passive-interface [intf]
Prevents RIP updates from being sent out a specific interface while still allowing the interface to receive updates.
Definition: passive-interface [intf] is a Cisco IOS router config command. Prevents RIP updates from being sent out a specific interface while still allowing the interface to receive updates.
Overview
The `passive-interface` command in RIP configuration mode is used to prevent RIP updates from being sent out a specified interface while still allowing the interface to receive RIP updates. This command is essential for controlling RIP advertisement boundaries, especially in hub-and-spoke topologies or when connecting to networks that should not receive dynamic routing updates. By default, RIP sends updates out all interfaces enabled for RIP.
The `passive-interface` command suppresses outgoing updates on a per-interface basis, which helps reduce unnecessary routing traffic, improve security by preventing route leaks, and conserve bandwidth. It is commonly used on interfaces facing stub networks, loopback interfaces, or links to non-RIP devices. Alternatives include using distribute lists or route maps to filter updates, but `passive-interface` is simpler and more direct.
In the broader configuration workflow, this command is typically applied after enabling RIP on interfaces, and it does not affect the interface's ability to learn routes from incoming updates. The command takes effect immediately and is stored in the running configuration. It requires privilege level 15 (enable mode) to configure.
Note that `passive-interface` only suppresses outgoing RIP updates; incoming updates are still processed. This behavior is important for troubleshooting, as a passive interface can still receive and install RIP routes. The command is available in all IOS versions and is a fundamental tool for RIP route control.
passive-interface [intf]When to Use This Command
- On a LAN interface where no other RIP routers exist, to reduce unnecessary broadcast traffic.
- On a loopback interface to avoid advertising the loopback network via RIP.
- On an interface connected to a stub network to prevent routing updates from being sent to hosts.
- On an interface where you want to receive RIP updates but not participate in sending them.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| intf | Interface type and number (e.g., GigabitEthernet0/0, Serial0/0/0) | Specifies the interface on which to suppress RIP updates. Valid values include any router interface (physical or subinterface). Common mistakes include using an interface that is not enabled for RIP, or forgetting that the command only affects outgoing updates. Ensure the interface exists and is up. |
Command Examples
Make GigabitEthernet0/1 passive for RIP
passive-interface GigabitEthernet0/1router rip version 2 network 192.168.1.0 passive-interface GigabitEthernet0/1 no auto-summary
The command is entered in router config mode. The output shows the running configuration for RIP, including the passive-interface statement. This means RIP updates will not be sent out GigabitEthernet0/1, but the router will still listen for RIP updates on that interface.
Make all interfaces passive and then enable specific ones
passive-interface default
no passive-interface Serial0/0/0router rip version 2 network 10.0.0.0 passive-interface default no passive-interface Serial0/0/0 no auto-summary
The 'passive-interface default' command sets all interfaces as passive. Then 'no passive-interface Serial0/0/0' re-enables sending RIP updates only on Serial0/0/0. This is useful when you want to send updates only on WAN links.
Understanding the Output
The output is typically part of the running configuration. Look for 'passive-interface' lines under the router rip configuration. Each line specifies an interface that will not send RIP updates.
The 'passive-interface default' command makes all interfaces passive, and subsequent 'no passive-interface' commands override that for specific interfaces. In 'show ip protocols' output, you can see a list of passive interfaces under 'Passive Interface(s):'. If an interface is passive, it will not appear in the list of interfaces sending updates.
A good configuration ensures that only necessary interfaces send updates to prevent unnecessary traffic and potential routing loops.
Configuration Scenarios
Suppress RIP updates on a loopback interface
A router has a loopback interface used for management or router ID purposes. RIP should not advertise this loopback to neighbors to avoid unnecessary routing entries and potential routing loops.
Topology
R1(Lo0: 10.0.0.1/32)---(Gi0/0: 192.168.1.0/30)---R2Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Enter RIP configuration mode: router rip
- 3.Step 3: Enable RIP on the loopback interface: network 10.0.0.0
- 4.Step 4: Suppress updates on loopback0: passive-interface loopback0
- 5.Step 5: Exit configuration mode: end
! router rip version 2 network 10.0.0.0 passive-interface loopback0 !
Verify: Use 'show ip rip database' to verify that the loopback route is present but not advertised. Use 'debug ip rip' on a neighbor to confirm no updates are received for the loopback prefix.
Watch out: If the loopback is not included in a 'network' statement, RIP will not advertise it anyway, but using 'passive-interface' ensures it remains silent even if added later.
Prevent RIP updates on a hub-and-spoke spoke interface
In a hub-and-spoke topology, the hub router should not send RIP updates to spoke routers to avoid unnecessary traffic and potential routing loops. Spokes should only receive updates from the hub.
