Octet

What does passive-interface do in OSPF, and when do you use it?

Show the answer

Say this first

It stops OSPF from sending and processing hellos on that interface, so no neighbor can form there, but the interface's subnet is still advertised. I use it on every user, server and loopback interface. The common pattern is passive-interface default and then no passive-interface on the real transit links.

Go deeper

Config

Cisco IOS
router ospf 1
 passive-interface default
 no passive-interface GigabitEthernet0/0/0
 no passive-interface GigabitEthernet0/0/1

Why

  • Security. A user cannot plug in a router or run a tool on a laptop and inject routes.
  • Less noise. No hellos every 10 seconds onto user VLANs.
  • Fewer surprises. No accidental adjacencies over an access VLAN.

Check

Output
R1# show ip ospf interface GigabitEthernet0/0/2 | include Passive|Area
  Internet Address 10.10.20.1/24, Area 0, Attached via Interface Enable
  No Hellos (Passive interface)

How it differs elsewhere

In EIGRP passive also stops neighbors and still advertises. In RIP, passive stops sending updates but still receives them. That difference is a classic follow-up.

Traps

  • Saying a passive interface stops the network from being advertised. It still is advertised.
How did you do?