passive-interface [intf]
Configures an OSPF interface as passive, preventing it from sending OSPF hello packets and forming neighbor adjacencies, while still advertising the network.
Definition: passive-interface [intf] is a Cisco IOS router config command. Configures an OSPF interface as passive, preventing it from sending OSPF hello packets and forming neighbor adjacencies, while still advertising the network.
Overview
The `passive-interface` command in OSPF router configuration mode is used to prevent an interface from sending OSPF hello packets and forming neighbor adjacencies, while still allowing the network on that interface to be advertised in OSPF link-state advertisements (LSAs). This is a critical tool for network engineers to optimize OSPF operation, reduce unnecessary protocol overhead, and enhance security. In OSPF, hello packets are used to discover neighbors and maintain adjacencies.
On interfaces where no OSPF neighbor exists (e.g., a loopback interface or a stub network), sending hellos is wasteful and can expose the router to potential attacks. By configuring an interface as passive, the router stops sending hellos and will not attempt to form adjacencies, but the subnet is still included in router LSAs, ensuring reachability. This command is often used on interfaces connected to end hosts, management networks, or other areas where OSPF adjacency is not required.
Alternatives include using `ip ospf network point-to-multipoint` or `ip ospf priority 0` to influence adjacency formation, but passive-interface is the most straightforward method to suppress hellos entirely. In a broader workflow, after enabling OSPF and configuring network statements, engineers should review which interfaces are participating in OSPF and apply passive-interface to those that should not form adjacencies. This is especially important in hub-and-spoke topologies or when connecting to non-OSPF domains.
The command takes effect immediately; the router stops sending hellos on the specified interface, and any existing adjacency is torn down. The running configuration is updated instantly. Privilege level 15 (enable mode) is required to enter global configuration mode.
Note that the `passive-interface default` variant sets all interfaces as passive by default, and then individual interfaces can be enabled with `no passive-interface`. This approach is common in modern OSPF deployments to ensure security and reduce overhead. Understanding this command is essential for CCNA and CCNP candidates as it appears frequently in exam scenarios and real-world network design.
passive-interface [intf]When to Use This Command
- Prevent OSPF neighbor formation on a LAN interface connected to end hosts to reduce unnecessary overhead.
- Secure a management interface by disabling OSPF adjacency while still including its subnet in OSPF updates.
- Optimize OSPF on a hub-and-spoke topology where spoke routers should not form adjacencies with each other.
- Simplify OSPF configuration on a router with many interfaces by using passive-interface default and then selectively enabling on specific interfaces.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| intf | Interface type and number, e.g., GigabitEthernet0/0, Loopback0, Serial0/0/0 | Specifies the interface to be made passive. Valid interface types include GigabitEthernet, FastEthernet, Serial, Loopback, etc. Common mistakes include using an interface that does not exist or forgetting to specify the full interface name (e.g., 'Gi0/0' instead of 'GigabitEthernet0/0'). |
Command Examples
Making a single interface passive
passive-interface GigabitEthernet0/1Router(config-router)# passive-interface GigabitEthernet0/1 Router(config-router)#
No output is generated; the command is applied silently. Use 'show ip ospf interface GigabitEthernet0/1' to verify.
Making all interfaces passive by default and enabling one
passive-interface default
no passive-interface GigabitEthernet0/0Router(config-router)# passive-interface default Router(config-router)# no passive-interface GigabitEthernet0/0 Router(config-router)#
The first command sets all interfaces as passive. The second command overrides for GigabitEthernet0/0, allowing it to form adjacencies.
Understanding the Output
The 'passive-interface' command does not produce direct output. To verify, use 'show ip ospf interface [interface]' and look for 'No Hellos (Passive interface)' in the output. If the interface is passive, you will see that line; otherwise, you will see timer values for hello/dead intervals.
In 'show ip ospf neighbor', a passive interface will not show any neighbors. In 'show ip route ospf', routes from the passive interface's network will still appear if learned via other routers. A common mistake is to forget that passive interfaces still advertise their subnet; they just don't form adjacencies.
Configuration Scenarios
Making a Loopback Interface Passive in OSPF
A loopback interface is often used for router ID or management. It should be advertised in OSPF but should never form an adjacency. This scenario shows how to configure a loopback as passive.
Topology
R1(Lo0: 10.0.0.1/32)---(Gi0/0: 192.168.1.0/30)---R2Steps
- 1.Step 1: Enter global configuration mode: Router> enable
- 2.Step 2: Enter OSPF router configuration: Router# configure terminal
- 3.Step 3: Specify the OSPF process: Router(config)# router ospf 1
- 4.Step 4: Make the loopback interface passive: Router(config-router)# passive-interface Loopback0
- 5.Step 5: Exit and verify: Router(config-router)# end
! Router(config)# router ospf 1 Router(config-router)# passive-interface Loopback0 Router(config-router)# end
Verify: Use 'show ip ospf interface Loopback0' to verify. Expected output includes 'No Hellos (Passive)' indicating the interface is passive.
Watch out: If the loopback interface is not explicitly configured with an IP address in the OSPF network statement, it will not be advertised. Ensure the network is included under router ospf.
Using passive-interface default to Secure All Interfaces
In a multi-access network, you may want to only allow OSPF adjacencies on specific interfaces. Using 'passive-interface default' makes all interfaces passive, then selectively enable adjacencies on needed interfaces.
