OSPF Forwarding Address of AS External Routes

OSPF Forwarding Address of AS External Routes

An AS External-LSA (type 5) carries a field called the forwarding address. When it is 0.0.0.0, packets for that external destination are sent to the ASBR that advertised the LSA. When it is non-zero, they are sent straight to that address, without going through the ASBR.

This article checks in RFC 2328 what the forwarding address is for and how route calculation treats it, and then confirms on real hardware when IOS XR puts a non-zero value in it. Type 5 LSAs in general and the difference between E1 and E2 are covered in OSPF External Routes.

What it is for

Section 2.3 of RFC 2328 uses an example in which only one ASBR on a shared segment exchanges BGP with a router that does not run OSPF.

To deal with this situation, the OSPF protocol allows an AS boundary router to specify a “forwarding address” in its AS-external-LSAs. In the above example, Router RT7 would specify RTX’s IP address as the “forwarding address” for all those destinations whose packets should be routed directly to RTX. (RFC 2328 Section 2.3)

When other OSPF routers sit on the same segment, without this field they take an extra hop through the ASBR. With the forwarding address set, they can send the traffic to the external router directly.

RFC 2328 says only that a non-zero value “should point to a router belonging to another Autonomous System” (footnote 24). When to put a non-zero value there is left to the implementation.

How route calculation treats it

Step (3) of Section 16.4 defines the handling of the forwarding address.

If the forwarding address is set to 0.0.0.0, packets should be sent to the ASBR itself. (…) If the forwarding address is non-zero, look up the forwarding address in the routing table. The matching routing table entry must specify an intra-area or inter-area path; if no such path exists, do nothing with the LSA and consider the next in the list. (RFC 2328 Section 16.4 (3))

A non-zero forwarding address comes with two consequences: it has to resolve to an intra-area or inter-area path, and the cost used in step (4) is the distance to the forwarding address, not to the ASBR. If it points to something reachable only by an external route, the LSA is not used at all.

When two routers originate the same route

Section 12.4.4.1 defines what happens when two ASBRs originate LSAs with the same destination, cost and non-zero forwarding address.

If two routers, both reachable from one another, originate functionally equivalent AS-external-LSAs (i.e., same destination, cost and non-zero forwarding address), then the LSA originated by the router having the highest OSPF Router ID is used. The router having the lower OSPF Router ID can then flush its LSA. (RFC 2328 Section 12.4.4.1)

Routing is the same whichever router advertises it, so the rule exists to keep the link state database smaller.

When IOS XR puts a non-zero value in it

IOS XR (XRd 26.1.1) uses the next-hop address of the redistributed route as the forwarding address. On real hardware the conditions turned out to be these three, which the lab checks in this order.

The third one follows from the rule for route calculation. A point-to-multipoint interface puts only the /32 of its own address in the Router-LSA rather than the subnet of the segment, so other routers cannot resolve the forwarding address. Since an address that cannot be resolved only makes the LSA unusable, 0.0.0.0 is the behaviour that works.

Lab verification

Lab setup

R1, R2, R3 and X, an external router that does not run OSPF, share one LAN (10.0.123.0/24). Only R1 has a static route for 192.0.2.0/24 (next hop 10.0.123.100, which is X) and redistributes it. R4, behind R2, is the observation point.

The cost-50 detour between R1 and R4 is there so that R1 stays connected even when its LAN side is made passive or taken out of OSPF. From R4, X is at a distance of 11 through R2 and 51 through R1.

Steps

The forwarding address is filled in (STEP 1)

This is the type 5 LSA as R4 sees it right after R1 starts redistributing.

RP/0/RP0/CPU0:R4#show ospf database external 192.0.2.0
Tue Sep 22 16:38:55.137 UTC


            OSPF Router with ID (4.4.4.4) (Process ID 1)

		Type-5 AS External Link States

  Routing Bit Set on this LSA
  LS age: 313
  Options: (No TOS-capability, DC)
  LS Type: AS External Link
  Link State ID: 192.0.2.0 (External Network Number)
  Advertising Router: 1.1.1.1
  LS Seq Number: 80000001
  Checksum: 0x1bd4
  Length: 36
  Network Mask: /24
	Metric Type: 2 (Larger than any link state path)
	TOS: 0 
	Metric: 20 
	Forward Address: 10.0.123.100
	External Route Tag: 0

It was originated by R1 (1.1.1.1) and the forwarding address holds X’s address 10.0.123.100. R4 looks that address up in its routing table.

