LogoفارسیFA

Hands-On Lab: Configuring the OSPF Passive Interface Manually

This hands-on lab configures a passive interface in OSPF so a LAN-facing interface still advertises its network while no longer sending or accepting OSPF hello packets on it, preventing unnecessary neighbor formation and unauthorized adjacencies on access-layer ports.

OSPF Passive InterfaceSuppress Hello PacketsAccess Port Security

~3 min read · Updated Sep 22, 2026

Lab Objective

Configure a router's LAN-facing interface as passive within OSPF, verify its network is still advertised into the routing domain, and confirm no OSPF hello packets are sent or accepted on that interface afterward.

Lab Purpose

An interface facing an end-user LAN segment has no legitimate OSPF neighbor to form an adjacency with, yet by default OSPF sends hello packets out every network-enabled interface. This wastes bandwidth and, more importantly, creates a security exposure: anyone who plugs a rogue router into that LAN segment could potentially form an unauthorized OSPF adjacency.

Lab Topology

R1
  GigabitEthernet0/0: 192.168.7.1/24 (LAN, end
                       users only, no other routers)
  Serial0/0/0: 10.7.7.1/30 (WAN link to R2,
               legitimate OSPF neighbor)

OSPF process 1 already advertising both networks

Task 1: Verify Both Interfaces Currently Send Hellos

Confirm OSPF hello packets are being sent on both the LAN and WAN interfaces.

Task 2: Configure the LAN Interface as Passive

Set GigabitEthernet0/0 as a passive interface within the OSPF process.

Task 3: Verify the LAN Network Is Still Advertised

Confirm 192.168.7.0/24 still appears in other routers' routing tables despite the interface being passive.

Task 4: Verify Hellos Are Suppressed on the LAN Interface

Confirm no OSPF hello packets are sent or received on the now-passive interface, while the WAN interface continues normally.

Solution and Verification

R1# show ip ospf interface brief

Interface    PID   Area    IP Address/Mask    Cost   State
Gi0/0        1     0       192.168.7.1/24     1      DR
Se0/0/0      1     0       10.7.7.1/30        64     P2P
-- Both interfaces are actively participating,
-- including the LAN interface with no
-- legitimate neighbor to talk to

R1(config)# router ospf 1
R1(config-router)# passive-interface gigabitethernet0/0

R2# show ip route ospf

O    192.168.7.0/24 [110/2] via 10.7.7.1, Serial0/0/0
-- R2 still learns this network correctly --
-- passive interface only suppresses hello
-- packets, it does NOT stop the network from
-- being advertised via the network command,
-- discussed earlier in this series

R1# show ip ospf interface gigabitethernet0/0

GigabitEthernet0/0 is up, line protocol is up
  No Hellos (Passive interface)

R1# show ip ospf interface serial0/0/0

Serial0/0/0 is up, line protocol is up
  Timer intervals configured, Hello 10, Dead 40
-- Confirms the LAN interface has genuinely
-- stopped sending hellos, while the WAN
-- interface continues normal OSPF operation

Key Takeaway

Passive interface is a critical distinction from simply not including a network in OSPF at all: the network is still advertised and reachable, but the interface stops actively participating in neighbor discovery — this combination of "advertise the route, but don't accept neighbors here" is exactly what a LAN-facing access interface needs, and it should be applied as standard practice on every interface with no legitimate OSPF neighbor.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring Standard Numbered ACLs

This hands-on lab configures a standard numbered ACL to permit traffic from a specific subnet while denying everything else, applies it to the correct interface and direction, and verifies both permitted and denied traffic behave as expected.

Continue

Hands-On Lab: Configuring VRRP

This hands-on lab configures VRRP between two routers as the open-standard alternative to HSRP, using a real interface address as the virtual IP, and verifies Master/Backup roles and automatic failover behavior.

Continue

Hands-On Lab: Configure GLBP Redundancy

This hands-on lab configures GLBP between two routers to achieve load balancing across both routers simultaneously, verifying that different hosts receive different virtual MAC addresses and therefore route through different physical gateways.

Continue

Hands-On Lab: Implementing HSRP

This hands-on lab configures HSRP between two routers sharing a virtual gateway address, sets priority and preempt to control which router is active, and verifies automatic failover when the active router fails.

Continue

Hands-On Lab: Verifying the EIGRP Database

This hands-on lab examines the EIGRP topology table directly, identifying the successor and feasible successor for a destination network, and demonstrates how this underlying data explains what appears in the IP routing table.

Continue

Hands-On Lab: Summarizing Routes with EIGRP

This hands-on lab manually configures interface-level route summarization in EIGRP, advertising a single aggregated route instead of several specific subnets, and verifies the automatically created Null0 discard route that prevents summarization-related loops.

Continue
Previous ArticleNext Article