Two routes to the same prefix. One has a metric of 20. The other has a metric of 31. Which one does OSPF install?
If you answered "the one with metric 20", you have just failed a very common CCIE lab question, and you would have been surprised by what our lab actually did. OSPF does not compare metrics first. It compares route types first, and only falls back to the metric to break ties within a type. A worse metric routinely wins.
This article proves the full ordering - O, O IA, E1, N1, E2, N2 - by injecting the same prefix six different ways into a live CML topology and watching each one take over as the previous is removed. For the fundamentals, start at the complete OSPF guide.
The order
Two things about that list are worth pausing on.
Type-1 externals beat type-2 externals. That is because an E1 route's metric incorporates the cost of getting to the ASBR, so OSPF can meaningfully compare two E1 routes to the same destination and pick the closer ASBR. An E2 route's metric is a flat number set by the redistributing router; every router in the domain sees the same value, so OSPF has no basis to prefer one over another and treats them as equivalent regardless of distance. E1 carries more information, so it wins.
E1 beats N1, but N1 beats E2. The type-1/type-2 distinction is the primary split; the E/N distinction only breaks ties inside it. Read the list as "type 1 externals, then type 2 externals, and within each, backbone externals before NSSA externals".
The lab
To see all six, you need a vantage point that can receive all six kinds of LSA. That rules out most routers. An NSSA ABR is the one place it works: it sits in the backbone (so it sees intra-area, inter-area, and Type-5 externals) and it also sits inside an NSSA (so it sees Type-7 externals as N1/N2). Our observer is R4, ABR between area 0 and area 2 (NSSA).
The prefix 172.16.99.0/24 gets injected six ways:
- O - a loopback on R1, inside area 0, with
ip ospf network point-to-pointso the full /24 is advertised rather than a /32. - O IA - the same prefix on a loopback on R3, inside area 1, arriving at R4 as a Type-3 from the ABR.
- E1 / E2 - R2 redistributes a static, switching between
metric-type 1andmetric-type 2. - N1 / N2 - R5, inside the NSSA, redistributes a static, switching metric-type the same way.
The sequence
Stage 1: O wins
R4#show ip route 172.16.99.0
Routing entry for 172.16.99.0/24
Known via "ospf 1", distance 110, metric 11, type intra area
* 10.0.14.1, from 1.1.1.1, via Ethernet0/0Stage 2: shut R1's loopback, O IA takes over
R4#show ip route 172.16.99.0
Routing entry for 172.16.99.0/24
Known via "ospf 1", distance 110, metric 21, type inter area
* 10.0.24.1, from 2.2.2.2, via Ethernet0/2Stage 3: shut R3's loopback, E1 takes over
R4#show ip route 172.16.99.0
Routing entry for 172.16.99.0/24
Known via "ospf 1", distance 110, metric 30, type extern 1
* 10.0.24.1, from 2.2.2.2, via Ethernet0/2Metric 30 = external cost 20 + internal cost 10 to reach the ASBR. That addition is what makes it an E1.
Stage 4: remove R2's redistribution, N1 takes over
R4#show ip route 172.16.99.0
Routing entry for 172.16.99.0/24
Known via "ospf 1", distance 110, metric 31, type NSSA extern 1
* 10.0.45.2, from 5.5.5.5, via Ethernet0/1Stage 5: R5 to metric-type 2, R2 back as metric-type 2. E2 beats N2.
R4#show ip route 172.16.99.0
Routing entry for 172.16.99.0/24
Known via "ospf 1", distance 110, metric 20, type extern 2, forward metric 10
* 10.0.24.1, from 2.2.2.2, via Ethernet0/2Stage 6: remove R2's redistribution, N2 is all that's left
R4#show ip route 172.16.99.0
Routing entry for 172.16.99.0/24
Known via "ospf 1", distance 110, metric 20, type NSSA extern 2, forward metric 11
* 10.0.45.2, from 5.5.5.5, via Ethernet0/1Six route types, six takeovers, in the exact order the RFC specifies.
The proof that type beats metric
The sequence above is tidy but it does not, on its own, prove the central claim - because the metrics happened to be increasing anyway. So we set it up deliberately: an E2 with metric 20 and an N1 with metric 20, both in the database at the same time.
