What does passive-interface do in OSPF, and when do you use it?
Show the answer
Say this first
It stops OSPF from sending and processing hellos on that interface, so no neighbor can form there, but the
interface's subnet is still advertised. I use it on every user, server and loopback interface. The common
pattern is passive-interface default and then no passive-interface on the real transit links.
Go deeper
Config
router ospf 1
passive-interface default
no passive-interface GigabitEthernet0/0/0
no passive-interface GigabitEthernet0/0/1Why
- Security. A user cannot plug in a router or run a tool on a laptop and inject routes.
- Less noise. No hellos every 10 seconds onto user VLANs.
- Fewer surprises. No accidental adjacencies over an access VLAN.
Check
R1# show ip ospf interface GigabitEthernet0/0/2 | include Passive|Area
Internet Address 10.10.20.1/24, Area 0, Attached via Interface Enable
No Hellos (Passive interface)How it differs elsewhere
In EIGRP passive also stops neighbors and still advertises. In RIP, passive stops sending updates but still receives them. That difference is a classic follow-up.
They will ask next
Your new link will not form an adjacency and everything looks right. What do you check?
Whether it is passive, especially with
passive-interface defaultin the config.show ip ospf interfaceprints "No Hellos (Passive interface)".
Traps
- Saying a passive interface stops the network from being advertised. It still is advertised.
How did you do?