# OSPF Route Summarization and Filtering

> Chapter 3 of the Courseiva ENARSI curriculum — https://courseiva.com/learn/enarsi/ospf-route-summarization-and-filtering

**Official objective:** 3.2 — Configure and verify OSPF route summarization and filtering

## Introduction

Exam domain 3.2 — 'Configure and verify OSPF route summarisation and filtering' — addresses the single biggest source of inefficiency in large OSPF networks: too much information. Without summarisation and filtering, every router in the network has to know the location of every single subnet, and every routing update is cluttered with useless or dangerous routes. For the 300-410 exam, you must understand not just how to configure these features, but why they're crucial for network stability, convergence speed, and security.

## The City Postal Sorting Office Analogy

A Royal Mail sorting office manager is responsible for ensuring that all post sent to addresses in a large city gets to the right local delivery depot. The city has a central district and several surrounding suburbs.

Without any traffic management, every single postal van from other cities would drive all the way into the central office with a sack filled with every individual letter for every single house in every suburb. The manager would have to open every sack, read every address, and redirect each letter to the correct suburb's depot. The entrance road would be gridlocked with vans, and the sorting floor would be piled high with millions of individual envelopes.

To solve this, the manager instructs all other city sorting offices: do not send individual letters. Instead, organise all letters destined for the entire suburb of, say, 'Manchester M1' into one consolidated sack labelled 'MANCHESTER-M1'. The van driver drops off just one sack per suburb, not thousands of individual letters. This summary reduces traffic by 90%.

But one suburb, 'Manchester M3', has a few streets that are dangerous and often receive parcels addressed with the wrong apartment number. The manager quietly intercepts any sack labelled 'MANCHESTER-M3' and, before letting it through to the delivery route, performs a filter: if a letter has a missing apartment number, it is sent back to the sender with a 'filtered: address incomplete' stamp. Only letters with complete and valid addresses proceed.

Just as the sorting office manager consolidates sacks by suburb and filters out dodgy mail, a network engineer configures OSPF routers to advertise one summary route for many subnets (the consolidated sack) and to filter out specific undesirable routes (the rejected letters).

This analogy maps precisely because both involve summarising many small items into one big chunk (route summarisation) and applying a rule to prevent specific items from reaching their destination (route filtering).

## Core explanation

OSPF, which stands for Open Shortest Path First, is a routing protocol that helps routers share information about how to reach different networks. Think of a network as a giant collection of cities and towns. Each 'route' is like a specific street address — it tells a router exactly where a group of devices lives. In a large organisation with many floors, buildings, and remote offices, there might be hundreds or thousands of these addresses.

Route summarisation is the practice of taking many specific routes and advertising them as one single, larger route. For example, instead of telling every other router about four separate networks — 10.1.0.0/24, 10.1.1.0/24, 10.1.2.0/24, and 10.1.3.0/24 — a summarising router announces just one route: 10.1.0.0/22. This is possible because all four of those networks fit neatly inside the larger 10.1.0.0/22 network block. The /22 part is what's called the 'prefix length' — it tells you how many bits of the IP address are the network portion versus the 'host' (device) portion.

Why does this matter? First, it dramatically reduces the size of the routing table — the list of all destinations that a router has to remember. Fewer routes means less memory used and less CPU time needed to calculate the best path. Second, it makes the network more stable. If one of those smaller networks goes down and comes back up, the rest of the network never sees that fluctuation — they only see the summary route, which stays up as long as at least one of the smaller networks is reachable. This prevents what engineers call 'route flapping', where routers keep sending updates back and forth about a route that keeps changing state.

Route filtering, on the other hand, is about choosing which routes to accept, advertise, or send. You might want to filter a route because it points to a network that should be kept secret (like a data centre that only internal staff should reach), or because it's a route for a network that you know doesn't exist or shouldn't be used. OSPF filters can be applied in several ways:

- Using a 'distribute-list', which is a rule that checks incoming or outgoing routing updates against an 'access control list' (ACL) — essentially a list of permit or deny statements for IP addresses.

- Using 'route maps', which are more flexible and can also change the properties of a route, not just block or allow it.

- Using an 'area filter list', which filters routes that cross the boundary between different OSPF areas (areas are logical groupings of routers in a large OSPF network).

The exam tests both configuration and verification. Verification means using commands like 'show ip ospf database' and 'show ip route' to confirm that the summary or filter is working as intended. You'll need to check that the summary route appears in the routing table instead of the individual routes, and that filtered routes do not appear.

A critical detail: summarisation in OSPF is only configured on what's called an 'ABR' (Area Border Router) or an 'ASBR' (Autonomous System Boundary Router). ABRs sit between different OSPF areas, and ASBRs sit between OSPF and another routing protocol (or the outside internet). Interfaces that are not on these boundary routers cannot perform route summarisation.

In summary, OSPF route summarisation and filtering are the two main tools for controlling the flow of routing information. Summarisation makes the network faster and quieter by grouping routes; filtering keeps out unwanted or dangerous routes. Together, they ensure that a large OSPF network stays stable, secure, and efficient.

## Real-world context

In a typical enterprise networking role, you don't just learn OSPF theory — you actually build and troubleshoot the routing for a whole company. Let's say you work for 'MegaCorp', which has headquarters in London, a branch office in Manchester, and a data centre in Birmingham. The network uses OSPF in a single area for simplicity, but the routing tables are growing out of control because every server and printer in each location has its own subnet — 50 subnets in London, 30 in Manchester, and 100 in Birmingham.

Step one: you log into the router at the London HQ. You look at the routing table using the command 'show ip route ospf'. You see lists of routes like 10.10.10.0/24, 10.10.11.0/24, 10.10.12.0/24 … all the way up to 10.10.59.0/24 for London alone. That's 60 separate routes just for London! Your boss asks why the routers keep crashing during peak hours. The problem is that every routing update contains all 180 routes, and the routers' CPU and memory are overloaded.

Step two: you plan route summarisation. You notice that all the London subnets fall within 10.10.0.0/16. You configure the London router — which is an ABR because it connects to the WAN link to Manchester and Birmingham — to summarise all London routes into that one summary. You use the command 'area 0 range 10.10.0.0 255.255.0.0' on the London router. Now, instead of advertising 60 routes to the other routers, London sends just one.

Step three: you've been told that the Birmingham data centre contains a sensitive finance server on subnet 10.20.5.0/24 that should never be reachable from the internet. But the existing OSPF configuration is flooding that route everywhere. You need to filter it. On the Birmingham router, you create an access control list that permits all routes except 10.20.5.0. Then you apply a distribute-list 'in' on the interface that connects to the outside world. This tells OSPF to discard any route that matches that subnet before it appears in the routing table.

Step four: verify your work. You run 'traceroute' from a test machine in London to confirm you can still reach the other Birmingham subnets but not 10.20.5.0. You also calculate the size of the routing table before and after summary. It shrunk from 180 routes to 3 summary routes (one per location) plus the filtered finance route being absent.

What tools and commands does a professional actually use?
- 'show ip ospf database summary' to see the summary routes in the OSPF link-state database.
- 'show ip route ospf' to see what routes are actually installed.
- 'show access-lists' and 'distribute-list' specific commands to confirm filters.
- 'debug ip ospf events' carefully in a lab (never in production without change control) to see if routes are being filtered correctly.

Professionals also document every summarisation and filter rule, because two years later someone will ask, 'Why doesn't route X show up?' and without documentation, you might have to trace the whole chain of filters again.

## Exam focus

For the 300-410 exam, 'OSPF Route Summarisation and Filtering' appears in configuration, verification, and troubleshooting scenarios. The exam expects you to know both 'inter-area' summarisation (using the 'area range' command on an ABR) and 'external' summarisation (using the 'summary-address' command on an ASBR). They will test you on the exact syntax, and the trick is often in the subtle differences.

Exam concepts to memorise:
- The 'area range' command summarises routes within an area (inter-area). Syntax: 'area [area-id] range [network] [mask] [advertise | not-advertise]'. The 'not-advertise' option is a form of filtering — it tells the ABR to suppress the summary route entirely.
- The 'summary-address' command summarises routes that are redistributed from another protocol into OSPF (external). Syntax: 'summary-address [network] [mask] [not-advertise] [tag value]'. The 'tag' option is used for route-maps later.
- Route filtering can be done with 'distribute-list' (applied to an interface or to the OSPF process) or with 'filter-list' (applied to an OSPF area using prefix-lists). The exam loves to ask which method is valid where.

Common exam traps:
- They'll give you a scenario where summarisation should be applied at an ABR but the config uses 'summary-address' instead of 'area range'. That's wrong — 'summary-address' is only for external routes.
- They'll give you a 'distribute-list' that filters 'in' but the router has no 'out' rule where one is needed. Memorise: distribute-list 'in' filters routes that the router receives; distribute-list 'out' filters routes the router sends. Mixing them up loses marks.
- They'll ask what happens if two overlapping summary routes exist. The answer is that the most specific (longest prefix) wins when both are present.
- They'll test your understanding of 'filter-list' vs 'distribute-list'. Filter-list uses a prefix-list and only works on ABRs; distribute-list uses an ACL and works on any OSPF router.
- They'll set up a scenario where a route is learned via OSPF but also directly connected. The directly connected route always takes priority because of administrative distance, not filtering.

Question types:
- Multiple-choice: 'Which command applies external route summarisation?' Options include 'area range' (trap) and 'summary-address' (correct).
- Simlet: You are given a partially configured router and a set of requirements. You must click the correct commands in a command-line interface simulator.
- Drag-and-drop: Match OSPF summarisation features to the correct router type (ABR or ASBR).
- Troubleshooting scenario: 'Router A should filter routes from Area 1 but they are still appearing. What command shows you the filter list status?' The answer is 'show ip ospf filter-list'.

To pass, you must practise until you can write 'area 1 range 172.16.0.0 255.255.0.0' from memory and explain why external summarisation needs 'summary-address' instead. Know the difference between 'not-advertise' (which suppresses the summary) and not configuring anything at all (which advertises the summary). Traps love to swap those two conditions.

## Step by step

1. **Identify the router role** — Determine if the router is an ABR (connects to two or more OSPF areas) or an ASBR (connects to a different routing protocol). Only these can perform summarisation. Internal routers cannot summarise OSPF routes.
2. **Choose the correct command** — If the router is an ABR, use 'area [area-id] range [network] [mask]' to summarise intra-area routes. If it is an ASBR, use 'summary-address [network] [mask]' to summarise external routes. Using the wrong command will cause the summarisation to not work.
3. **Apply optional filtering with 'not-advertise'** — If you want to suppress the summary route (i.e., not advertise it to other areas or protocols), add the 'not-advertise' keyword. This is a common exam configuration task — you must know when to use it versus when to leave it out.
4. **Verify the summary in the routing table** — Use 'show ip route' on the summarising router and on a neighbouring router to confirm that the summary route appears in place of the individual routes. On the summarising router, you will still see individual routes in the routing table for its own area, but neighbours should see only the summary.
5. **Configure a distribute-list filter** — If you need to filter a specific route rather than summarise, create an access control list (ACL) that permits or denies the target network. Then apply a 'distribute-list [acl-name] [in | out] [interface-name]' under the OSPF process. The direction must match whether you want to filter incoming or outgoing updates.
6. **Verify the filter is working** — Use 'show ip route' to confirm the filtered route is absent from the routing table. Also use 'show ip ospf database' to verify that the route still appears in the OSPF database (because filters do not remove from the database, only from the RIB).

## Comparisons

### Inter-area summarisation (area range) vs External summarisation (summary-address)

**Inter-area summarisation (area range):**
- Configured on ABRs only.
- Summarises routes that originate within a single OSPF area.
- Uses the 'area [id] range [network] [mask]' command.

**External summarisation (summary-address):**
- Configured on ASBRs only.
- Summarises routes redistributed from another routing protocol.
- Uses the 'summary-address [network] [mask]' command.

### Distribute-list (interface-level) vs Filter-list (area-level)

**Distribute-list (interface-level):**
- Applied to a specific interface or to the OSPF process globally.
- Can use standard or extended ACLs.
- Filters routes being installed into the routing table (RIB).

**Filter-list (area-level):**
- Applied to an OSPF area using a prefix-list.
- Only works on ABRs.
- Filters routes that cross area boundaries in the link-state database (LSDB).

### Route summarisation vs Route filtering

**Route summarisation:**
- Combines multiple routes into one summary route.
- Reduces the number of routes in routing updates.
- Configured at area or redistribution boundaries.

**Route filtering:**
- Selectively blocks or permits specific routes.
- Does not change the number of routes, it removes them.
- Can be applied at any point (inbound or outbound).

### Prefix-list vs Access Control List (ACL)

**Prefix-list:**
- Specifically designed for filtering IP routes (prefixes).
- Matches on the network and prefix length.
- Ordered automatically from most specific to least specific.

**Access Control List (ACL):**
- General-purpose traffic filter for packets and routes.
- Matches on source/destination IP, protocol, and port.
- Processed in sequential order (top-down).

## Diagram

_This diagram shows how ABRs summarise routes from their connected areas into the backbone, while ASBRs summarise external routes, and how a distribute-list can filter specific routes before they are installed._

```mermaid
graph LR
    A[OSPF Area 1] -->|'area range'| B[ABR]
    B -->|Summary route 10.1.0.0/22| C[Area 0 Backbone]
    C --> D[ABR Area 2]
    D -->|Summary 10.2.0.0/22| E[Area 2]
    F[External Network] -->|Redistribution| G[ASBR]
    G -->|'summary-address'| C
    H[Distribute-list] -.->|Filters route| C
```

## Common misconceptions

- **Misconception:** Route summarisation eliminates the original individual routes from the OSPF database entirely. **Reality:** Summarisation only stops the advertisement of the individual routes out of the area. The individual routes still exist in the link-state database of the routers within the area. The summarising router (ABR/ASBR) still has them, it just doesn't tell neighbours about them individually. (Beginners think 'summarised' means 'deleted', but OSPF keeps full topological knowledge inside an area for fast convergence. Summarisation is an advertising filter, not a deletion.)
- **Misconception:** Route filtering with 'distribute-list in' also prevents the router from learning the route via its own OSPF database updates. **Reality:** 'distribute-list in' only prevents the route from being installed into the router's routing table (RIB). The route still appears in the OSPF link-state database (LSDB) and can still be used for SPF calculations within the area. It just won't be used for forwarding. (People confuse the routing table (RIB) with the OSPF database (LSDB). OSPF filters operate at the point where the LSDB entries are considered for the RIB, not before they enter the LSDB.)
- **Misconception:** You can summarise routes on any OSPF router, regardless of its position in the network. **Reality:** Only ABRs (Area Border Routers) can perform inter-area summarisation using 'area range', and only ASBRs (Autonomous System Boundary Routers) perform external summarisation using 'summary-address'. An internal router (non-ABR, non-ASBR) cannot summarise OSPF routes. (The exam specifically tests that summarisation is a boundary function. Beginners assume any router can summarise because they've seen summary commands in labs where the router happens to be an ABR.)
- **Misconception:** Filtering a route with a 'distribute-list' will also stop the router from sending that route to its neighbours. **Reality:** It depends on whether you apply it 'in' or 'out'. A 'distribute-list in' affects routes being received; a 'distribute-list out' affects routes being sent. Applying 'in' does not stop the router from sending the route — it only stops it from being received. (The direction keyword is often overlooked in study materials. Students assume 'distribute-list' always blocks the route, but the direction is critical.)
- **Misconception:** Route summarisation automatically fixes routing loops and convergence issues. **Reality:** Route summarisation can sometimes mask routing problems because it hides the flapping of individual subnets. It does not fix underlying routing loops — those must be addressed with proper area design and route filtering separately. (People think summarisation is a silver bullet for all OSPF problems, but it is primarily a scalability tool, not a troubleshooting tool for loops.)

## Key takeaways

- Route summarisation reduces the size of OSPF routing updates and routing tables, improving network stability and convergence speed.
- Only ABRs can use the 'area range' command for inter-area summarisation; only ASBRs use 'summary-address' for external summarisation.
- The 'not-advertise' keyword in both 'area range' and 'summary-address' suppresses the summary route entirely, acting as a summary-level filter.
- Distribute-lists filter routes from being installed into the routing table (RIB) but do not remove them from the OSPF link-state database (LSDB).
- Always match the direction of a distribute-list ('in' versus 'out') to the desired filtering action — they are not interchangeable.
- Verification commands such as 'show ip route', 'show ip ospf database', and 'show access-lists' are essential to confirm that summarisation and filtering are correctly applied.

## FAQ

**What is the difference between 'area range' and 'summary-address' in OSPF?**

'area range' summarises routes inside a specific OSPF area and is configured on an ABR. 'summary-address' summarises external routes redistributed into OSPF and is configured on an ASBR. Using the wrong one on the wrong router type will not work.

**Does route summarisation increase or decrease CPU usage on routers?**

Route summarisation decreases CPU usage because the router has to process fewer routing updates and run a smaller SPF calculation. However, configuring it incorrectly (e.g., overlapping summaries) can increase CPU due to extra checking.

**Can I filter OSPF routes without using a distribute-list?**

Yes, you can also use a 'filter-list' with a prefix-list on an ABR, or use a route-map with a distribute-list. The 'filter-list' is applied within an area using the 'area [id] filter-list prefix [name] [in|out]' command.

**What happens if I apply a distribute-list 'in' on an interface that receives both OSPF and directly connected routes?**

The distribute-list 'in' only affects routes learned via OSPF on that interface. Directly connected routes are not affected because they are learned locally, not via OSPF updates.

**Why does my summary route not appear in the routing table after I configure 'area range'?**

This can happen if the individual routes being summarised are not all present in the ABR's routing table, or if there is a prefix overlap causing the router to prefer a more specific route instead. Check that all subnets are being generated and that the mask is correct.

**Is there a performance benefit to filtering routes that are already summarised?**

Yes, because filtering can remove unwanted routes from the summarised block, reducing the risk of routing loops and unnecessary forwarding. However, it is generally better to fix the source of unwanted routes rather than filter them at multiple points.

## Check your understanding

1. **Which command is used on an ABR to summarise routes from Area 1 into the backbone?**

   Answer: The 'area 1 range [network] [mask]' command is used.

2. **What keyword can be added to 'area range' or 'summary-address' to stop the summary route from being advertised?**

   Answer: The keyword is 'not-advertise'.

3. **If a distribute-list 'in' is applied, does the filtered route still remain in the OSPF link-state database?**

   Answer: Yes, the route remains in the LSDB and is still used for SPF calculations, but it is not installed into the routing table.

4. **You need to summarise redistributed routes from an external protocol into OSPF on a router. Which command should you use?**

   Answer: You should use the 'summary-address [network] [mask]' command on the ASBR.

5. **What is the difference between 'distribute-list in' and 'distribute-list out' regarding the direction of filtering?**

   Answer: 'distribute-list in' filters routes that the router receives; 'distribute-list out' filters routes that the router sends.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/enarsi/ospf-route-summarization-and-filtering