Ping Labz
OSPF · · 6 min read

OSPF Passive Interfaces: When and How to Use Them

OSPF Passive Interfaces: When and How to Use Them

Why Passive Interfaces Matter

Security

Problem without passive interfaces:
If you enable OSPF on a user-facing VLAN (e.g., office LAN), anyone can:

Solution:
Make the interface passive. OSPF advertises the network, but won't form adjacencies.

Reduce Overhead

Problem:
OSPF sends Hello packets every 10 seconds on each active interface. On user-facing networks with no OSPF routers, this wastes:

Solution:
Passive interfaces eliminate unnecessary Hello packets.

When to Use Passive Interfaces

✅ Use Passive on:

❌ Don't Use Passive on:

How to Configure Passive Interfaces

Method 1: Per-Interface (Selective)

Make specific interfaces passive:

Router(config)# router ospf 1
Router(config-router)# passive-interface gi0/1
Router(config-router)# passive-interface loopback 0

Use case: Most interfaces need OSPF neighbors; only a few are passive.

Make all interfaces passive by default, then explicitly enable OSPF on specific interfaces:

Router(config)# router ospf 1
Router(config-router)# passive-interface default
Router(config-router)# no passive-interface gi0/0
Router(config-router)# no passive-interface gi0/2

What this does:

Use case: Branch routers with many user VLANs and only 1-2 uplinks.

Configuration Example

Scenario:

Branch router with:

Goal:

Configuration:

interface loopback 0
 ip address 10.255.255.10 255.255.255.255

interface gi0/0
 description Uplink to HQ
 ip address 10.1.1.2 255.255.255.252

interface gi0/1
 description User VLAN 10
 ip address 192.168.10.1 255.255.255.0

interface gi0/2
 description User VLAN 20
 ip address 192.168.20.1 255.255.255.0

router ospf 1
 router-id 10.255.255.10
 network 10.255.255.10 0.0.0.0 area 0
 network 10.1.1.0 0.0.0.3 area 0
 network 192.168.10.0 0.0.0.255 area 0
 network 192.168.20.0 0.0.0.255 area 0
 passive-interface loopback 0
 passive-interface gi0/1
 passive-interface gi0/2

Result:

Alternative (Passive by Default):

router ospf 1
 router-id 10.255.255.10
 network 0.0.0.0 255.255.255.255 area 0
 passive-interface default
 no passive-interface gi0/0

Result: Same outcome, cleaner config.

Verification

Check Which Interfaces are Passive

Router# show ip protocols
Routing Protocol is "ospf 1"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Router ID 10.255.255.10
  Number of areas in this router is 1. 1 normal 0 stub 0 nssa
  Maximum path: 4
  Routing for Networks:
    0.0.0.0 255.255.255.255 area 0
  Passive Interface(s):
    Loopback0
    GigabitEthernet0/1
    GigabitEthernet0/2
  Routing Information Sources:
    Gateway         Distance      Last Update
    10.0.0.1        110           00:12:34

Key section: "Passive Interface(s)"

Check OSPF on Specific Interface

Router# show ip ospf interface gi0/1
GigabitEthernet0/1 is up, line protocol is up
  Internet Address 192.168.10.1/24, Area 0
  Process ID 1, Router ID 10.255.255.10, Network Type BROADCAST, Cost: 1
  Transmit Delay is 1 sec, State WAITING, Priority 1
  No Hellos (Passive interface)
  Supports Link-local Signaling (LLS)
  Index 2/2, flood queue length 0

Key line: "No Hellos (Passive interface)"

Verify Network is Still Advertised

Check the OSPF database on another router:

HQ-Router# show ip route ospf
O    192.168.10.0/24 [110/2] via 10.1.1.2, 00:15:23, GigabitEthernet0/0
O    192.168.20.0/24 [110/2] via 10.1.1.2, 00:15:23, GigabitEthernet0/0

✅ Passive networks are advertised, even though they don't send Hellos.

Common Mistakes

Problem:

Router(config-router)# passive-interface gi0/0

(Gi0/0 is the uplink to another OSPF router)

Impact:
OSPF neighbor on Gi0/0 drops. No adjacency = no routes learned.

