Configure single-area OSPFv2 two ways — network statements with wildcard masks and interface-level enablement — set a stable router-id, make LAN interfaces passive, and verify the process with show ip protocols and show ip ospf interface.
Week 5 · Lesson 4 · Active ~44 min · Video ~8 min (optional) · Lab ~30 min · Domain: IP Connectivity
You should know what a healthy adjacency looks like (FULL) and what Hello parameters must match. This lesson is how you configure OSPF so those adjacencies form on the right interfaces and nowhere else.
Prerequisites: ospf-concepts-and-neighbors
Paths: Start lesson · Test out (jump to the quick check) · Review sheet
Baseline check
You want to enable OSPF on a /30 point-to-point link addressed 10.1.12.0. What wildcard mask goes in the network statement — and is it a subnet mask or its inverse? Write it down before continuing.
The answer — 0.0.0.3, the inverse of the /30 subnet mask — is where most first OSPF configs go wrong. The network statement does not take a subnet mask; it takes a wildcard.
Enabling OSPF is a two-decision job: pick a process, then tell it which interfaces participate. The process is created with router ospf <process-id>. The process ID is locally significant (Week's earlier lesson) — pick any number; it need not match neighbors. The second decision — which interfaces — has two valid styles.
Style 1 — the network statement (classic). Inside the process you list networks with a wildcard mask and an area:
R1(config)# router ospf 1
R1(config-router)# network 10.1.1.0 0.0.0.255 area 0
R1(config-router)# network 10.1.12.0 0.0.0.3 area 0
The statement does not advertise a subnet directly. It is a match rule: OSPF looks at every local interface, and any interface whose IP falls within address/wildcard is enabled for OSPF in the stated area. So network 10.1.1.0 0.0.0.255 area 0 enables OSPF on whatever local interface sits in 10.1.1.0/24. The wildcard is the inverse of the subnet mask: /24 → 0.0.0.255, /30 → 0.0.0.3, a single host /32 → 0.0.0.0.
Style 2 — interface-level (modern, explicit). Instead of matching, you enable OSPF directly on the interface:
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip ospf 1 area 0
This is unambiguous — you can see OSPF is on this interface without reverse-engineering a wildcard — and it is common in labs. Prefer it when you want zero ambiguity about which interfaces run OSPF; prefer network statements when a single line can cleanly cover a range of interfaces. Both coexist. Either way, area 0 is the backbone, and every router in a single-area design lives in it.
How do I turn a subnet mask into a wildcard mask quickly?
Subtract each octet of the subnet mask from 255. A /24 mask is 255.255.255.0, so the wildcard is (255-255).(255-255).(255-255).(255-0) = 0.0.0.255. A /30 mask is 255.255.255.252, so the wildcard is 0.0.0.3. A /26 mask is 255.255.255.192, so the wildcard is 0.0.0.63. The wildcard's 1-bits mark "don't care" positions; getting it wrong either enables OSPF on interfaces you did not intend or silently misses the interface you wanted — which then never appears in show ip ospf interface brief.
Network-statement vs interface enablement and wildcard rules (topic guide)
Pin the Router ID. OSPF chooses its RID at process start: manual router-id first, else the highest loopback IP, else the highest active physical IP. Letting it default means an interface flap or a new loopback can silently change the router's identity — and duplicate RIDs across routers cause real faults. Set it explicitly:
R1(config)# router ospf 1
R1(config-router)# router-id 1.1.1.1
A RID change after the process is running does not take effect until you run clear ip ospf process (or reload). Forgetting that step is a common "I set it but it did not change" moment.
Passive interfaces advertise without adjacency. On a LAN facing end hosts there is no OSPF neighbor to talk to, yet sending Hellos out that interface wastes CPU and — worse — invites a rogue router to peer with you. passive-interface stops Hellos on an interface while still advertising that connected network into OSPF:
R1(config-router)# passive-interface GigabitEthernet0/0
The subtle, exam-relevant point: passive-interface does not remove the route. The 10.1.1.0/24 LAN is still flooded to the rest of the area — you simply stop forming adjacencies out that port. Apply it to user LANs; never apply it to a transit link, or you kill the adjacency you need. You can also flip the default with passive-interface default and then selectively no passive-interface the transit links.
Free CCNA | OSPF Part 2 | Day 27 | CCNA 200-301 Complete Course
~8 min
Optional walkthrough of the router ospf process, network statements, and verification. The written lesson and lab already cover the exam-tested config.
Skip if you can write a network statement and set a router-id from memory.
Watch on YouTubeEnrichment only — the required work is the configuration checkpoint in the lab.
Configure single-area OSPF on R1 and verify
R1(config)# router ospf 1
R1(config-router)# router-id 1.1.1.1
R1(config-router)# network 10.1.1.0 0.0.0.255 area 0
R1(config-router)# network 10.1.12.0 0.0.0.3 area 0
R1(config-router)# passive-interface GigabitEthernet0/0
R1(config-router)# end
R1# show ip protocols
Routing Protocol is "ospf 1"
Router ID 1.1.1.1
Number of areas in this router is 1. 1 normal 0 stub 0 nssa
Maximum path: 4
Routing for Networks:
10.1.1.0 0.0.0.255 area 0
10.1.12.0 0.0.0.3 area 0
Passive Interface(s):
GigabitEthernet0/0
Routing Information Sources:
Gateway Distance Last Update
2.2.2.2 110 00:03:11
show ip protocols is the fastest confirmation the configuration is right: it echoes the Router ID, the exact network statements with their wildcards, the passive interfaces, and the neighbors it is learning from. Cross-check the interfaces actually running OSPF with:
R1# show ip ospf interface brief
Interface PID Area IP Address/Mask Cost State Nbrs F/C
Gi0/0 1 0 10.1.1.1/24 1 DR 0/0
Gi0/1 1 0 10.1.12.1/30 1 P2P 1/1
Gi0/1 has 1 neighbor Full/Count (1/1) — the transit adjacency. Gi0/0 shows 0/0 neighbors because it is passive: it is in OSPF (advertised) but forms no adjacency. That 0/0 on a LAN is expected, not a fault.
Pause and predict
You configure network 10.1.12.0 0.0.0.255 area 0 (a /24 wildcard) on a router whose only interface in that range is the 10.1.12.1/30 transit link. Does OSPF still come up on the transit link? What risk did the too-broad wildcard introduce?
Reveal answer
Yes — OSPF still enables on 10.1.12.1 because that address falls within the 10.1.12.0/24 match range, so the transit adjacency forms normally. The risk is over-matching: if this router had any other interface in 10.1.12.0/24 (say a second link 10.1.12.5), the broad wildcard would enable OSPF there too, possibly forming an unintended adjacency or leaking a network you did not mean to advertise. The disciplined habit is to size the wildcard to the actual prefix — 0.0.0.3 for a /30 — so the statement matches exactly the interface you intend.
This is the configuration stage of the shared lab-week5-ospf-single-area lab. You take the two-router adjacency from the previous lesson and build out a full single-area domain with clean RIDs and passive LANs.
Lab checkpoint · lab-week5-ospf-single-area · ~18 min · packet_tracer
Skill: Enable OSPF on the correct interfaces using network statements with wildcard masks
Starting: R1, R2, R3 have interface IPs but no routing protocol; each has a LAN and point-to-point links.
Action: Configure router ospf 1, set a manual router-id, and add network statements with correct wildcard masks for each link and LAN in area 0.
Verify: show ip ospf interface brief lists every intended interface; show ip route ospf shows the remote LANs as O routes; neighbors reach FULL.
Variant: Use a /24 wildcard (0.0.0.255) for a /30 link and observe an unintended interface enabled, or an intended interface missing from show ip ospf interface brief.
Lab checkpoint · lab-week5-ospf-single-area · ~12 min · troubleshooting
Skill: Make LAN interfaces passive and set deterministic router IDs
Starting: OSPF is up and neighbors are FULL, but LAN interfaces still send Hellos and RIDs were auto-selected.
Action: Apply passive-interface to each LAN interface and set a manual router-id on each router, then reset the process.
Verify: show ip protocols lists the LAN interfaces as passive and shows the configured router-id; adjacencies on transit links remain FULL.
Variant: Accidentally mark the transit link passive-interface and watch the adjacency drop; remove it to restore FULL.
Quick check (3 items) · test
Answer from memory:
- Write the network statement that enables OSPF on a /30 link addressed 10.1.12.0 in area 0.
- What does passive-interface do and not do to a LAN's OSPF participation?
- You set router-id 1.1.1.1 but show ip ospf still shows the old RID. What did you forget?
Review sheet
- Enable:
network <addr> <wildcard> area <id>(match rule) or interfaceip ospf <pid> area <id>. - Wildcard = inverse of subnet mask: /24 → 0.0.0.255, /30 → 0.0.0.3.
- Router ID: manual → loopback → highest active IP; changes need
clear ip ospf process. - passive-interface: stops Hellos on LANs, still advertises the connected route — never on a transit link.
- Verify config first with
show ip protocolsandshow ip ospf interface brief, then check routes.
network 10.1.12.0 0.0.0.3 area 0 enables the /30; using 255.255.255.252 there is rejected, and using 0.0.0.255 over-matches.Troubleshooting scenario
Symptom. After configuring OSPF on R1 and R2 you see the log %OSPF-4-DUP_RTRID1 and the routers exchange incomplete routes; some remote LANs are missing from the table.
Diagnosis. Both routers selected or were configured with the same Router ID (for example both auto-picked 10.1.12.x, or both were set to 1.1.1.1). OSPF requires a unique RID per router; a duplicate corrupts the LSDB view and yields missing or unstable routes.
Fix. Assign a unique router-id on each router (R1 router-id 1.1.1.1, R2 router-id 2.2.2.2), then clear ip ospf process on both so the change takes effect. Confirm unique RIDs in show ip protocols and full route learning in show ip route ospf.
With OSPF configured and neighbors up, next you tune which path wins (cost), who leads a multiaccess segment (DR/BDR), and how to inject a default route.
Next: OSPF Cost, DR/BDR, and Default-Route Advertisement