1: All areas must connect to Area 0 (directly or via virtual link)
- Rule 2: Area 0 must be contiguous (no partitioning)
- Rule 3: Transit areas for virtual links cannot be stub
- Rule 4: ABRs generate Type 3 LSAs between areas
🚀 Advanced Topics
1. Virtual Link Authentication
! Add MD5 authentication to virtual link
Core-1(config-router)# area 1 virtual-link 3.3.3.3 authentication message-digest
Core-1(config-router)# area 1 virtual-link 3.3.3.3 message-digest-key 1 md5 SECRET_KEY
! On S-Z
S-Z(config-router)# area 1 virtual-link 1.1.1.1 authentication message-digest
S-Z(config-router)# area 1 virtual-link 1.1.1.1 message-digest-key 1 md5 SECRET_KEY
2. Advanced Prefix-List Examples
! Match specific network
ip prefix-list EXACT seq 5 permit 192.168.1.0/24
! Match any /24 subnet in 10.0.0.0/8
ip prefix-list RANGE seq 5 permit 10.0.0.0/8 ge 24 le 24
! Match any subnet from /24 to /30 in 172.16.0.0/12
ip prefix-list SUBNET seq 5 permit 172.16.0.0/12 ge 24 le 30
! Match default route only
ip prefix-list DEFAULT seq 5 permit 0.0.0.0/0
! Match all routes except default
ip prefix-list NO_DEFAULT seq 5 deny 0.0.0.0/0
ip prefix-list NO_DEFAULT seq 10 permit 0.0.0.0/0 le 32
3. Multiple Virtual Links
- Can have multiple virtual links through different transit areas
- Provides redundancy for Area 0 connectivity
- Each virtual link requires separate configuration
📖 Lab Summary
| Component | Configuration | Status |
|---|---|---|
| Network Topology | 4 routers, 3 OSPF areas (broken backbone) | ✅ Configured |
| Virtual Link | Core-1 ↔ S-Z through Area 1 | ✅ Working |
| Route Filtering | Prefix-list + Route-map + Area filter | ✅ Active |
| Filtered Networks | 192.168.2.0/24, 192.168.3.0/24 | ✅ Filtered |
| Area 2 Connectivity | Reaches Area 0 via virtual link | ✅ Verified |
🎉 Lab 13.2 Completed!
OSPF Virtual Links & Advanced Filtering
Skills Mastered: Virtual Links | Broken Backbone Fix | Prefix-Lists | Route-Maps | ABR Filtering
CCNP ENARSI - Expert Level Lab
🔖 Quick Reference Card
| Task | Command |
|---|---|
| Configure Virtual Link | area [transit-area] virtual-link [router-id] |
| Create Prefix-List | ip prefix-list NAME seq # {permit|deny} A.B.C.D/len |
| Create Route-Map | route-map NAME {permit|deny} [seq] |
| Match Prefix-List | match ip address prefix-list NAME |
| Apply Distribute-List | distribute-list route-map NAME {in|out} |
| ABR Area Filter | area X filter-list prefix NAME {in|out} |
| Show Virtual Links | show ip ospf virtual-links |
| Show Prefix-List | show ip prefix-list [NAME] |