Topology
R1(Gi0/0: 10.1.1.0/24)---(Gi0/1: 10.1.2.0/24)---R2
R1(Gi0/2: 10.1.3.0/24)---End hostsSteps
- 1.Step 1: Enter OSPF router configuration: Router(config)# router ospf 1
- 2.Step 2: Set all interfaces as passive by default: Router(config-router)# passive-interface default
- 3.Step 3: Enable OSPF on the interface that should form adjacency: Router(config-router)# no passive-interface GigabitEthernet0/0
- 4.Step 4: Verify: Router(config-router)# end
! Router(config)# router ospf 1 Router(config-router)# passive-interface default Router(config-router)# no passive-interface GigabitEthernet0/0 Router(config-router)# end
Verify: Use 'show ip ospf interface brief' to see which interfaces are passive. The output will show 'PASSIVE' for passive interfaces and 'DR/BDR' for active ones.
Watch out: If you forget to enable 'no passive-interface' on the interface connecting to another OSPF router, no adjacency will form. Always verify adjacency with 'show ip ospf neighbor'.
Troubleshooting with This Command
When troubleshooting OSPF adjacency issues, the `passive-interface` command is a common culprit. If a router is not forming a neighbor relationship, check if the interface is configured as passive. Use `show ip ospf interface [interface]` to see the passive status.
Healthy output shows 'Hello due in ...' and 'Neighbor Count is ...'. If the interface is passive, you will see 'No Hellos (Passive)' and 'Neighbor Count is 0'. Another symptom is that the network is advertised in the OSPF database but no neighbor is present.
This can be confirmed with `show ip ospf database` – the prefix will appear as a stub network. To diagnose, first verify the interface status with `show ip ospf interface`. If passive, decide if it should be.
If not, remove the passive configuration with `no passive-interface`. Also check if `passive-interface default` is configured globally; use `show running-config | section router ospf` to see. If the interface is not passive but still no adjacency, check other issues like mismatched area IDs, authentication, or network types.
The `debug ip ospf hello` command can help see if hellos are being sent or received. Correlate with `show ip ospf neighbor` to see if any neighbor is listed. A step-by-step diagnostic flow: 1) `show ip ospf interface` – check passive status and hello timer. 2) `show ip ospf neighbor` – check if any neighbor is seen. 3) `show running-config | include passive-interface` – confirm configuration. 4) If passive, decide to remove or keep. 5) If not passive, check Layer 2 connectivity and OSPF parameters.
Remember that passive interfaces still advertise their subnet, so they appear in the LSDB. This can be useful for loopbacks but problematic for interfaces that should form adjacencies. Always verify with `show ip route ospf` to ensure routes are learned correctly.
CCNA Exam Tips
CCNA exam tip: Passive interfaces still advertise the network in LSAs; they just don't send hellos or form adjacencies.
CCNA exam tip: Use 'passive-interface default' to set all interfaces as passive, then 'no passive-interface' on specific interfaces that need to form adjacencies.
CCNA exam tip: Passive interfaces are commonly used on loopback interfaces or LAN segments with only end devices.
CCNA exam tip: In OSPF, a passive interface will not have any neighbors; verify with 'show ip ospf neighbor'.
Common Mistakes
Mistake 1: Forgetting that passive interfaces still advertise the network; this can cause routing loops if not intended.
Mistake 2: Applying 'passive-interface' to a WAN interface that needs to form an adjacency, breaking OSPF neighbor relationships.
Mistake 3: Using 'passive-interface default' without then enabling necessary interfaces, resulting in no OSPF adjacencies at all.
passive-interface [intf] vs show ip ospf interface
These two OSPF commands are often discussed together because both involve OSPF interfaces, but they serve fundamentally different purposes: one configures interface behavior (preventing neighbor formation) while the other displays operational status and parameters. Understanding their distinction is crucial for effective OSPF troubleshooting and design.
| Aspect | passive-interface [intf] | show ip ospf interface |
|---|---|---|
| Scope | Per-interface configuration | Displays all OSPF interfaces or a specific one |
| Configuration mode | Router config mode (config-router) | Privileged EXEC mode (enable) |
| Persistence | Persistent in running-config | Output only; no configuration change |
| Precedence | Overrides default OSPF behavior on that interface | Reflects current operational state |
| Typical use | Stop OSPF neighbor formation on loopback or WAN interfaces | Verify OSPF parameters, timers, and neighbor status |
| Impact on routing | Network still advertised via LSA | No impact; read-only |
Use passive-interface [intf] when you want to advertise a network via OSPF without forming an adjacency (e.g., on a loopback or broadcast interface connected only to hosts).
Use show ip ospf interface when you need to verify OSPF interface settings, timers, and neighbor state for troubleshooting or auditing.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the `passive-interface` command syntax is identical to classic IOS. However, in NX-OS (e.g., Nexus switches), the equivalent command is `passive-interface [interface]` under `router ospf [process]` but note that NX-OS uses `feature ospf` to enable OSPF first. Also, NX-OS supports `passive-interface default` similarly.
On ASA firewalls, OSPF is supported in routed mode; the command is `passive-interface [interface]` under `router ospf [process]`. There is no significant difference between IOS 12.x, 15.x, and 16.x for this command. In IOS-XR, the command is `passive-interface [interface]` under `router ospf [process]` but note that IOS-XR uses a different configuration hierarchy (e.g., `router ospf [process] area [area-id] interface [interface] passive`).
Always check the specific platform documentation. For CCNA/CCNP, focus on classic IOS syntax as it is the most common in exams.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions