OSPF

The steps

1. Discover neighbors with Hello packets (IP protocol 89, multicast 224.0.0.5).
2. Form adjacencies and synchronize databases with DBD, LSR, LSU and LSAck packets.
3. Flood LSAs reliably. Every LSA is acknowledged, has a sequence number and an age.
4. Run SPF. Each router builds a shortest-path tree from the LSDB, with itself as root.
5. Install routes with administrative distance 110 and the summed cost as the metric.

What makes it link state

Routers do not pass routes to each other as distance vector protocols do. They pass topology facts ("I am R1, I have a link to R2 with cost 10, and a stub network 10.1.1.0/24") and each router computes routes itself. That is why every router in an area must have the same LSDB, and why you cannot summarize or filter LSAs inside an area.

Why areas

SPF cost grows with the size of the database. Areas limit flooding and SPF to one area. Between areas, ABRs advertise summaries (Type 3 LSAs), so inter-area routing behaves more like distance vector.

Selection order on IOS-XE

1. router-id 1.1.1.1 under router ospf.
2. Highest IPv4 address on a loopback interface that is up.
3. Highest IPv4 address on any other interface that is up.

The interface does not have to run OSPF to be used for the router ID.

Changing it

R1(config)# router ospf 1
R1(config-router)# router-id 1.1.1.1
% OSPF: Reload or use "clear ip ospf process" command, for this to take effect
R1# clear ip ospf process
Reset ALL OSPF processes? [no]: yes

Clearing the process drops every adjacency on that router, so do it in a window.

Why it must be unique

The router ID names the router's Type 1 LSA. Two routers with the same ID keep overwriting each other's LSA, which causes flapping routes and constant SPF runs. IOS logs %OSPF-4-DUP_RTRID_NBR when a directly connected neighbor has the same ID. A duplicate further away in the area shows up as a flood war: the same LSA re-originated again and again with rising sequence numbers.

Defaults by network type (IOS)

The dead interval defaults to four times the hello. If you change only the hello, IOS also moves the dead interval to four times the new hello unless you set dead explicitly.

Changing them

interface GigabitEthernet0/0/0
 ip ospf hello-interval 5
 ip ospf dead-interval 20

Sub-second detection with OSPF alone uses ip ospf dead-interval minimal hello-multiplier 4, which sets dead to 1 second and sends 4 hellos per second. In practice I use BFD instead, which is lighter on the CPU.

What else hellos carry

Router ID, area ID, mask, hello and dead intervals, options (including the stub bit), router priority, DR and BDR addresses, and the list of neighbors already heard on the link.

Flow on a broadcast segment

1. R3, a DROTHER, sees a link change and sends an LSU to 224.0.0.6.
2. The DR and BDR receive it. The BDR listens so it can take over without resynchronizing.
3. The DR floods the LSU to 224.0.0.5, so every router on the segment gets it.
4. Routers acknowledge to the DR.

Other details

• Both are link-local scope (224.0.0.0/24), sent with TTL 1 and never routed.
• The MAC addresses are 0100.5e00.0005 and 0100.5e00.0006.
• On point-to-point links everything goes to 224.0.0.5, since there is no DR.
• Unicast is used for retransmissions, and for all packets on NBMA networks where neighbors are configured statically.

Where each appears

All five ride directly on IP, protocol 89. OSPF builds its own reliability: an LSU that is not acknowledged is retransmitted every retransmit-interval (5 seconds by default).

The common header

Version (2 for OSPFv2, 3 for OSPFv3), type, length, router ID, area ID, checksum, and authentication type and data in OSPFv2.

State by state

Two points interviewers probe

• 2-Way is the end state between two DROTHERs on a broadcast segment. They only go Full with the DR and BDR.
• MTU is checked in the DBD packets. A mismatch is the classic cause of a neighbor stuck in ExStart or Exchange.

