Lab Objective
Configure a router's LAN-facing interface as passive within OSPF, verify its network is still advertised into the routing domain, and confirm no OSPF hello packets are sent or accepted on that interface afterward.
Lab Purpose
An interface facing an end-user LAN segment has no legitimate OSPF neighbor to form an adjacency with, yet by default OSPF sends hello packets out every network-enabled interface. This wastes bandwidth and, more importantly, creates a security exposure: anyone who plugs a rogue router into that LAN segment could potentially form an unauthorized OSPF adjacency.
Lab Topology
R1
GigabitEthernet0/0: 192.168.7.1/24 (LAN, end
users only, no other routers)
Serial0/0/0: 10.7.7.1/30 (WAN link to R2,
legitimate OSPF neighbor)
OSPF process 1 already advertising both networksTask 1: Verify Both Interfaces Currently Send Hellos
Confirm OSPF hello packets are being sent on both the LAN and WAN interfaces.
Task 2: Configure the LAN Interface as Passive
Set GigabitEthernet0/0 as a passive interface within the OSPF process.
Task 3: Verify the LAN Network Is Still Advertised
Confirm 192.168.7.0/24 still appears in other routers' routing tables despite the interface being passive.
Task 4: Verify Hellos Are Suppressed on the LAN Interface
Confirm no OSPF hello packets are sent or received on the now-passive interface, while the WAN interface continues normally.
Solution and Verification
R1# show ip ospf interface brief
Interface PID Area IP Address/Mask Cost State
Gi0/0 1 0 192.168.7.1/24 1 DR
Se0/0/0 1 0 10.7.7.1/30 64 P2P
-- Both interfaces are actively participating,
-- including the LAN interface with no
-- legitimate neighbor to talk toR1(config)# router ospf 1
R1(config-router)# passive-interface gigabitethernet0/0R2# show ip route ospf
O 192.168.7.0/24 [110/2] via 10.7.7.1, Serial0/0/0
-- R2 still learns this network correctly --
-- passive interface only suppresses hello
-- packets, it does NOT stop the network from
-- being advertised via the network command,
-- discussed earlier in this seriesR1# show ip ospf interface gigabitethernet0/0
GigabitEthernet0/0 is up, line protocol is up
No Hellos (Passive interface)
R1# show ip ospf interface serial0/0/0
Serial0/0/0 is up, line protocol is up
Timer intervals configured, Hello 10, Dead 40
-- Confirms the LAN interface has genuinely
-- stopped sending hellos, while the WAN
-- interface continues normal OSPF operationKey Takeaway
Passive interface is a critical distinction from simply not including a network in OSPF at all: the network is still advertised and reachable, but the interface stops actively participating in neighbor discovery — this combination of "advertise the route, but don't accept neighbors here" is exactly what a LAN-facing access interface needs, and it should be applied as standard practice on every interface with no legitimate OSPF neighbor.