Symptom:

Router# show ip ospf neighbor
(No neighbors listed)

Fix:

Router(config-router)# no passive-interface gi0/0

Mistake 2: Forgetting to Make Loopbacks Passive

Problem:
Loopbacks are included in OSPF but not made passive.

Impact:
Minimal (loopbacks can't form neighbors anyway), but wastes resources.

Best practice:
Always make loopbacks passive:

Router(config-router)# passive-interface loopback 0

Mistake 3: Using Passive-Default Without Exclusions

Problem:

Router(config-router)# passive-interface default

(No no passive-interface statements)

Impact:
All interfaces are passive. No neighbors form anywhere.

Fix:
Add exclusions for uplinks:

Router(config-router)# no passive-interface gi0/0
Router(config-router)# no passive-interface gi0/1

Passive Interfaces vs Network Statement Exclusion

Question:
"Why not just exclude user VLANs from OSPF network statements?"

Answer:
You could, but then OSPF wouldn't advertise those networks. With passive interfaces:

Example:

Option 1: Exclude from network statement

router ospf 1
 network 10.1.1.0 0.0.0.3 area 0
 ! (192.168.10.0 not included)

❌ Result: Other routers don't know about 192.168.10.0

Option 2: Include but make passive

router ospf 1
 network 10.1.1.0 0.0.0.3 area 0
 network 192.168.10.0 0.0.0.255 area 0
 passive-interface gi0/1

✅ Result: Other routers learn about 192.168.10.0, but gi0/1 doesn't send Hellos

Best Practices

1. Use Passive Interfaces on All User-Facing Networks

Rule:
If there's no OSPF router on the other end, make it passive.

2. Use passive-interface default on Edge Routers

Branch routers, WAN edge routers, and firewalls typically have:

Template:

router ospf 1
 passive-interface default
 no passive-interface [uplink1]
 no passive-interface [uplink2]

3. Always Make Loopbacks Passive

Even if you use passive-interface default, explicitly configure it for clarity:

router ospf 1
 passive-interface loopback 0

4. Document Passive Interfaces

In the config or network documentation, note which interfaces are passive and why.

Example:

! User VLANs - passive for security
passive-interface gi0/1  ! VLAN 10
passive-interface gi0/2  ! VLAN 20

5. Test After Configuration

After making interfaces passive, verify:

Troubleshooting Passive Interface Issues

Problem: Neighbor Won't Form

Symptom:

Router# show ip ospf neighbor
(No neighbor on expected interface)

Cause:
Interface is passive (accidentally or intentionally).

Check:

Router# show ip protocols | include Passive
  Passive Interface(s):
    GigabitEthernet0/0  ← Uplink is passive!

Fix:

Router(config-router)# no passive-interface gi0/0

Problem: Network Not Advertised

Symptom:
Other routers don't have a route to a specific network.

Cause:
Interface is excluded from OSPF entirely (not in a network statement).

Check:

Router# show ip ospf interface brief
Interface    PID   Area            IP Address/Mask    Cost  State Nbrs F/C
Gi0/0        1     0               10.1.1.2/30        1     P2P   1/1
! Gi0/1 missing - not in OSPF

Fix:
Add network statement:

Router(config-router)# network 192.168.10.0 0.0.0.255 area 0
Router(config-router)# passive-interface gi0/1

Summary: Passive Interface Checklist

Now you know:

✅ What passive interfaces do — Advertise networks without sending Hellos
✅ Why they matter — Security and reduced overhead
✅ When to use them — User VLANs, loopbacks, non-OSPF segments
✅ How to configure — Per-interface or default-all
✅ How to verify — show ip protocols, show ip ospf interface
✅ Common mistakes — Making uplinks passive, forgetting loopbacks

Next Step:
Passive interfaces handle security on existing networks. But what if you need to advertise a default route to guide traffic? Read How to Advertise a Default Route in OSPF next.

Screenshot Suggestions:

  1. Topology showing passive (red) vs active (green) interfaces
  2. show ip protocols output highlighting Passive Interface(s) section
  3. show ip ospf interface output showing "No Hellos (Passive interface)"
  4. Before/after: OSPF neighbor table when interface made passive

Internal Links:

Share Share Share Share Share Email

Read next

© 2025 Ping Labz. All rights reserved.