Checked in the hello (no neighbor at all if wrong)

• Area ID. Both interfaces must be in the same area.
• Hello and dead intervals.
• Subnet and mask. Checked on broadcast and NBMA. Skipped on point-to-point links and virtual links.
• Authentication. Same type (null, plain text, MD5 or SHA) and same key and key ID.
• Stub area flags. Both sides agree on stub or NSSA. A mismatch logs "mismatched Stub/Transit area option bit" in debug ip ospf hello.

Checked later

• Router IDs must differ. A duplicate gives %OSPF-4-DUP_RTRID_NBR.
• IP MTU is compared in DBD packets. A mismatch leaves the neighbor stuck in ExStart or Exchange.
• Network type is not in the hello, but broadcast against non-broadcast fails on timers, and broadcast against point-to-point can reach Full while routes stay missing, because the two LSAs describe the link differently and the SPF two-way check fails.

Things that do not have to match

Process ID, interface cost, and router priority.

The rules

• Runs on broadcast and NBMA network types only. Not on point-to-point or point-to-multipoint.
• Priority is per interface, 0 to 255, default 1. Priority 0 means the router can never be DR or BDR.
• Tie on priority: highest router ID wins.
• The BDR is elected first, then the DR. If there is no DR, the BDR is promoted.
• A router that comes up on a segment waits the wait timer (equal to the dead interval, 40 seconds) before it elects, so it can learn about an existing DR first.

Influencing it

interface GigabitEthernet0/0/0
 ip ospf priority 255

On the routers that should never be DR, such as small branch routers on a shared WAN segment, I set ip ospf priority 0.

What you see

R3# show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
1.1.1.1         255   FULL/DR         00:00:36    10.0.123.1      GigabitEthernet0/0/0
2.2.2.2           1   FULL/BDR        00:00:39    10.0.123.2      GigabitEthernet0/0/0
4.4.4.4           1   2WAY/DROTHER    00:00:33    10.0.123.4      GigabitEthernet0/0/0

R3 is a DROTHER. It is Full with the DR and BDR and stays 2WAY with R4, the other DROTHER.

What areas reduce

• LSDB size. Routers hold full topology only for their own areas.
• SPF runs. A topology change inside area 1 does not run SPF in area 2.
• Flooding. Type 1 and 2 LSAs never leave their area.
• Routing table size, with summarization at ABRs and stub area types.

The rules

• Every area must attach to area 0, the backbone.
• All inter-area traffic goes through area 0.
• Routers with interfaces in area 0 and another area are ABRs.

How big can one area be

There is no fixed number. Modern routers handle hundreds of routers in a single area. I split when there is a real reason: unstable WAN links I want to isolate, a need to summarize, or small branch routers that should only get a default route.

The loop-prevention rules

• An ABR advertises into area 0 the intra-area routes of its non-backbone areas.
• An ABR advertises into non-backbone areas the routes it learned from area 0 and its other areas.
• An ABR with a backbone adjacency ignores Type 3 LSAs received in non-backbone areas when it computes inter-area routes. That rule stops a summary from going area 1, to area 2, and back again.

What breaks without it

An area attached only to another non-backbone area gets no inter-area routes, because the ABR in between will not pass summaries from one non-backbone area to another.

Fixes

• Connect the area to area 0 physically.
• A virtual link through the transit area, as a temporary fix.
• A GRE tunnel placed in area 0.

Roles

How to see them

R2# show ip ospf border-routers

            OSPF Router with ID (2.2.2.2) (Process ID 1)

Base Topology (MTID 0)

        Internal Router Routing Table
Codes: i - Intra-area route, I - Inter-area route

i 3.3.3.3 [1] via 10.0.23.3, GigabitEthernet0/0/1, ASBR, Area 1, SPF 7
i 1.1.1.1 [1] via 10.0.12.1, GigabitEthernet0/0/0, ABR, Area 0, SPF 9

show ip ospf also prints "It is an area border router" and "It is an autonomous system boundary router".

A gotcha

A router with interfaces in two non-backbone areas and none in area 0 is not a true ABR. It does not pass summaries between those areas.

With the default of 100 Mbps

With auto-cost reference-bandwidth 100000 (100 Gbps)

router ospf 1
 auto-cost reference-bandwidth 100000
% OSPF: Reference bandwidth is changed.
        Please ensure reference bandwidth is consistent across all routers.

The value is in Mbps. Interface cost tops out at 65535.

Why every router must match

Each router computes the cost of its own outgoing links. If R1 uses 100000 and R2 uses 100, R1's 10G links cost 10 and R2's cost 1, and paths become asymmetric and odd. Nothing warns you across routers.

Other platforms

Junos also defaults to 100 Mbps (reference-bandwidth under protocols ospf). NX-OS defaults to 40 Gbps.

Config

router ospf 1
 passive-interface default
 no passive-interface GigabitEthernet0/0/0
 no passive-interface GigabitEthernet0/0/1

Why

• Security. A user cannot plug in a router or run a tool on a laptop and inject routes.
• Less noise. No hellos every 10 seconds onto user VLANs.
• Fewer surprises. No accidental adjacencies over an access VLAN.

Check

R1# show ip ospf interface GigabitEthernet0/0/2 | include Passive|Area
  Internet Address 10.10.20.1/24, Area 0, Attached via Interface Enable
  No Hellos (Passive interface)

How it differs elsewhere

In EIGRP passive also stops neighbors and still advertises. In RIP, passive stops sending updates but still receives them. That difference is a classic follow-up.

Example

R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1
R1(config)# router ospf 1
R1(config-router)# default-information originate

On another router:

R2# show ip route ospf | include 0.0.0.0
O*E2  0.0.0.0/0 [110/1] via 10.0.12.1, 00:00:52, GigabitEthernet0/0/0

Options

• always: advertise even without a default in the table. Useful when the default should exist whatever happens, risky because it attracts traffic to a router that has lost its uplink.
• metric 10 metric-type 1: with two edge routers, make the default E1 so each router uses the nearest exit.
• route-map: advertise only when a condition holds, for example a tracked ISP prefix is present.

Other ways to get a default

• Stub and totally stubby areas: the ABR injects a Type 3 default automatically.
• NSSA: area X nssa default-information-originate on the ABR gives a Type 7 default.

Network statements

router ospf 1
 network 10.0.12.0 0.0.0.3 area 0
 network 10.10.0.0 0.0.255.255 area 1
 network 1.1.1.1 0.0.0.0 area 0

• 0.0.0.3 with 10.0.12.0 matches 10.0.12.0 to 10.0.12.3.
• 0.0.0.0 matches one exact interface address. It is the most precise form.
• The first matching statement wins, most specific first in the running config.

Interface mode

interface GigabitEthernet0/0/0
 ip ospf 1 area 0

It is explicit, cannot match a new interface by accident, and wins over a network statement.

Common mistakes

• network 0.0.0.0 255.255.255.255 area 0 enables OSPF on every interface, including the ones to the ISP.
• The mask in the network statement is a wildcard, not a subnet mask.
• The prefix advertised is the interface's real subnet, not the range in the statement.

Normal

R3# show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
1.1.1.1           1   FULL/DR         00:00:38    10.0.100.1      GigabitEthernet0/0/0
2.2.2.2           1   FULL/BDR        00:00:35    10.0.100.2      GigabitEthernet0/0/0
4.4.4.4           1   2WAY/DROTHER    00:00:31    10.0.100.4      GigabitEthernet0/0/0

R3 and R4 are both DROTHERs. Their 2WAY is correct.

Not normal

R3# show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
4.4.4.4           0   2WAY/DROTHER    00:00:31    10.0.100.4      GigabitEthernet0/0/0

No DR and no BDR on the segment, so nobody forms Full adjacencies. show ip ospf interface on R3 says "No designated router on this network". Fix: give at least one router a non-zero priority, or make a two-router link point-to-point.

Why it is designed this way

A DR change means every router on the segment re-forms adjacencies with the new DR and the Type 2 LSA is re-originated. Preemption would cause that churn every time a router rebooted.

What happens on failure

1. The DR goes down.
2. The BDR becomes DR immediately, because it already has Full adjacencies and the same database.
3. A new BDR is elected among the DROTHERs.
4. When the old DR comes back it becomes a DROTHER.

Forcing a change

• Set the priorities you want, then clear ip ospf process on the current DR. The BDR takes DR.
• Clear the process on the new BDR (the old DR or another router) so your preferred router can win BDR, then clear again on the DR if needed. Each clear drops that router's adjacencies.
• Or avoid the problem: on links with only two routers, use ip ospf network point-to-point and there is no DR at all.

IOS defaults and behavior

Mixing them

Two routers with different types can be fine or broken:

• Broadcast against non-broadcast fails, because 10/40 does not match 30/120.
• Broadcast against point-to-point has matching timers and can reach Full, yet routes are missing. One side describes a transit network with a DR, the other a point-to-point link, so SPF fails the two-way link check.
• Broadcast against point-to-multipoint: timers differ, so no neighbor unless you change them.

Loopbacks

The loopback type always advertises a /32 host route whatever mask you configure. Set ip ospf network point-to-point on the loopback to advertise the configured mask.

What changes

• No wait timer. On broadcast the router waits the dead interval before the election. Point-to-point goes straight from 2-Way to ExStart.
• No Type 2 LSA. The link appears in each router's Type 1 LSA as a point-to-point link plus a stub network, instead of a transit network pointing at a DR.
• No mask check in the hello.

Config

interface GigabitEthernet0/0/1
 description to R2
 ip address 10.0.12.1 255.255.255.252
 ip ospf network point-to-point
 ip ospf 1 area 0

Output

R1# show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
2.2.2.2           0   FULL/  -        00:00:38    10.0.12.2       GigabitEthernet0/0/1

Priority shows 0 and the role shows a dash, because there is no election on this link.

The table I draw on the whiteboard

How they fit together

Types 1 and 2 are the map of one area. Type 3 is "this prefix is reachable through me at this cost", regenerated by every ABR at each area boundary. Type 5 names the ASBR as advertising router, so a router in another area needs a Type 4 to find its cost to that ASBR.

In show ip ospf database

Type 1 is "Router Link States", Type 2 "Net Link States", Type 3 "Summary Net Link States", Type 4 "Summary ASB Link States", Type 5 "Type-5 AS External Link States" and Type 7 "Type-7 AS External Link States".

Defaults on IOS

• Redistributed routes get metric type 2 and seed metric 20.
• Routes redistributed from BGP get seed metric 1.
• default-information originate produces an E2 default with metric 1.

Tie breaking inside E2

With two ASBRs advertising the same E2 prefix with the same metric, routers compare the forward metric, the internal cost to each ASBR, and pick the lower one. So E2 is not totally blind, it just shows the same number in the routing table.

Choosing

router ospf 1
 redistribute static metric 50 metric-type 1

• E1 when there are several exits and each router should use the nearest one.
• E2 when there is one exit, or when the external cost should dominate, for example to keep a backup ISP exit as backup with a higher external metric.

In the routing table

O E1     198.51.100.0/24 [110/52] via 10.0.12.2, 00:02:11, GigabitEthernet0/0/0
O E2     203.0.113.0/24 [110/20] via 10.0.12.2, 00:02:11, GigabitEthernet0/0/0

The E1 route shows 50 plus an internal cost of 2. The E2 route shows only its seed metric.

The order

1. O intra-area
2. O IA inter-area
3. O E1 or O N1
4. O E2 or O N2

An intra-area path with cost 500 beats an inter-area path with cost 10. This surprises people in designs where the same subnet is reachable inside the area over a slow link and through the backbone over fast ones.

Where it bites

• A backup WAN link placed in the same area as a branch makes the branch prefer the slow link, because the path becomes intra-area. Put the link in the right area or fix the design.
• Two ABRs summarizing differently produce a mix of more-specific and summary routes. Longest prefix match still applies first in the FIB, before any OSPF preference.

Order of decisions overall

Longest prefix match across all sources, then administrative distance between protocols, then this OSPF route-type order, then cost, then ECMP across equal-cost paths.

Comparison

Config

! ABR R2, area 1 totally stubby
router ospf 1
 area 1 stub no-summary
!
! Internal router R1 in area 1
router ospf 1
 area 1 stub

Rules

• The stub flag is in every hello. Every router in the area must agree or adjacencies fail.
• No ASBR inside a stub area. Use NSSA if you need one.
• Area 0 can never be a stub.
• A stub area cannot be the transit area of a virtual link.
• area 1 default-cost 10 on the ABR changes the cost of the injected default (default 1).

Result on R1

O*IA  0.0.0.0/0 [110/2] via 10.0.12.2, 00:01:05, GigabitEthernet0/0/0

Typical use

A branch area that should stay small, but has a local internet breakout or a partner connection redistributed into OSPF at the branch.

Config

! ABR R2
router ospf 1
 area 2 nssa no-summary
!
! ASBR R4 inside area 2
router ospf 1
 area 2 nssa
 redistribute static subnets

subnets is needed on older IOS releases to redistribute non-classful prefixes. Newer IOS-XE adds it automatically.

Translation

• The ABR translates Type 7 to Type 5 only when the P bit is set, which the ASBR sets by default.
• With several ABRs, the one with the highest router ID is elected translator.
• The translated Type 5 has the ABR as advertising router.

Default routes

• Plain NSSA: no automatic default on IOS. Add area 2 nssa default-information-originate on the ABR, which creates a Type 7 default (shown as O*N2).
• Totally NSSA: the ABR injects a Type 3 default automatically (O*IA).

Cost is outbound

The cost of a link counts in the direction the router sends traffic. To make R1 avoid a link, raise the cost on R1's interface. To make the return traffic avoid it too, raise it on the far end as well.

Tools, from cleanest to bluntest

1. Reference bandwidth set right everywhere, so speed is reflected automatically.
2. ip ospf cost <1-65535> on specific interfaces. Overrides the calculation, affects only OSPF.
3. bandwidth on the interface. Changes the calculation but also EIGRP and QoS. Avoid for this.
4. Area design. Intra-area beats inter-area regardless of cost, so a link in the wrong area wins anyway.

Check

R1# show ip ospf interface brief
Interface    PID   Area            IP Address/Mask    Cost  State Nbrs F/C
Lo0          1     0               1.1.1.1/32         1     LOOP  0/0
Gi0/0/1      1     0               10.0.13.1/30       100   P2P   1/1
Gi0/0/0      1     0               10.0.12.1/30       10    P2P   1/1

Example

Area 1 holds 10.1.0.0/24 to 10.1.15.0/24. R2 is the ABR between area 0 and area 1.

router ospf 1
 area 1 range 10.1.0.0 255.255.240.0

On R2:

R2# show ip route ospf | include Null0
O        10.1.0.0/20 is a summary, 00:03:12, Null0

In area 0 every router now sees one O IA 10.1.0.0/20 instead of sixteen /24s.

What you gain and lose

• Gain: smaller tables in other areas, and a flap of one /24 in area 1 no longer changes anything outside it.
• Lose: detail. Traffic may take a longer path through the wrong ABR if two ABRs both advertise the summary and only one has a good path to a given subnet.

Options

• area 1 range 10.1.0.0 255.255.240.0 not-advertise hides the range entirely. It is a crude filter.
• area 1 range ... cost 50 sets the cost of the summary.

Limits

You can only summarize at an ABR or an ASBR. Inside an area every router must have the full LSDB.

Example

R3 redistributes static routes 172.16.0.0/24 to 172.16.3.0/24 toward a partner.

router ospf 1
 redistribute static
 summary-address 172.16.0.0 255.255.252.0

R3# show ip route | include 172.16.0.0/22
O        172.16.0.0/22 is a summary, 00:00:41, Null0
R1# show ip route | include 172.16.0.0/22
O E2     172.16.0.0/22 [110/20] via 10.0.13.3, 00:00:41, GigabitEthernet0/0/1

Two places it works

• On the ASBR that redistributes the routes.
• On an NSSA ABR, which can summarize Type 7 routes while it translates them into Type 5.

Options

• summary-address 172.16.0.0 255.255.252.0 not-advertise suppresses the summary and its components.
• tag <n> sets a route tag on the summary, which is handy in two-way redistribution.

Example

Area 2 attaches only to R3. R3 connects to area 1. R2 is the ABR between area 0 and area 1.

! R2 (router ID 2.2.2.2)
router ospf 1
 area 1 virtual-link 3.3.3.3
!
! R3 (router ID 3.3.3.3)
router ospf 1
 area 1 virtual-link 2.2.2.2

The arguments are the transit area and the router ID of the other end, not an IP address.

R3# show ip ospf virtual-links
Virtual Link OSPF_VL0 to router 2.2.2.2 is up
  Run as demand circuit
  DoNotAge LSA allowed.
  Transit area 1, via interface GigabitEthernet0/0/0
  Topology-MTID    Cost    Disabled     Shutdown      Topology Name
        0           1         no           no            Base
  Transmit Delay is 1 sec, State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Adjacency State FULL (Hello suppressed)

Rules

• The transit area cannot be a stub or NSSA, and cannot be area 0.
• The virtual link is part of area 0, so area 0 authentication applies to it.
• It runs as a demand circuit: hellos are suppressed once Full, and its LSAs do not age.
• Its cost is the intra-area cost through the transit area.

Why it is a stopgap

Traffic between the two areas still crosses the transit area, often on links not sized for it, and troubleshooting gets harder. The real fix is a physical link into area 0 or a renumbered area design.

HMAC-SHA-256 on IOS-XE (preferred)

key chain OSPF-KEYS
 key 1
  key-string Str0ngOspfKey
  cryptographic-algorithm hmac-sha-256
!
interface GigabitEthernet0/0/0
 ip ospf authentication key-chain OSPF-KEYS

MD5 (legacy, still common)

interface GigabitEthernet0/0/0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 Str0ngOspfKey

MD5 can also be enabled for a whole area with area 0 authentication message-digest, with the key still set per interface. The interface command overrides the area setting.

Key rotation

With MD5 you can add key 2 on both sides. IOS sends with both keys until it sees every neighbor using the newest key. With key chains, use send-lifetime and accept-lifetime so the change rolls over without a flap.

Symptoms of a mismatch

The neighbor disappears after the dead interval and debug ip ospf adj reports a mismatched authentication type or key. Virtual links follow area 0's authentication.

OSPFv3

OSPFv3 removed the authentication fields. It uses IPsec AH or ESP (ipv6 ospf authentication ipsec), or the RFC 7166 authentication trailer on newer releases.

Config and check

router ospf 1
 maximum-paths 8

R1# show ip route 10.30.0.0
Routing entry for 10.30.0.0/24
  Known via "ospf 1", distance 110, metric 21, type intra area
  Last update from 10.0.13.3 on GigabitEthernet0/0/1, 00:04:10 ago
  Routing Descriptor Blocks:
  * 10.0.12.2, from 3.3.3.3, 00:04:10 ago, via GigabitEthernet0/0/0
      Route metric is 21, traffic share count is 1
    10.0.13.3, from 3.3.3.3, 00:04:10 ago, via GigabitEthernet0/0/1
      Route metric is 21, traffic share count is 1

Per flow, not per packet

The default CEF hash keeps a flow on one path, which avoids reordering. One big flow still uses one link. show ip cef exact-route <src> <dst> shows which path a given pair takes.

Wanting unequal cost

Options are equal costs with links of different sizes accepted as is, a bundle (EtherChannel), MPLS TE, or a different protocol. Changing costs to fake it only moves all traffic to one path.

What you see

R2# show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
1.1.1.1           1   EXSTART/BDR     00:00:34    10.0.12.1       GigabitEthernet0/0/0

R2# debug ip ospf adj
OSPF-1 ADJ   Gi0/0/0: Nbr 1.1.1.1 has larger interface MTU

The router with the smaller MTU logs this. The neighbor eventually goes down after too many retransmissions and starts again, so the state can flap between EXSTART, EXCHANGE and DOWN.

Check and fix

R2# show ip interface GigabitEthernet0/0/0 | include MTU
  MTU is 1400 bytes

R2(config)# interface GigabitEthernet0/0/0
R2(config-if)# no ip mtu

Why mtu-ignore is not a fix

The adjacency forms, but an LSU bigger than the small side's MTU is fragmented or dropped. With a large LSDB, updates then fail later and in a much more confusing way.

Other causes

• Duplicate router IDs: both claim master and the exchange loops.
• Unicast reachability broken on NBMA: hellos make it, DBDs do not.
• An MTU change on only one side of a switch path with jumbo frames, so large DBDs are dropped in the middle.

Reasoning

The 2-Way check is "my router ID appears in your hello". If R1 sees R2 in INIT, R2's hellos reach R1 but R1's hellos do not reach R2, or R2 discards them.

What to check

1. ACLs and firewalls inbound on R2 or along the path: they must permit IP protocol 89 to 224.0.0.5.
2. The link itself: a fiber with one bad strand, shown by input errors or UDLD on a switch in between.
3. Multicast handling on a switch or wireless bridge between the routers.
4. NBMA or hub-and-spoke clouds: one side has no mapping that carries multicast or broadcast.

Proof

R2# debug ip ospf hello

If R2 shows nothing from R1 at all, the hellos are not arriving. A capture or an ACL with log on R2's interface tells you if they arrive and get dropped.

Example

R3 (3.3.3.3) is an ASBR in area 0 originating a default route. R2 (2.2.2.2) is the ABR to area 1. R1 (1.1.1.1) is inside area 1.

R1# show ip ospf database

            OSPF Router with ID (1.1.1.1) (Process ID 1)

                Router Link States (Area 1)

Link ID         ADV Router      Age         Seq#       Checksum Link count
1.1.1.1         1.1.1.1         312         0x80000004 0x00B1C2 2
2.2.2.2         2.2.2.2         298         0x80000003 0x0047E1 1

                Summary Net Link States (Area 1)

Link ID         ADV Router      Age         Seq#       Checksum
10.0.23.0       2.2.2.2         301         0x80000001 0x00D4A8

                Summary ASB Link States (Area 1)

Link ID         ADV Router      Age         Seq#       Checksum
3.3.3.3         2.2.2.2         301         0x80000001 0x00C6B3

                Type-5 AS External Link States

Link ID         ADV Router      Age         Seq#       Checksum Tag
0.0.0.0         3.3.3.3         640         0x80000002 0x00E5F1 1

The Type 5 names 3.3.3.3. The only thing in area 1 that mentions 3.3.3.3 is the Type 4 from R2. Without it, R1 would ignore the external route.

Where Type 4 is not needed

• Inside the ASBR's own area, where its Type 1 LSA is present.
• In stub and NSSA areas, which do not get Type 5 LSAs at all.
• For an NSSA, the translating ABR becomes the advertising router of the Type 5. Other areas then get a Type 4 for that ABR as the ASBR.

Constants from RFC 2328

Which copy is newer

1. Higher sequence number.
2. If equal, higher checksum.
3. If equal, a copy at MaxAge is newer.
4. If ages differ by more than MaxAgeDiff, the younger copy is newer. Otherwise they are the same.

Reading it in the database

Age counts up from 0. Seq# shows the sequence. An LSA with a high and rising sequence number on a stable network means it is being re-originated again and again: a flapping link or a duplicate router ID.

Withdrawal

When a router removes a prefix it originated, such as a stopped redistribution, it sets the LSA age to 3600 and floods it. Every router removes it after acknowledging it. That is "premature aging".