RP/0/RP0/CPU0:R4#show route 10.0.123.0/24
Tue Sep 22 16:38:53.786 UTC

Routing entry for 10.0.123.0/24
  Known via "ospf 1", distance 110, metric 11, type intra area
  Installed Sep 22 16:18:47.770 for 00:20:06
  Routing Descriptor Blocks
    10.0.24.2, from 3.3.3.3, via GigabitEthernet0/0/0/0
      Route metric is 11
  No advertising protos. 

It resolves to an intra-area path (type intra area), which satisfies the condition in Section 16.4 (3). The cost of 11 on this entry is the distance used to calculate the external route.

Here is R4’s entry for 192.0.2.0/24 and a traceroute to it.

RP/0/RP0/CPU0:R4#show route 192.0.2.0/24
Tue Sep 22 16:38:53.149 UTC

Routing entry for 192.0.2.0/24
  Known via "ospf 1", distance 110, metric 20, type extern 2
  Installed Sep 22 16:33:43.895 for 00:05:09
  Routing Descriptor Blocks
    10.0.24.2, from 1.1.1.1, via GigabitEthernet0/0/0/0
      Route metric is 20
  No advertising protos. 

RP/0/RP0/CPU0:R4#traceroute 192.0.2.1 source 4.4.4.4 timeout 1 probe 3 maxttl 4
Tue Sep 22 16:35:49.692 UTC

Type escape sequence to abort.
Tracing the route to 192.0.2.1

 1  10.0.24.2 6 msec  5 msec  5 msec 
 2  10.0.123.100 29 msec  *  15 msec 

RP/0/RP0/CPU0:R2#traceroute 192.0.2.1 source 2.2.2.2 timeout 1 probe 3 maxttl 4
Tue Sep 22 16:35:36.267 UTC

Type escape sequence to abort.
Tracing the route to 192.0.2.1

 1  10.0.123.100 20 msec  *  8 msec 

RP/0/RP0/CPU0:R3#traceroute 192.0.2.1 source 3.3.3.3 timeout 1 probe 3 maxttl 4
Tue Sep 22 16:35:42.749 UTC

Type escape sequence to abort.
Tracing the route to 192.0.2.1

 1  10.0.123.100 8 msec  *  8 msec 

R4 goes through 10.0.24.2 (R2) and the next hop is already X. R2 and R3, on the same LAN, reach X in a single hop. None of them goes through R1, the ASBR.

This is the Link State Update that crossed the LAN. It is No.4 in the attached capture (R1 - LAN in STEP 1).

    LS Update Packet
        Number of LSAs: 1
        LSA-type 5 (AS-External-LSA (ASBR)), len 36
            .000 0000 0000 0001 = LS Age (seconds): 1
            0... .... .... .... = Do Not Age Flag: 0
            Options: 0x20, (DC) Demand Circuits
                0... .... = DN: Not set
                .0.. .... = (O) Opaque: Not set
                ..1. .... = (DC) Demand Circuits: Supported
                ...0 .... = (L) LLS Data block: Not Present
                .... 0... = (N) NSSA: Not supported
                .... .0.. = (MC) Multicast: Not capable
                .... ..0. = (E) External Routing: Not capable
                .... ...0 = (MT) Multi-Topology Routing: No
            LS Type: AS-External-LSA (ASBR) (5)
            Link State ID: 192.0.2.0
            Advertising Router: 1.1.1.1
            Sequence Number: 0x80000001
            Checksum: 0x1bd4
            Length: 36
            Netmask: 255.255.255.0
            1... .... = External Type: Type 2 (metric is larger than any other link state path)
            .000 0000 = TOS: 0
            Metric: 20
            Forwarding Address: 10.0.123.100
            External Route Tag: 0

The LSA is 36 bytes long and the forwarding address is a 4-byte field holding the same value the show command printed.

Making it passive gives 0.0.0.0 (STEP 2)

The LAN side of R1 was set to passive enable.

RP/0/RP0/CPU0:R1#show configuration commit changes last 1
Tue Sep 22 16:40:07.129 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
router ospf 1
 area 0
  interface GigabitEthernet0/0/0/0
   passive enable
  !
 !
!
end

RP/0/RP0/CPU0:R4#show ospf database external 192.0.2.0
Tue Sep 22 16:45:23.746 UTC


            OSPF Router with ID (4.4.4.4) (Process ID 1)

		Type-5 AS External Link States

  Routing Bit Set on this LSA
  LS age: 318
  Options: (No TOS-capability, DC)
  LS Type: AS External Link
  Link State ID: 192.0.2.0 (External Network Number)
  Advertising Router: 1.1.1.1
  LS Seq Number: 80000002
  Checksum: 0xe7f0
  Length: 36
  Network Mask: /24
	Metric Type: 2 (Larger than any link state path)
	TOS: 0 
	Metric: 20 
	Forward Address: 0.0.0.0
	External Route Tag: 0

The forwarding address is now 0.0.0.0, so packets go to R1, the ASBR.

RP/0/RP0/CPU0:R4#traceroute 192.0.2.1 source 4.4.4.4 timeout 1 probe 3 maxttl 4
Tue Sep 22 16:42:13.853 UTC

Type escape sequence to abort.
Tracing the route to 192.0.2.1

 1  10.0.14.1 7 msec  5 msec  50 msec 
 2  10.0.123.100 11 msec  *  10 msec 

R4 first reaches R1 (10.0.14.1, the cost-50 detour) and R1 hands the packet to X. Making the interface passive also removes the adjacencies on the LAN, which is why the detour is used here. Either way, one extra hop through the ASBR has appeared.

Point-to-multipoint also gives 0.0.0.0 (STEP 3)

Passive was removed and the LAN side of R1, R2 and R3 was set to point-to-multipoint.

RP/0/RP0/CPU0:R1#show configuration commit changes last 1
Tue Sep 22 16:46:34.480 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
router ospf 1
 area 0
  interface GigabitEthernet0/0/0/0
   network point-to-multipoint
   no passive enable
  !
 !
!
end

RP/0/RP0/CPU0:R4#show ospf database external 192.0.2.0
Tue Sep 22 16:52:59.985 UTC


            OSPF Router with ID (4.4.4.4) (Process ID 1)

		Type-5 AS External Link States

  Routing Bit Set on this LSA
  LS age: 774
  Options: (No TOS-capability, DC)
  LS Type: AS External Link
  Link State ID: 192.0.2.0 (External Network Number)
  Advertising Router: 1.1.1.1
  LS Seq Number: 80000002
  Checksum: 0xe7f0
  Length: 36
  Network Mask: /24
	Metric Type: 2 (Larger than any link state path)
	TOS: 0 
	Metric: 20 
	Forward Address: 0.0.0.0
	External Route Tag: 0

The adjacencies are up, but the forwarding address stays 0.0.0.0. Looking the LAN addresses up on R4:

RP/0/RP0/CPU0:R4#show route 10.0.123.0/24
Tue Sep 22 16:52:58.646 UTC

% Network not in table
RP/0/RP0/CPU0:R4#show route 10.0.123.100/32
Tue Sep 22 16:52:58.845 UTC

% Network not in table

Neither resolves, because a point-to-multipoint interface does not put the subnet in the Router-LSA. Even if 10.0.123.100 were in the forwarding address, the LSA would not satisfy Section 16.4 (3) and would not be used.

An interface that is not in OSPF (STEP 4)

The network type was reverted and the LAN side of R1 was taken out of OSPF.

RP/0/RP0/CPU0:R1#show configuration commit changes last 1
Tue Sep 22 16:54:24.665 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
router ospf 1
 area 0
  no interface GigabitEthernet0/0/0/0
 !
!
end

RP/0/RP0/CPU0:R4#show ospf database external 192.0.2.0
Tue Sep 22 17:00:38.150 UTC


            OSPF Router with ID (4.4.4.4) (Process ID 1)

		Type-5 AS External Link States

  Routing Bit Set on this LSA
  LS age: 1232
  Options: (No TOS-capability, DC)
  LS Type: AS External Link
  Link State ID: 192.0.2.0 (External Network Number)
  Advertising Router: 1.1.1.1
  LS Seq Number: 80000002
  Checksum: 0xe7f0
  Length: 36
  Network Mask: /24
	Metric Type: 2 (Larger than any link state path)
	TOS: 0 
	Metric: 20 
	Forward Address: 0.0.0.0
	External Route Tag: 0

0.0.0.0 again. R1 still holds the LAN address, but since that interface is not in OSPF it is not used as a forwarding address.

Two routers originating the same LSA (STEP 5)

The LAN side of R1 was put back into OSPF, and R2 was given the same static route and told to redistribute it.

RP/0/RP0/CPU0:R2#show configuration commit changes last 1
Tue Sep 22 17:01:58.392 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
router static
 address-family ipv4 unicast
  192.0.2.0/24 10.0.123.100
 !
!
router ospf 1
 redistribute static
!
end

This is what the two LSAs did on the R1 - R4 link. The columns are time, source, advertising router, sequence number, LS age and forwarding address.

2026-09-23T02:01:50.801048000+0900	10.0.14.1	1.1.1.1	0x80000003	1	10.0.123.100
2026-09-23T02:01:51.793437000+0900	10.0.14.4	1.1.1.1,1.1.1.1	0x8000000a,0x80000003	1,1	
2026-09-23T02:01:57.598710000+0900	10.0.14.4	2.2.2.2	0x80000001	2	10.0.123.100
2026-09-23T02:01:57.921569000+0900	10.0.14.1	1.1.1.1	0x80000004	3600	10.0.123.100
2026-09-23T02:01:59.602586000+0900	10.0.14.1	2.2.2.2,2.2.2.2	0x80000001,0x8000000b	2,2	
2026-09-23T02:01:59.925625000+0900	10.0.14.4	1.1.1.1,1.1.1.1,3.3.3.3	0x80000004,0x8000000b,0x80000002	3600,1,2	

On line 3, R2 (2.2.2.2) originates its own LSA with the same destination, cost and forwarding address. 0.32 seconds later, on line 4, R1 sends its own LSA (1.1.1.1, sequence number 0x80000004) with LS age 3600. R1, which has the lower router ID, withdrew it, exactly as Section 12.4.4.1 describes.

R1 no longer holds a type 5 LSA of its own:

RP/0/RP0/CPU0:R1#show ospf database external self-originate
Tue Sep 22 17:04:52.900 UTC


            OSPF Router with ID (1.1.1.1) (Process ID 1)

RP/0/RP0/CPU0:R4#show ospf database external 192.0.2.0
Tue Sep 22 17:07:50.280 UTC


            OSPF Router with ID (4.4.4.4) (Process ID 1)

		Type-5 AS External Link States

  Routing Bit Set on this LSA
  LS age: 354
  Options: (No TOS-capability, DC)
  LS Type: AS External Link
  Link State ID: 192.0.2.0 (External Network Number)
  Advertising Router: 2.2.2.2
  LS Seq Number: 80000001
  Checksum: 0xfcee
  Length: 36
  Network Mask: /24
	Metric Type: 2 (Larger than any link state path)
	TOS: 0 
	Metric: 20 
	Forward Address: 10.0.123.100
	External Route Tag: 0

R4 holds only R2’s LSA. The forwarding address is the same, so traffic still takes the path it took while R1 was the originator.

Design notes

• To make the forwarding address work, keep the interface holding the next hop in OSPF and do not make it passive. If the point of making it passive is to avoid an adjacency with the external router, note that the forwarding address is lost with it
• The external router’s address has to resolve to an intra-area or inter-area path. If it only resolves through a static route or BGP, the LSA is not used in the calculation

Configurations and show outputs

In each STEP, the following files were collected from all five routers, one file per router. The configuration used in the lab is the ..._run.txt file (the final state is the one of the last STEP).

There is no commit.cfg for STEPs and routers whose configuration did not change. The final state matches the initial one: no router redistributes 192.0.2.0/24.

STEP 0: Initial state (nothing redistributed)

STEP 1: R1 redistributes 192.0.2.0/24

STEP 2: The LAN side of R1 is made passive

STEP 3: The LAN side is set to point-to-multipoint

STEP 4: The LAN side of R1 is taken out of OSPF

STEP 5: R1 is put back and R2 redistributes the same route

STEP 6: Everything back to the defaults (final state)

Packets were captured per STEP on the R1 side of the LAN and on the R1 - R4 link.

References

Related articles

• What is OSPF
• OSPF Router ID
• OSPF Packet Types and Header Format
• OSPF Authentication
• OSPF Neighbor States
• OSPF Options Field
• OSPF DR and BDR
• OSPF Network Types
• OSPF Cost (Metric)
• OSPF Equal-Cost Multi-Path (ECMP)
• OSPF External Routes (Redistributing Static Routes)
• OSPF RFC1583 Compatibility (External Route Selection Rules)
• OSPF Forwarding Address of AS External Routes
• OSPF Multiple Areas and the ABR
• OSPF Virtual Links
• OSPF Stub and Totally Stubby Areas
• OSPF NSSA and Totally NSSA
• OSPF Default Route
• OSPF Route Summarization
• OSPF LSAs and the LSA Header
• OSPF Hello and Dead Intervals
• OSPF Convergence Timers (SPF / LSA Throttling)
• OSPF LSA Refresh and Pacing
• OSPF router-LSA (type 1)
• OSPF network-LSA (type 2)
• OSPF summary-LSA (type 3)
• OSPF ASBR summary-LSA (type 4)
• OSPF AS external-LSA (type 5)
• OSPF NSSA External-LSA (Type 7)