Stub and NSSA mechanics — Type 5 blocking, ABR default, Type 7 propagation

The stub and NSSA area types exist for one reason: to limit the LSA flooding scope so a remote site does not have to learn every external prefix in the OSPF domain. The mechanism is the same in both — the ABR filters certain LSA types at the area boundary — but the NSSA introduces a new LSA type (Type 7) and a new bit (the P-bit) so that an ASBR inside the area can still contribute external prefixes to the wider domain. This lesson walks through the mechanics end-to-end.

xx-01 named the area types and listed the LSA filters. This lesson explains why the filters exist, what the ABR injects to compensate, and what the NSSA’s Type 7 LSA actually does.

Why a stub area cannot contain a Type 5 LSA

Type 5 LSAs (AS-External-LSAs, RFC 2328 Section 5) carry external prefixes — destinations learned outside the OSPF domain and redistributed in. They are flooded throughout the OSPF domain by flooding scope: every ASBR that originates a Type 5 reaches every router in the domain through the LSA’s flooding procedure, except where the procedure is explicitly constrained.

The stub area is the constraint. The reason a stub area exists is that a remote site does not need to learn every external prefix; the site needs a default route and the specific inter-area prefixes it explicitly summarises. The Type 5 LSA’s information density (one prefix per LSA, often tens of thousands of prefixes in a modern routing domain) is the cost the stub saves.

The ABR enforces the constraint at the flooding loop. When the ABR is about to flood a Type 5 LSA into an attached area, the flooding code checks the area-type flag on the destination area. If the flag is stub or nssa, the ABR drops the Type 5 and does not install it in the destination LSDB. The check is symmetric: Type 5 LSAs originated inside a stub are also dropped at the ABR outbound.

The downstream effect is that every router inside the stub has no Type 5 LSAs in its LSDB, has no view of the ASBRs that originated them, and has no view of the external metric for any external prefix. The router relies entirely on:

• Type 3 Summary LSAs for inter-area prefixes (real summaries plus a default route the ABR injects).
• Type 1 / Type 2 LSAs for intra-area destinations.

The default-route injection

The ABR compensates for the suppressed Type 5s by originating a Type 3 Summary LSA with destination 0.0.0.0/0. The default summary carries a metric that the ABR assigns — by default, the metric is 10, but the operator can change it via the configuration.

set protocols ospf area 20 area-type stub
set protocols ospf area 20 default-cost 5

The default-cost keyword adjusts the cost the ABR attaches to the injected default route. A lower cost makes the default more attractive relative to specific inter-area summaries; a higher cost deprioritises it. The default is 10, which sits between the typical intra-area cost (reference cost 100 for 100 Mbps) and the typical external cost (reference cost 100 for redistributed external). Operators raise the default cost when they want specific inter-area routes to be preferred over the default.

sequenceDiagram
  participant ABR as ABR
  participant R as Stub-area router
  participant EXT as External ASBR
  ABR-->>R: Type 3 Summary 0.0.0.0/0 metric 10
  EXT-->>ABR: Type 5 198.51.100.0/24 metric 20
  ABR--xR: Type 5 dropped at area boundary
  Note over R: Routing table installs 0.0.0.0/0 -> ABR
  Note over R: No entry for 198.51.100.0/24<br/>until ABR summarises it

The default route is the only summary the totally stubby / totally NSSA ABR injects. The plain stub / plain NSSA ABR injects the default plus all real inter-area Type 3 summaries; the totally variants suppress the real summaries and inject only the default.

Why a plain stub cannot contain an ASBR

A plain stub area’s contract is “no Type 5 LSAs cross the boundary”. The contract is bilateral — Type 5 LSAs cannot enter the stub from outside, and Type 5 LSAs cannot leave the stub from inside. If a router inside the stub tried to be an ASBR (i.e. it tried to redistribute a non-OSPF source into OSPF), the Type 5 LSA it originated would have no audience: no router inside the stub would accept it as valid, and the ABR would refuse to flood it into the rest of the domain.

The protocol enforcement is in the Hello packet’s Options field. The E-bit (External bit) signals whether the router is willing to receive Type 5 LSAs. A stub router sets the E-bit clear in its Hello packets; a non-stub router sets the E-bit set. A Hello from a non-stub router received by a stub router fails the area-type compatibility check and the adjacency stays in Init. The check is symmetric and bi-directional.

The consequence is operationally simple: if the operator wants a remote site to redistribute external prefixes into OSPF (e.g. a static route to a partner network, or a locally-run BGP session), the area cannot be a plain stub. The two options are:

• Use a standard area. The full set of LSA types is allowed; the cost is the LSDB size.
• Use a NSSA. The Type 7 LSA mechanism allows the redistribution while still keeping the rest of the LSA-type restrictions.

The NSSA Type 7 LSA

RFC 3101 defines the Type 7 LSA (NSSA External LSA). It carries the same information as a Type 5 LSA — prefix, mask, metric, forward address, external route tag — but is encoded with NSSA-specific TLVs and is flooded only within the NSSA. The Type 7 originates from the ASBR-NSSA and is contained in the NSSA’s LSDB until the NSSA’s ABR processes it.

The P-bit (propagate) is one bit in the Type 7 LSA’s header flags. RFC 3101 defines it as follows: when set, the NSSA’s ABR is allowed to translate the Type 7 to a Type 5 and flood the Type 5 into the rest of the OSPF domain. When clear, the ABR must NOT translate — the prefix stays inside the NSSA only.

The default is “set”. An ASBR-NSSA that redistributes a route without explicitly clearing the P-bit gets the default behaviour: the prefix is propagated outward. An ASBR-NSSA that wants a prefix to stay inside the NSSA (e.g. an internal-only static route) must clear the P-bit explicitly.

flowchart LR
  subgraph "NSSA area 30"
    ASBR["ASBR-NSSA<br/>redistributes static 10.99.0.0/16"]
    R1[R-1]
    R2[R-2]
    ABR[ABR-NSSA]
    ASBR -- "Type 7<br/>10.99.0.0/16<br/>P-bit set" --> R1
    ASBR -- "Type 7" --> R2
    R1 -- "Type 7" --> ABR
    R2 -- "Type 7" --> ABR
  end
  subgraph "Backbone area 0"
    B[Backbone]
    EXT[Other area]
  end
  ABR -- "Type 5<br/>regenerated<br/>10.99.0.0/16" --> B
  B --> EXT

The translation is regeneration, not copying. The ABR reads the Type 7 from its LSDB, generates a fresh Type 5 LSA with the equivalent information (prefix / mask / metric / forward address), and floods the Type 5 through the rest of the OSPF domain. The original Type 7 stays inside the NSSA for the lifetime of its LSA sequence number.

The forward address in Type 7

The forward address is the next-hop the external traffic should use. In a Type 5 LSA, the forward address is one of:

• 0.0.0.0 — the originator ASBR is the next hop.
• A non-zero address — the forward address is the next hop, and traffic to the external prefix is forwarded to that address.

In a Type 7 LSA, the forward address defaults to the ASBR-NSSA’s interface address in the NSSA. If the ASBR-NSSA redistributes a static route, the forward address is typically the ASBR’s interface in the NSSA — the address that internal NSSA routers use to reach the ASBR-NSSA. The ABR, when translating the Type 7 to a Type 5, preserves the forward address.

The choice of forward address matters for recursive routing: if the forward address is a non-zero address in an area outside the NSSA, the router receiving the Type 5 must perform a recursive lookup to reach the forward address. If that lookup fails, the route is unusable even though the LSA is present.

How the NSSA ABR decides what to translate

The NSSA ABR holds the LSDB for both its attached areas (the NSSA and the backbone, or the NSSA and another standard area). When a Type 7 LSA arrives in its NSSA LSDB, the ABR runs the translation decision:

1. Read the Type 7’s P-bit. If clear, do not translate.
2. Read the Type 7’s prefix / mask / metric. If the prefix is one the ABR has been configured to suppress (e.g. via no-redistribute), do not translate.
3. Otherwise, generate a Type 5 LSA with the equivalent information and flood it into the non-NSSA area.

The Type 5 is originated by the ABR, not by the original ASBR-NSSA. The LSA’s advertising router is the ABR’s router-id. The LSA sequence number starts at 0x80000001 and increments on every re-origination. The LSA’s age starts at 0 and is incremented by the flooding loop.

If the Type 7 is later flushed (e.g. the ASBR-NSSA stops redistributing), the ABR re-ages its Type 5 to MaxAge and refloods. The rest of the domain sees the Type 5 disappear.

VyOS 1.5 LTS configuration

# Stub area
set protocols ospf area 20 network 192.168.20.0/24
set protocols ospf area 20 area-type stub

# Totally stubby (ABR side)
set protocols ospf area 40 network 192.168.40.0/24
set protocols ospf area 40 area-type stub no-summary

# NSSA
set protocols ospf area 30 network 192.168.30.0/24
set protocols ospf area 30 area-type nssa

# Totally NSSA (ABR side)
set protocols ospf area 50 network 192.168.50.0/24
set protocols ospf area 50 area-type nssa no-summary

# NSSA ASBR — redistribute static
set protocols ospf area 30 nssa redistribute static

# Adjust the ABR default cost
set protocols ospf area 20 default-cost 5

# NSSA ABR — suppress translation of a specific prefix
set protocols ospf area 30 range 10.99.0.0/16 not-advertise

The range statement with not-advertise is the mechanism an ABR uses to suppress translation of a specific Type 7 prefix. The range matches the Type 7’s prefix, and the not-advertise flag tells the ABR not to generate a Type 5 from it. The Type 7 still floods inside the NSSA; the prefix is just not propagated outward.

How the result is validated

show ip ospf database
show ip ospf database stub
show ip ospf database nssa-external
show ip ospf database external
show ip ospf border-routers
show ip route ospf
vtysh -c 'show ip ospf'
vtysh -c 'show ip ospf database'

What the operator looks for:

• show ip ospf database stub lists the stub area’s Type 3 Summary LSAs, including the default route (0.0.0.0/0).
• show ip ospf database nssa-external lists Type 7 LSAs in the NSSA.
• show ip ospf database external lists Type 5 LSAs in the rest of the domain. A prefix that was redistributed in the NSSA and translated must appear here.
• show ip ospf border-routers lists the ABRs and ASBRs visible from the area. A NSSA should see ASBRs (the ASBR-NSSA); a plain stub should NOT.
• show ip route ospf shows the default route installed from the stub / NSSA’s default summary, and the specific inter-area routes installed from real summaries.

How it fails

The production failure modes:

• Area-type mismatch on a single router. A new router joined the area without area-type stub, breaking the adjacency with the rest of the stub. The new router sees the others as Down; the others see the new router as Init. The diagnostic is show ip ospf neighbor verbose, looking for area-type-mismatch.
• Type 7 with P-bit clear unexpectedly. An ASBR-NSSA redistributes static routes, but the routes do not appear outside the NSSA. The diagnostic is show ip ospf database nssa-external self-originate looking for P-bit clear. The fix is to ensure the ASBR’s redistribution is configured without an explicit P-bit clear.
• Forward address unreachable. The Type 7 / Type 5 forward address is in an area the receiving router cannot reach. The route is present in the LSDB but does not install in the RIB. The diagnostic is show ip route <prefix> showing “recursive routing failure”.
• ABR refuses to translate a prefix. The no-redistribute range blocks the prefix. The diagnostic is the operator’s own configuration: show configuration commands | match range.
• Stub area used as transit for a virtual-link. The ABR refuses the virtual-link configuration because the transit area must be standard. The fix is to convert the transit area to standard or to choose a different transit area.

Rollback

# Capture the running configuration before the change
show configuration commands | save /tmp/ospf-area-type-$(date +%s).txt

# Verify the candidate is what was intended
compare

# Apply with a short confirm window in case the change breaks adjacencies
commit-confirm 5

# Roll back manually if needed
rollback 1
commit

A short commit-confirm window is essential: the change of area-type is a full adjacency flap, and if the change is on a remote router the operator may not be able to issue commands while the adjacencies are down.

Production discipline

Cross-course references

• The OSPF fundamentals part covers the LSA types (vyos-xviii-03-lsa-types), the area concept (vyos-xviii-04-areas), and the basic OSPF configuration (vyos-xix-03-ospf-area-config).
• The previous lesson (vyos-xx-01-area-types) named the area types and listed the LSA filters.
• The summarisation lesson (vyos-xx-03-summarisation) covers the area range mechanism that interacts with the NSSA’s Type 7 translation.
• The troubleshooting part (XXII) covers the adjacency failure modes that surface when the area-type is mismatched.

Quiz