OSPF version 2 and version 3 are link-state routing protocols that let a collection of routers automatically build a detailed, identical map of the network and then calculate the shortest, loop-free path to every destination. Unlike older protocols that simply gossip about rough distances and hope for the best, OSPF floods reliable, structured reports so every router makes the same decision. For someone studying the 350-401 ENCOR exam, OSPF is the backbone routing protocol inside virtually every enterprise campus and data centre, and the exam expects you to configure, verify and troubleshoot OSPF adjacencies, network types and areas without hesitation.
Jump to a section
A simple way to picture OSPFv2 and OSPFv3 Implementation
The residents’ committee in a sprawling apartment complex is the neighbourhood’s central intelligence hub. When a resident spots a broken lock, a suspicious car or a burst pipe, they don’t shout into the void—they report it to the committee secretary. The secretary takes the report, writes a short summary and distributes copies to every other committee member in the complex, who then note it on their own personal map of problems. Because every member has the same complete map, any one of them can immediately plot the fastest route to avoid the burst pipe without asking anyone else.
The complex is split into cores (a low-rise block, a mid-rise block) to stop a single secretary drowning in reports. Each core elects its own head secretary (a Designated Router) and a deputy (Backup Designated Router) to collect and share reports for that core. The head secretary only trades full binders with the deputies of other cores, passing a concise digest to their own core’s residents. When a plumbing issue spans cores, a special border liaison officer (Area Border Router) recaps the situation so no resident needs to carry the entire city’s floorplan in their head. This precise, elected, map-sharing system is exactly how OSPFv2 and OSPFv3 keep a network’s routers aligned.
OSPF, which stands for Open Shortest Path First, is a link-state routing protocol. A routing protocol is the language routers use to tell each other about the networks they can reach. The ‘link-state’ part means each router describes the state of its directly connected links—interfaces and their neighbours—and then floods that information to every other router inside its area. An area is a logical grouping of routers and links that keeps the map small enough to be recalculated quickly. All routers in the same area end up with an identical copy of that area’s map, called the link-state database (LSDB). Once the LSDB is synchronised, each router runs the Dijkstra Shortest Path First (SPF) algorithm, a mathematical routine that finds the lowest-cost path to every network, and the result is installed as the routing table.
OSPF version 2 (OSPFv2) works with IPv4 addresses, while OSPF version 3 (OSPFv3) supports IPv6. They share the same fundamental principles but differ in important implementation details. OSPFv2 exchanges hellos and link-state advertisements (LSAs) using the IPv4 subnet address of the sending interface and optionally authenticates messages with clear-text or MD5/SHA passwords inserted in each packet. OSPFv3 uses IPv6 link-local addresses—special addresses valid only on a single link that start with fe80::—for neighbour discovery and floods LSAs with a separate ‘OSPFv3’ header that does not embed authentication natively; instead it relies on IPv6’s built-in IPsec (Authentication Header or Encapsulating Security Payload) for integrity and confidentiality.
To form a neighbour relationship, two OSPF routers must agree on several parameters: the subnet and the area number configured on the link, matching hello and dead timers, and, on multi-access networks, a consistent network type. A network type defines how OSPF behaves on a particular medium. The four classic OSPF network types are:
Broadcast (default on Ethernet): elects a Designated Router (DR) and a Backup Designated Router (BDR) to reduce the number of full adjacencies; hello timer 10 seconds, dead timer 40 seconds.
Point-to-point (serial links, GRE tunnels): no DR/BDR election; faster convergence; hello timer 10 seconds, dead timer 40 seconds.
Non-broadcast (Frame Relay, generic routing encapsulation with manual neighbour statements): requires static neighbour configuration; still elects a DR/BDR.
Point-to-multipoint: treats the network as a collection of point-to-point links; no DR/BDR; hello timer 30 seconds, dead timer 120 seconds.
On a broadcast network, the DR and BDR election follows a simple rule. The router with the highest OSPF priority (1 by default) becomes the DR; the second highest becomes the BDR. A priority of 0 removes the router from the election entirely. When priorities tie, the highest router ID—a 32-bit number usually derived from the highest loopback IP address—breaks the tie. All other routers on the link are DROthers and only form a full adjacency with the DR and BDR, exchanging LSAs solely with those two. This arrangement ensures that on a shared Ethernet with 20 routers, the total number of full adjacencies stays manageable, not the 190 pairs that would otherwise be needed.
OSPF supports a hierarchy of areas to control the size of the LSDB and the frequency of SPF recalculations. Area 0, the backbone, must be contiguous and connect all other areas. Routers that sit between areas are Area Border Routers (ABRs); they take LSAs from one area, condense them into summary LSAs and inject them into the other area. An Autonomous System Boundary Router (ASBR) connects the OSPF domain to an external routing source, such as a different routing protocol or a static default route, and injects external LSAs.
The step-by-step process of building an adjacency passes through rigorous states. It begins with Down, moves to Init when the first hello is received, then to 2-Way when bi-directional communication is confirmed and the DR/BDR election occurs. Next comes ExStart, where master-slave roles are negotiated for database description packets, followed by Exchange, where each side sends a summary of its LSDB. In the Loading state the routers request any missing LSAs, and finally the Full state indicates that both routers have a completely synchronised LSDB.
Why does all this matter? Without OSPF, every static route would have to be hand-crafted on every device, an impossible task in networks with hundreds of subnets. OSPF automates convergence: when a link fails, the detecting router floods a new LSA, and within seconds every router recalculates its best path, keeping applications reachable.
Down
The router has not received a hello from the neighbour. All adjacency information is cleared, and no DR/BDR election takes place. This is the starting point before any communication.
Init
A hello packet arrives from the neighbour, but the local router’s own router ID is not yet listed in the received hello. The router transitions to Init and starts sending its own hellos, but the neighbour is still only one-sided.
2-Way
Both routers see each other’s router ID in the received hellos, confirming bi-directional communication. On broadcast and non-broadcast networks, the DR and BDR are elected during this state. DROthers only advance beyond this state with the DR and BDR.
ExStart
The routers negotiate master/slave roles and agree on the initial Database Description sequence number. No LSA data is exchanged yet; this state ensures that the subsequent Exchange phase uses a controlled, reliable transfer.
Exchange
Routers send Database Description packets that list the content of their LSDBs. Each side compares the list with its own database and, if any newer or missing LSAs are detected, creates a request list for the next state. This is where MTU mismatches often cause a hang.
Loading
The router sends Link State Request packets for each missing LSA and the neighbour replies with Link State Update packets containing the full LSA data. Once all requested LSAs are received, the adjacency moves toward Full. This state can be prolonged if the network is flaky or the LSAs are very large.
Full
Both routers have completely synchronised LSDBs for the area. The adjacency is fully formed, and the routers can now run the SPF algorithm and populate their routing tables. This is the desired end state for a stable OSPF neighbour relationship.
An IT professional deploying a new three-floor office will typically implement OSPF across the building’s distribution and access switches. The core switch stack is placed in Area 0. Each floor forms its own non-backbone area—Floor 2 becomes Area 10, Floor 3 Area 20—terminating on distribution switches that act as ABRs. The engineer logs into the core switch and configures router ospf 1, then adds network statements that match the IP subnets of the core and distribution links, ensuring they fall into Area 0. For each floor’s distribution switch, the same OSPF process is started, but the VLAN interfaces facing access switches are placed into the floor’s area with a network statement that includes the appropriate area ID.
Next, the engineer tweaks the OSPF interface priority on the core-to-floor VLAN to guarantee the floor’s distribution switch becomes the DR and the core the BDR, avoiding unnecessary re-elections after a power cycle. They also set all access-switch interfaces connecting to user PCs as passive—no OSPF hellos need to be sent to endpoints, and active hellos on those ports create useless noise and a small security risk. The engineer verifies the configuration with show ip ospf neighbour to confirm that each floor’s ABR has reached Full state with the core and that the expected DR/BDR roles are correct.
A common real-world troubleshooting step is checking for mismatched timers. Suppose the network team recently changed a point-to-point fibre link between floors to a new Ethernet service that uses broadcast timers while the OSPF network type was left as point-to-point. The hellos arrive but the dead timer values differ, so the adjacency flaps. The engineer spots it with show ip ospf interface, corrects the network type to point-to-point, and the adjacency stabilises. Another daily task is introducing a new floor. The engineer assigns a new area number, configures the ABR accordingly, and then verifies that the summary LSA for the new area appears in Area 0 with show ip ospf database summary. Throughout, they keep a constant eye on the routing table to ensure no sub-optimal path has been learned.
For OSPFv3 in a dual-stack or IPv6-only environment, the same workflow applies, but the commands change to ipv6 router ospf 1 and the interfaces are enabled directly with ipv6 ospf 1 area 10. The engineer must remember that OSPFv3 peers use link-local addresses, so they check the neighbour table with show ipv6 ospf neighbour and verify that the neighbour ID (still a 32-bit number) is associated with a link-local address. If they need authentication, they apply an IPsec policy to the interface, not a simple password, because OSPFv3 removes the built-in authentication field.
The 350-401 ENCOR exam tests OSPFv2 and OSPFv3 with a blend of configuration tasks, troubleshooting scenarios and conceptual questions. Expect to be asked to identify why an adjacency is stuck in a particular state, to select the correct network type for a given WAN technology, and to interpret the output of show ip ospf neighbour and show ip ospf interface. The exam loves to present a scenario where two routers have everything configured but simply won’t become neighbours, and the answer often hinges on a subtle mismatch in timers, MTU, subnet mask or area ID.
Key topics that appear repeatedly in the question pool include:
Adjacency states: you must recognise the meaning of DOWN, INIT, 2-WAY, EXSTART, EXCHANGE, LOADING and FULL. A question may ask what state two routers are in if they keep getting stuck after DR/BDR election, which points to EXSTART or EXCHANGE (likely MTU mismatch).
DR/BDR election: expect to calculate which router becomes DR given a list of priority and router-ID values. Remember that a priority of 0 takes a router out of the election and that if a DR already exists, a new router with a higher priority will not pre-empt the current DR.
Network types: you must map the correct type to the link technology, know the default hello/dead timers for each, and recognise that changing the network type changes whether a DR/BDR is elected. A classic trap shows a point-to-point serial link configured as broadcast and asks what must be adjusted to form an adjacency; the answer is often that a DR must be elected, but the real fix is to change the network type.
OSPFv3 specifics: questions often highlight that OSPFv3 neighbours are identified by router ID, not IP address, and that they communicate using IPv6 link-local addresses. A configuration task may ask you to enable OSPFv3 on an interface and include the area ID directly, since there is no network statement in the traditional sense.
LSA types: the exam expects you to recognise the role of Type 1 (Router LSA), Type 2 (Network LSA – generated by DR), Type 3 (Summary LSA between areas), Type 4 (ASBR Summary), Type 5 (External LSA) and Type 7 (NSSA external). Interpret the output of show ip ospf database to spot which LSAs an area is receiving.
Authentication: for OSPFv2, plain-text and MD5/SHA authentication are configured per interface or globally. For OSPFv3, you must apply IPsec policies under the interface, not a simple key.
Common exam trap patterns include: offering an answer that changes the dead timer but not the hello timer when the adjacency is failing (the correct fix is to match both); presenting a loopback address that changes the router ID after an adjacency is already formed (router ID is fixed until the process is reset); and confusing the meaning of the ‘area range’ command (used on ABRs for inter-area summarisation) with the ‘summary-address’ command (used on ASBRs for external routes). To score well, practise reading show commands quickly, memorise the default timers per network type, and understand the strict rules that govern adjacency formation.
OSPF is a link-state protocol, meaning every router in an area holds an identical map of that area’s topology and independently calculates the shortest path.
Before two OSPF routers become fully adjacent, they must pass through eight distinct operational states: Down, Init, 2-Way, ExStart, Exchange, Loading, and Full.
On multi-access broadcast networks, a Designated Router and Backup Designated Router are elected to reduce the total number of full adjacencies.
The DR/BDR election is non-pre-emptive; once elected, a new router with a higher priority will not take over the role until the current DR becomes unavailable.
OSPFv3 separates the routing protocol from the authentication mechanism, relying on IPv6 IPsec instead of the plain-text or MD5/SHA passwords embedded within OSPFv2 packets.
Network types (broadcast, point-to-point, non-broadcast, point-to-multipoint) control hello and dead timers and whether a DR/BDR is elected, so a mismatched network type prevents adjacency formation.
Areas partition the OSPF domain to limit the size of the link-state database and the frequency of SPF calculations, with Area 0 acting as the mandatory backbone.
Verification commands such as show ip ospf neighbour, show ip ospf interface, and show ip ospf database are the first tools an engineer reaches for when troubleshooting OSPF issues.
These come up on the exam all the time. Here's how to tell them apart.
OSPFv2
Uses IPv4 addresses in hello and LSA payloads.
Authentication fields (clear-text or MD5/SHA) are built into the OSPF header.
Network statement under router ospf process is mandatory.
OSPFv3
Uses IPv6 link-local addresses for neighbour discovery and LSA flooding.
Authentication relies on IPv6 IPsec (AH/ESP) applied to interfaces.
Interfaces are enabled directly with ipv6 ospf area, with no network statements.
Broadcast Network Type
Elects a DR and BDR to limit adjacencies.
Default hello timer 10 seconds, dead timer 40 seconds.
Typical for Ethernet multi-access segments.
Point-to-Point Network Type
No DR/BDR election; neighbours form a 1-to-1 adjacency.
Default hello timer also 10 seconds, dead 40 seconds.
Used on serial point-to-point links, GRE tunnels, and PPP connections.
Designated Router (DR)
Forms full adjacencies with all routers on the segment.
Generates the Type 2 Network LSA on behalf of the broadcast link.
The single router responsible for initial LSA synchronisation on the multi-access link.
Backup Designated Router (BDR)
Also forms full adjacencies with all routers on the segment.
Listens passively but takes over DR duties if the current DR fails.
Does not generate the Network LSA while the DR is active.
Area 0 (Backbone)
Must be contiguous and directly connect all other areas.
Receives summary LSAs from ABRs and can hold external routes.
All inter-area traffic must traverse Area 0.
Non-Backbone Area
Can be stub, totally stubby, NSSA or normal.
Relies on Area 0 for connectivity to other areas.
Does not require direct adjacency to every other non-backbone area.
Mistake
OSPFv3 is simply OSPFv2 with IPv6 addresses pasted on top.
Correct
OSPFv3 is a separate protocol with its own LSA formats; it uses IPv6 link-local addresses for neighbour discovery, removes the built-in authentication field in favour of IPsec, and can carry multiple address families.
Many beginners assume version numbers just mean ‘v6 support’, but the internal packet structure and configuration syntax differ so fundamentally that treating them as identical leads to broken configurations.
Mistake
On a broadcast network, the router with the highest OSPF priority always becomes the DR.
Correct
If a DR already exists, a new router with a higher priority will not pre-empt the current DR unless the DR fails. Additionally, a router with priority 0 is never elected DR or BDR.
The non-pre-emptive election process trips up newcomers because they expect a dynamic takeover, similar to HSRP, but OSPF elections are stable and use a strict, on-link election procedure.
Mistake
All OSPF routers inside an area share exactly the same link-state database.
Correct
Routers in the same area have identical LSDBs for that area, but ABRs have separate databases per area and also contain summary LSAs. The overall database across the whole autonomous system is not identical on every router.
Beginners conflate ‘identical intra-area LSDB’ with ‘identical entire-OSPF-domain LSDB’, which causes confusion when interpreting show ip ospf database on an ABR.
Mistake
If a hello packet is not received within the dead interval, the neighbour relationship drops immediately.
Correct
The dead interval is a countdown timer; if no hello is received within that time, the router waits until the timer expires before declaring the neighbour down. The adjacency does not vanish the instant a single hello is missed.
Movies and analogies often depict instant failure, but real OSPF uses a hold-down timer, and missing one hello on a 10-second network does not break the adjacency until four missing hellos have accumulated.
Mistake
OSPF areas are only needed in very large networks.
Correct
Even a modest network with 20 routers benefits from areas because they contain the scope of SPF recalculations and limit the impact of an unstable router flooding LSAs.
Many study materials claim that areas exist only for scalability, but they also provide fault isolation and faster convergence, making area design relevant sooner than learners anticipate.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
OSPFv2 works with IPv4 and embeds authentication inside the OSPF header. OSPFv3 supports IPv6, uses link-local addresses for neighbour adjacencies, removes built-in authentication in favour of IPsec, and provides a more flexible LSA structure that can carry multiple address families.
OSPFv3 neighbours communicate using their IPv6 link-local addresses (starting fe80::). The neighbor table shows the neighbour’s router ID and the link-local address, not the global unicast IPv6 address. Use show ipv6 ospf neighbour to see these details.
The router with the highest OSPF priority (default 1) on the subnet becomes the DR; the second highest becomes the BDR. A priority of 0 excludes a router from the election. If priorities are equal, the highest router ID breaks the tie. Election happens during the 2-Way state and is non-pre-emptive.
Broadcast and point-to-point networks use hello 10 seconds, dead 40 seconds. Non-broadcast networks use hello 30 seconds, dead 120 seconds. Point-to-multipoint networks also use 30/120 seconds by default, and point-to-multipoint non-broadcast uses the same. Mismatched timers block adjacency formation.
A stub area is an area that does not allow external LSAs (Type 5). It replaces them with a default summary route from the ABR, which greatly reduces the LSDB size and SPF runtime. It is used in branch areas that only need a default route to reach external networks.
No, OSPFv3 removed the authentication fields that OSPFv2 had. You must apply an IPsec security policy (Authentication Header or Encapsulating Security Payload) on the interface or in the OSPFv3 process to obtain authentication and encryption, which is a more secure design.
You've finished OSPFv2 and OSPFv3 Implementation. Continue through the 350-401 ENCOR study guide to build a complete picture of the exam.
Done with this chapter?