OSPF passive interfaces

The LAN needs a route, but it does not need a neighbour

PC-A, 192.168.1.10/24, sends traffic through R1 towards PC-B, 192.168.2.10/24. PC-B connects through SW2 to R2's Gi0/2 interface, 192.168.2.1/24. That address is PC-B's default gateway: the router used for destinations outside its own subnet.

R1 needs a route to 192.168.2.0/24. R2 can advertise that network through OSPF (Open Shortest Path First), but PC-B does not run this routing protocol. There is no reason for R2 to send discovery packets onto this user LAN.

A passive interface solves those two requirements separately. It remains selected for OSPF, so its subnet can be advertised through R2's other adjacencies. It sends no OSPF Hellos, the packets used to discover and maintain neighbours, and does not use received Hellos to form an adjacency on that interface. Passive does not stop Ethernet frames from physically arriving at the port.

Compare three settings on the same LAN interface

Change only R2 Gi0/2 in these snapshots. Its link to R1 stays active.

Enabled and active

R2 includes LAN 2 in OSPF and sends Hellos on Gi0/2. The subnet is advertised, but no neighbour forms because PC-B is an end host. This works for route learning, yet it leaves unnecessary OSPF discovery active on the user network.

Enabled and passive

R2 still includes LAN 2 in its OSPF information. The difference is local activity on Gi0/2: no Hellos and no adjacency. R1 keeps its route to LAN 2 through R2. This is the intended configuration for this example.

Excluded from OSPF

Removing all OSPF activation from Gi0/2 has a different result. R2 still has a connected LAN route because the interface is up, but it no longer advertises that LAN through interface participation. With no other advertisement in this lab, R1 loses the learned /24 after convergence. That is why deleting the network statement is not a substitute for passive.

Use passive on an OSPF-enabled LAN where no neighbour is intended. An excluded prefix could still be advertised by redistribution or another source.

Passive prevents unintended adjacency on the LAN; authentication and access controls still matter.

Configure one LAN interface

Use these Cisco IOS/IOS XE style commands on the router and interface shown. Interface names can differ by image. router ospf 1 enters the local OSPF process configuration; passive-interface then names the interface whose neighbour activity should stop. It does not itself select that interface for OSPF.

Start from privileged EXEC, R2#, and enter configure terminal to reach R2(config)#. The first line below changes the prompt to R2(config-router)#. Process number 1 is local to R2 and need not match its peers. The final exit returns to global configuration; use end before running show commands.

If Gi0/2 is not already enabled, use ip ospf 1 area 0 under interface GigabitEthernet0/2, or a matching network statement under the OSPF process. See the configuration lesson.

Make passive the default, then allow router links

With several LANs it is easier to make passive the process default and explicitly allow only the router links. On R2, Gi0/0 reaches R1 at 10.0.12.1, and Gi0/1 reaches R3 at 10.0.23.2. These two links need active discovery. Gi0/2 reaches PC-B's LAN and should remain passive.

Changing passive policy can interrupt adjacencies. This is an initial-build configuration; plan a live migration separately.

New interfaces still need OSPF activation; new router links also need a non-passive exception.

Verify the passive setting and the active neighbours

Start with the detailed interface output. The area and process identify its OSPF participation. The line No Hellos (Passive interface) confirms the intended behaviour. A blank neighbour table on a PC-only LAN is expected; the important neighbours are on R2's two router-facing interfaces.

The following outputs are written examples, not router captures. The router links in this main lab use OSPF point-to-point network type, as in the configuration lesson; FULL/ - therefore has no DR or BDR role. Their interfaces and LANs already have the configured addresses and are up.

R2#show ip ospf interface GigabitEthernet0/2
Internet Address 192.168.2.1/24, Area 0
Process ID 1, Router ID 2.2.2.2, Network Type BROADCAST, Cost: 10
No Hellos (Passive interface)
Neighbor Count is 0, Adjacent neighbor count is 0

R2#show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
1.1.1.1           0   FULL/  -        00:00:37    10.0.12.1       GigabitEthernet0/0
3.3.3.3           0   FULL/  -        00:00:34    10.0.23.2       GigabitEthernet0/1

Verify the remote route and the user's packet path

On R1, look for LAN 2's prefix rather than R2's router ID. The route's next hop, 10.0.12.2, is R2's address on the link R1 can reach directly. Traffic can then leave R2 Gi0/2 towards PC-B even though that interface is passive for OSPF.

Assume no competing preferred route to LAN 2 in this lab. We are checking that OSPF supplies the route, rather than a static route hiding a missing advertisement.

R1#show ip route 192.168.2.0
Routing entry for 192.168.2.0/24
  Known via "ospf 1", distance 110, metric 20
  Routing Descriptor Blocks:
  * 10.0.12.2, via GigabitEthernet0/1

Test PC-A 192.168.1.10 to PC-B 192.168.2.10 and back. If a prefix is missing, check activation, advertisement and route selection.

Short lab: prove that passive keeps the route

Start with the working three-router configuration in an isolated lab. Record R1's route to LAN 2 and R2's active neighbours. Make only R2 Gi0/2 passive using the first configuration block, then repeat these checks.

Ping PC-B from PC-A and confirm the return traffic works. If the route remains but ping fails, check the hosts' masks, gateways and any filtering. Changing passive again will not repair an incorrect PC gateway. Keep Gi0/2 passive as the final intended state.

Recover a router link that was made passive by mistake

In this isolated chain, making R2 Gi0/1 passive removes the R3 adjacency and the paths that depend on it after the change is detected. Gi0/1 can still show up/up, because the cable has not failed. R2's Gi0/0 adjacency to R1 should remain Full. If you test this fault, record the working state first and use the lab console so you can restore the setting.

To restore that link under the passive-default policy, return to R2's global configuration mode and apply the exception below. Keep the default policy and Gi0/2's passive state; removing the entire policy would enable discovery on user LANs too.

Run show ip ospf interface GigabitEthernet0/1 on R2 and check that it is no longer passive. Then confirm R3 returns to Full in show ip ospf neighbor, the expected LAN 3 route returns, and the affected host traffic works in both directions. If no neighbour returns, inspect R3's corresponding interface too. A passive setting at either end prevents the relationship.

Reference: Cisco IOS XE default passive interfaces.

Practise LAN and transit behaviour on R1

This companion lab switches to the OSPF overview's R1 topology. Use R1 Gi0/0 for LAN 1 and Gi0/1 towards R2; the earlier R2 Gi0/2 commands belong to the lesson above. This practice link uses broadcast OSPF, with R2 as DR.

Success means the LAN stays passive while the router link stays active. Open the guided exercise below to compare both settings yourself.

Test yourself on passive interfaces