R4#show ip ospf database external 172.16.99.0 | include Advertising|Metric Type|Metric:
Advertising Router: 2.2.2.2
Metric Type: 2 (Larger than any link state path)
Metric: 20
Advertising Router: 4.4.4.4
Metric Type: 1 (Comparable directly to link state metric)
Metric: 20
R4#show ip ospf database nssa-external 172.16.99.0 | include Advertising|Metric Type|Metric:
Advertising Router: 5.5.5.5
Metric Type: 1 (Comparable directly to link state metric)
Metric: 20And the winner:
R4#show ip route 172.16.99.0
Routing entry for 172.16.99.0/24
Known via "ospf 1", distance 110, metric 31, type NSSA extern 1
* 10.0.45.2, from 5.5.5.5, via Ethernet0/1OSPF installed the N1 at a routing metric of 31, and rejected the E2 at 20. The route with the worse metric won, because its type is better. There is no metric comparison across types at all. That is the rule, and there is the evidence.
(Also visible in that output: Advertising Router: 4.4.4.4 in the Type-5 table. That is R4's own Type-7 to Type-5 translation - as the NSSA ABR it re-originates the NSSA's external into the backbone. It does not use its own translation; it uses the original Type-7.)
E1 vs E2: choosing when you redistribute
This is the practical decision the ordering forces on you, and the default is often wrong.
Use when: there is only one ASBR, or all ASBRs are equivalent and you do not care which one traffic uses
Danger: with two ASBRs at very different distances, traffic may prefer the far one
Use when: multiple ASBRs inject the same external and you want each router to use its nearest one
Cost: a slightly larger SPF, and a metric that changes as your IGP does
The rule of thumb: if two or more ASBRs redistribute the same prefixes, use E1. With E2, every router in the domain sees identical metrics and breaks the tie on the forward metric - the internal cost to reach the ASBR or its forwarding address. That mostly does the right thing, but it is a tiebreak rather than a first-class comparison, and it is much harder to reason about. E1 makes the intent explicit.
The E2 tiebreak, visible in the output
Look back at Stages 5 and 6. Both routes have metric 20, and both print a forward metric:
type extern 2, forward metric 10 <-- via R2
type NSSA extern 2, forward metric 11 <-- via R5That forward metric is the tiebreak field. When two E2 routes have the same external metric, OSPF picks the one with the lower cost to the advertising ASBR (or, if there is one, the forwarding address). It is the only thing standing between you and a random choice.
What is not in the comparison
Two things that people expect to matter and do not:
Administrative distance does not break these ties. All OSPF routes carry AD 110, whatever their type. AD only comes into play when comparing OSPF against a different protocol. Inside OSPF, the type ordering is the whole story.
The number of hops does not matter, at all. OSPF has no hop count. A four-hop O IA route beats a one-hop E1 route every time, because inter-area beats external, full stop.
Where this bites in production
The classic outage: a network runs OSPF internally and also redistributes some routes in from BGP or a partner network as E2. Somebody adds a summary or a static that accidentally overlaps an internal prefix and redistributes it. Now the same prefix exists as both an O IA and an E2. The O IA wins, everywhere, regardless of metric. Traffic that should have gone to the partner network is now being routed internally into a black hole. And the E2 route looks perfectly healthy in the LSDB - it is just never selected.
The second classic: mutual redistribution between OSPF and another protocol, where a route leaves OSPF, comes back in as an external, and is now preferred over the internal path on some subset of routers. Route tags exist precisely to prevent this - see the multi-protocol redistribution material under IP routing.
Key takeaways
- The order is O > O IA > E1 > N1 > E2 > N2. Type is compared first; metric only breaks ties within a type.
- We proved it: an N1 at metric 31 beat an E2 at metric 20. A worse metric wins if the type is better.
- E1 metric = external cost + internal cost to the ASBR. E2 metric = external cost only, identical on every router.
- E2 is the default. If more than one ASBR injects the same prefix, use E1 so each router picks its nearest ASBR.
- Equal E2 routes are broken by the forward metric - the internal cost to the ASBR or its forwarding address. It is printed in
show ip route. - An NSSA ABR is the only vantage point that can see all six types at once.
- Administrative distance and hop count play no part in this. AD is 110 for every OSPF route.
- An internal route (O or O IA) will always beat an external one for the same prefix. An accidental overlap between an internal subnet and a redistributed one is a silent black hole.
Next: five broken OSPF scenarios, ticket style. The full cluster index lives on the OSPF pillar guide.