Topology
Hub(Gi0/0: 10.0.1.0/30)---Spoke1
Hub(Gi0/1: 10.0.2.0/30)---Spoke2Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Enter RIP configuration mode: router rip
- 3.Step 3: Enable RIP on the interfaces: network 10.0.0.0
- 4.Step 4: Suppress updates on spoke-facing interfaces: passive-interface gigabitethernet0/0 and passive-interface gigabitethernet0/1
- 5.Step 5: Exit configuration mode: end
! router rip version 2 network 10.0.0.0 passive-interface gigabitethernet0/0 passive-interface gigabitethernet0/1 !
Verify: On the hub, use 'show ip protocols' to see which interfaces are passive. On spokes, use 'show ip route rip' to confirm they receive routes from the hub. Use 'debug ip rip' on the hub to verify no updates are sent out passive interfaces.
Watch out: If the hub also needs to send updates to other routers (e.g., another hub), do not make those interfaces passive. Also, passive interfaces still receive updates, so spokes can still send updates to the hub if they are not passive.
Troubleshooting with This Command
When troubleshooting RIP issues, the `passive-interface` command is often a suspect if routes are missing or updates are not being sent. Healthy output from 'show ip protocols' will list passive interfaces under 'Passive Interface(s):'. If an interface is incorrectly configured as passive, no RIP updates will be sent out that interface, causing neighbors to not learn routes.
Conversely, if an interface should be passive but is not, unnecessary updates may be sent, wasting bandwidth. To diagnose, first verify the passive interface list with 'show ip protocols'. Then check if the expected routes are present on neighbors using 'show ip route rip'.
If routes are missing, ensure the interface is not passive if updates should be sent. Use 'debug ip rip' to see actual update activity; a passive interface will show no outgoing updates. Also check that the interface is enabled for RIP via a 'network' statement.
Common symptoms include: a neighbor not learning routes from a router, or a router receiving routes but not advertising them. The diagnostic flow: 1) Identify the interface in question. 2) Check 'show ip protocols' for passive status. 3) If passive and updates are needed, remove the passive-interface command. 4) If not passive but updates are not sent, check other filters (distribute-list, route-map). 5) Verify the interface is up/up and has an IP address in the RIP network range. Correlate with 'show ip interface brief' and 'show running-config | section router rip'.
The `passive-interface` command does not affect incoming updates, so if a router is not receiving routes, look elsewhere (e.g., neighbor configuration, network statements).
CCNA Exam Tips
Remember that passive-interface only stops sending updates, not receiving them.
In RIP, passive-interface is commonly used on LAN segments to reduce broadcast traffic.
The 'passive-interface default' command is a CCNA exam favorite for simplifying configuration.
Be aware that passive-interface does not affect the interface's ability to advertise its own network; it only stops sending RIP updates.
Common Mistakes
Assuming passive-interface stops both sending and receiving updates — it only stops sending.
Forgetting to apply 'no passive-interface' on WAN links after using 'passive-interface default'.
Applying passive-interface to a loopback interface unnecessarily, though it is harmless.
passive-interface [intf] vs show ip protocols
The 'passive-interface' command configures a router to suppress routing updates on an interface, while 'show ip protocols' displays the operational state of routing processes. They are often paired during troubleshooting or configuration verification, as one controls update behavior and the other confirms the applied settings.
| Aspect | passive-interface [intf] | show ip protocols |
|---|---|---|
| Scope | Affects only the specified interface for a single routing protocol. | Displays parameters for all running IP routing protocols globally. |
| Configuration mode | Router configuration mode (e.g., router rip). | Privileged EXEC mode (enable). |
| Persistence | Persists in running-config; takes effect immediately. | Displays current runtime state; no persistence. |
| Precedence | Overrides default behavior of sending updates on that interface. | Shows network statements, passive interfaces, and filters configured. |
| Typical use | Suppress RIP advertisements on a LAN interface to reduce overhead. | Verify which interfaces are passive or verify protocol timers. |
Use passive-interface [intf] when you need to prevent RIP from sending updates on a specific interface while still receiving updates from neighbors.
Use show ip protocols when you need to verify the operational status of routing protocols, including passive interfaces, timers, and redistribution filters.
Platform Notes
In IOS-XE, the `passive-interface` command syntax is identical to classic IOS. However, in NX-OS, the equivalent command is `passive-interface` under `router rip` but the syntax is slightly different: `passive-interface [default] {interface-type number}`. NX-OS also supports the `default` keyword to make all interfaces passive by default.
In ASA, RIP is not commonly used; if needed, the command is `passive-interface` under `router rip` but ASA uses a different configuration model. In IOS-XR, RIP is not supported; instead, use OSPF or ISIS. For IOS versions, the command has remained consistent from 12.x through 16.x.
There are no significant output differences. Note that in some older IOS versions, the command may not be available for subinterfaces; always check the documentation for your specific version.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions