OSPF NSSA and Totally NSSA

What an NSSA is for

Stub and totally stubby areas showed one of the restrictions of a stub area on real devices: a stub area cannot hold an ASBR. The redistribution command commits happily, but not a single AS External-LSA (type 5) is generated.

In practice it is common to want exactly that: no external routes inside the area, except for the one router in it that connects to something outside. The NSSA (not-so-stubby area) resolves the contradiction. A dedicated LSA, type 7, carries the external route inside the area, and an ABR converts it into a type 5 on the way out.

Term	Description
NSSA	An area that keeps type 5 out (the stub property) yet can carry the external routes of an ASBR inside it as type 7
NSSA External-LSA (type 7)	The LSA for an external route originated by an ASBR inside the NSSA. It travels only inside that area
P bit (Propagate)	A bit in the Options field of a type 7 LSA. When set, an ABR may convert it into a type 5
Translator ABR	The ABR that converts type 7 into type 5. When there are several, the one with the highest router ID is elected
Totally NSSA	An NSSA that also blocks type 3. The name is Cisco’s

This article makes area 2 of a seven-router, three-area lab an NSSA and then a totally NSSA, to see on real devices where a type 7 turns into a type 5, what happens when the translator ABR goes away, and how an NSSA’s default route differs from a stub area’s.

Type 7 versus type 5

Item	Type 5 (AS external)	Type 7 (NSSA external)
How far it travels	The whole AS (except stub areas and NSSAs)	Only inside that NSSA
Originated by	The ASBR that brought the route in	An ASBR inside the NSSA
Forwarding address	May be `0.0.0.0`	Must be non-zero when the P bit is set
P bit	None	Present; says whether an ABR may convert it
How `show route` shows it	`O E1` / `O E2`	`O N1` / `O N2`

Inside an NSSA the external routes of an ASBR travel as type 7 and stop at the ABR. Since other areas cannot see them that way, the ABR rebuilds them as type 5 LSAs and floods those into the backbone. That is the translation.

Lab topology

The three-area lab of the stub area article is reused with one addition: R13, an internal router of area 2, also redistributes a static route. That makes two ASBRs — R1 in area 1 and R13 in area 2 — so a single lab shows both “type 5 arriving from outside” and “type 7 leaving from inside”.

Item	Content
Area 1	R1’s Loopback0 and the R1 - R2 link. R1 is an ASBR redistributing `192.168.1.0/24`
Area 0	The Loopback0 of R2, R3 and R4, plus R2 - R3 and R2 - R4
Area 2	The Loopback0 of R11, R12 and R13, plus R3 - R11, R4 - R12, R11 - R13 and R12 - R13. This is the area that becomes an NSSA
ABR	R2 (area 1 to 0), R3 and R4 (area 0 to 2). R3 and R4 are the translator candidates
ASBR inside the NSSA	R13, redistributing `192.168.13.0/24` with `192.168.13.1/32` on Loopback1
Observation points	R13 (from inside the NSSA) and R1 / R2 (from outside)
Link cost	Cost 1 everywhere, except the R4 - R12 link at `cost 10` on both ends
Network type	`network point-to-point` on every link. No DR/BDR is elected and no Network-LSA (type 2) has to be generated

R13 show running-config (the router ospf 1 part, at boot)
router ospf 1
 router-id 13.13.13.13
 redistribute static
 area 2
  interface Loopback0
   passive enable
  !
  interface GigabitEthernet0/0/0/0
   network point-to-point
  !
  interface GigabitEthernet0/0/0/1
   network point-to-point
  !
 !
!

The normal-area starting point (STEP 0)

Before the area becomes an NSSA, the route R13 redistributes is an ordinary type 5 that floods the whole AS. From R1 in area 1, 192.168.13.0/24 arrives as type extern 2 advertised by 13.13.13.13, R13 itself.

STEP 0 R1 show route, ping and traceroute (before the NSSA)
RP/0/RP0/CPU0:R1#show route 192.168.13.0/24
Mon Sep  7 14:41:31.645 UTC

Routing entry for 192.168.13.0/24
  Known via "ospf 1", distance 110, metric 20, type extern 2
  Installed Sep  7 14:39:16.133 for 00:02:15
  Routing Descriptor Blocks
    10.0.12.2, from 13.13.13.13, via GigabitEthernet0/0/0/0
      Route metric is 20
  No advertising protos. 
RP/0/RP0/CPU0:R1#ping 192.168.13.1 source 1.1.1.1
Mon Sep  7 14:41:31.804 UTC
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.13.1 timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 14/14/17 ms
RP/0/RP0/CPU0:R1#traceroute 192.168.13.1 source 1.1.1.1
Mon Sep  7 14:41:32.943 UTC

Type escape sequence to abort.
Tracing the route to 192.168.13.1

 1  10.0.12.2 6 msec  5 msec  5 msec 
 2  10.0.23.3 8 msec  7 msec  7 msec 
 3  172.16.3.11 11 msec  12 msec  10 msec 
 4  10.1.11.13 21 msec  *  16 msec 

R13 likewise has R1’s 192.168.1.0/24 as a type 5.

STEP 0 R13 show route ospf (normal area)
RP/0/RP0/CPU0:R13#show route ospf
Mon Sep  7 14:44:15.136 UTC

O IA 1.1.1.1/32 [110/5] via 10.1.11.11, 00:04:59, GigabitEthernet0/0/0/0
O IA 2.2.2.2/32 [110/4] via 10.1.11.11, 00:05:09, GigabitEthernet0/0/0/0
O IA 3.3.3.3/32 [110/3] via 10.1.11.11, 00:05:09, GigabitEthernet0/0/0/0
O IA 4.4.4.4/32 [110/5] via 10.1.11.11, 00:05:03, GigabitEthernet0/0/0/0
O IA 10.0.12.0/24 [110/4] via 10.1.11.11, 00:05:09, GigabitEthernet0/0/0/0
O IA 10.0.23.0/24 [110/3] via 10.1.11.11, 00:05:09, GigabitEthernet0/0/0/0
O IA 10.0.24.0/24 [110/4] via 10.1.11.11, 00:05:09, GigabitEthernet0/0/0/0
O    11.11.11.11/32 [110/2] via 10.1.11.11, 00:05:15, GigabitEthernet0/0/0/0
O    12.12.12.12/32 [110/2] via 10.1.12.12, 00:05:01, GigabitEthernet0/0/0/1
O    172.16.3.0/24 [110/2] via 10.1.11.11, 00:05:15, GigabitEthernet0/0/0/0
O    172.16.4.0/24 [110/11] via 10.1.12.12, 00:05:01, GigabitEthernet0/0/0/1
O E2 192.168.1.0/24 [110/20] via 10.1.11.11, 00:04:59, GigabitEthernet0/0/0/0

Making area 2 an NSSA (STEP 1)

As with a stub area, the NSSA setting goes on every router attached to the area.

The configuration applied in STEP 1
(applied to all five: R3, R4, R11, R12 and R13)
router ospf 1
 area 2
  nssa

The external route R13 was originating disappears from show ospf database external (type 5) and shows up in show ospf database nssa-external (type 7) instead. Type 7/5 translation in the Options is the P bit, and the Forward Address holding R13’s own address 13.13.13.13 is characteristic of a type 7.

STEP 1 R13 show ospf database nssa-external and more
RP/0/RP0/CPU0:R13#show ospf database nssa-external
Mon Sep  7 14:47:45.728 UTC


            OSPF Router with ID (13.13.13.13) (Process ID 1)

		Type-7 AS External Link States (Area 2)

  LS age: 16
  Options: (No TOS-capability, Type 7/5 translation, DC)
  LS Type: AS External Link
  Link State ID: 192.168.13.0 (External Network Number)
  Advertising Router: 13.13.13.13
  LS Seq Number: 80000001
  Checksum: 0x17a0
  Length: 36
  Network Mask: /24
	Metric Type: 2 (Larger than any link state path)
	TOS: 0 
	Metric: 20 
	Forward Address: 13.13.13.13
	External Route Tag: 0

RP/0/RP0/CPU0:R13#show route 192.168.1.0/24
Mon Sep  7 14:47:46.368 UTC

% Network not in table

RP/0/RP0/CPU0:R13#show ospf neighbor detail | include Options
Mon Sep  7 14:47:46.659 UTC
    Options is 0x58  
    LLS Options is 0x1 (LR)
    Options is 0x58  
    LLS Options is 0x1 (LR)

As the rest of that output shows, 192.168.1.0/24 (the type 5 from R1) no longer enters the area. What matters just as much is that an NSSA does not get a default route automatically. A stub area has its ABRs inject 0.0.0.0/0 for free; an NSSA has no such rule. As a result R13 cannot reach anything outside the area at this point.

STEP 1 R13 show route, ping and traceroute (no way out)
RP/0/RP0/CPU0:R13#show route 192.168.1.0/24
Mon Sep  7 14:48:25.373 UTC

% Network not in table

RP/0/RP0/CPU0:R13#ping 192.168.1.1 source 13.13.13.13
Mon Sep  7 14:48:25.523 UTC
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1 timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
RP/0/RP0/CPU0:R13#traceroute 192.168.1.1 source 13.13.13.13
Mon Sep  7 14:48:36.361 UTC

Type escape sequence to abort.
Tracing the route to 192.168.1.1

 1  13.13.13.13 !N  *  !N 

Seen from outside the NSSA, however, 192.168.13.0/24 arrives fine. In R2’s LSDB the advertising router of the type 5 is R4 (4.4.4.4), not R13, because R4 converted the type 7 into a type 5. The Forward Address is inherited from the type 7 unchanged (13.13.13.13).

STEP 1 R2 show ospf database external 192.168.13.0
RP/0/RP0/CPU0:R2#show ospf database external 192.168.13.0
Mon Sep  7 14:47:59.254 UTC


            OSPF Router with ID (2.2.2.2) (Process ID 1)

		Type-5 AS External Link States

  Routing Bit Set on this LSA
  LS age: 19
  Options: (No TOS-capability, DC)
  LS Type: AS External Link
  Link State ID: 192.168.13.0 (External Network Number)
  Advertising Router: 4.4.4.4
  LS Seq Number: 80000001
  Checksum: 0xba2b
  Length: 36
  Network Mask: /24
	Metric Type: 2 (Larger than any link state path)
	TOS: 0 
	Metric: 20 
	Forward Address: 13.13.13.13
	External Route Tag: 0

RP/0/RP0/CPU0:R2#show route 192.168.13.0/24
Mon Sep  7 14:47:59.818 UTC

Routing entry for 192.168.13.0/24
  Known via "ospf 1", distance 110, metric 20, type extern 2
  Installed Sep  7 14:47:40.739 for 00:00:19
  Routing Descriptor Blocks
    10.0.23.3, from 4.4.4.4, via GigabitEthernet0/0/0/1
      Route metric is 20
  No advertising protos. 

The route says from 4.4.4.4, yet its next hop is 10.0.23.3 (R3). Packets are sent to the forwarding address 13.13.13.13, and the shortest path to it runs through R3. Traffic does not have to pass the ABR that did the translation — that is the forwarding address at work.

The LS Update captured inside area 2 is worth a look. No.31 of the attached capture is R13 sending its own Router-LSA together with the type 7. The Options of the type 7 carry (P) Propagate, and R13’s Router-LSA says (N) NSSA translation: No — R13 is not a translator.

No.31 LS Update (R13's Router-LSA and its type 7) tshark -V
Open Shortest Path First
    OSPF Header
        Version: 2
        Message Type: LS Update (4)
        Packet Length: 124
        Source OSPF Router: 13.13.13.13
        Area ID: 0.0.0.2
        Checksum: 0x1231 [correct]
        Instance ID: Base IPv4 Unicast Instance (0)
        Auth Type: Null (0)
        Auth Data (none): 0000000000000000
    LS Update Packet
        Number of LSAs: 2
        LSA-type 1 (Router-LSA), len 60
            .000 0000 0000 0001 = LS Age (seconds): 1
            0... .... .... .... = Do Not Age Flag: 0
            Options: 0x28, (DC) Demand Circuits, (N) NSSA
                0... .... = DN: Not set
                .0.. .... = (O) Opaque: Not set
                ..1. .... = (DC) Demand Circuits: Supported
                ...0 .... = (L) LLS Data block: Not Present
                .... 1... = (N) NSSA: Supported
                .... .0.. = (MC) Multicast: Not capable
                .... ..0. = (E) External Routing: Not capable
                .... ...0 = (MT) Multi-Topology Routing: No
            LS Type: Router-LSA (1)
            Link State ID: 13.13.13.13
            Advertising Router: 13.13.13.13
            Sequence Number: 0x80000005
            Checksum: 0x65d4
            Length: 60
            Flags: 0x02, (E) AS boundary router
                0... .... = (H) Host: No
                ..0. .... = (S) Shortcut-capable ABR: No
                ...0 .... = (N) NSSA translation: No
                .... 0... = (W) Wild-card multicast receiver: No
                .... .0.. = (V) Virtual link endpoint: No
                .... ..1. = (E) AS boundary router: Yes
                .... ...0 = (B) Area border router: No
            Number of Links: 3
            Type: Stub     ID: 13.13.13.13     Data: 255.255.255.255 Metric: 1
                Link ID: 13.13.13.13 - IP network/subnet number
                Link Data: 255.255.255.255
                Link Type: 3 - Connection to a stub network
                Number of Metrics: 0 - TOS
                0 Metric: 1
            Type: Stub     ID: 10.1.11.0       Data: 255.255.255.0   Metric: 1
                Link ID: 10.1.11.0 - IP network/subnet number
                Link Data: 255.255.255.0
                Link Type: 3 - Connection to a stub network
                Number of Metrics: 0 - TOS
                0 Metric: 1
            Type: Stub     ID: 10.1.12.0       Data: 255.255.255.0   Metric: 1
                Link ID: 10.1.12.0 - IP network/subnet number
                Link Data: 255.255.255.0
                Link Type: 3 - Connection to a stub network
                Number of Metrics: 0 - TOS
                0 Metric: 1
        LSA-type 7 (NSSA AS-External-LSA), len 36
            .000 0000 0000 0001 = LS Age (seconds): 1
            0... .... .... .... = Do Not Age Flag: 0
            Options: 0x28, (DC) Demand Circuits, (P) Propagate
                0... .... = DN: Not set
                .0.. .... = (O) Opaque: Not set
                ..1. .... = (DC) Demand Circuits: Supported
                ...0 .... = (L) LLS Data block: Not Present
                .... 1... = (P) Propagate: Set
                .... .0.. = (MC) Multicast: Not capable
                .... ..0. = (E) External Routing: Not capable
                .... ...0 = (MT) Multi-Topology Routing: No
            LS Type: NSSA AS-External-LSA (7)
            Link State ID: 192.168.13.0
            Advertising Router: 13.13.13.13
            Sequence Number: 0x80000001
            Checksum: 0x17a0
            Length: 36
            Netmask: 255.255.255.0
            1... .... = External Type: Type 2 (metric is larger than any other link state path)
            .000 0000 = TOS: 0
            Metric: 20
            Forwarding Address: 13.13.13.13
            External Route Tag: 0

Download the pcap of the packet in the tshark output above (No.31, a type 7 LSU)

The capture from the backbone side (between R2 and R4) holds the type 5 that R4 produced by translating it.

No.40 LS Update (the type 5 R4 produced by translation) tshark -V
Open Shortest Path First
    OSPF Header
        Version: 2
        Message Type: LS Update (4)
        Packet Length: 64
        Source OSPF Router: 4.4.4.4
        Area ID: 0.0.0.0 (Backbone)
        Checksum: 0x2c7b [correct]
        Instance ID: Base IPv4 Unicast Instance (0)
        Auth Type: Null (0)
        Auth Data (none): 0000000000000000
    LS Update Packet
        Number of LSAs: 1
        LSA-type 5 (AS-External-LSA (ASBR)), len 36
            .000 0000 0000 0001 = LS Age (seconds): 1
            0... .... .... .... = Do Not Age Flag: 0
            Options: 0x20, (DC) Demand Circuits
                0... .... = DN: Not set
                .0.. .... = (O) Opaque: Not set
                ..1. .... = (DC) Demand Circuits: Supported
                ...0 .... = (L) LLS Data block: Not Present
                .... 0... = (N) NSSA: Not supported
                .... .0.. = (MC) Multicast: Not capable
                .... ..0. = (E) External Routing: Not capable
                .... ...0 = (MT) Multi-Topology Routing: No
            LS Type: AS-External-LSA (ASBR) (5)
            Link State ID: 192.168.13.0
            Advertising Router: 4.4.4.4
            Sequence Number: 0x80000001
            Checksum: 0xba2b
            Length: 36
            Netmask: 255.255.255.0
            1... .... = External Type: Type 2 (metric is larger than any other link state path)
            .000 0000 = TOS: 0
            Metric: 20
            Forwarding Address: 13.13.13.13
            External Route Tag: 0

Download the pcap of the packet in the tshark output above (No.40, the translated type 5)

Which ABR converts type 7 into type 5

If both ABRs of an NSSA translated, the same external route would exist twice as a type 5. Section 3.1 of RFC 3101 has the reachable NSSA border router with the highest router ID become the translator (NSSATranslatorState = elected). Here the candidates are R3 (3.3.3.3) and R4 (4.4.4.4), and R4 was elected.

When the translator goes away (STEP 2)

Shutting down R4’s area 2 interface removes the elected translator.

The configuration applied in STEP 2
(R4)
interface GigabitEthernet0/0/0/1
 shutdown

R3, the one that is left, takes over, and the advertising router of the type 5 becomes 3.3.3.3.

STEP 2 R2 show ospf database external 192.168.13.0 (R3 has taken over)
RP/0/RP0/CPU0:R2#show ospf database external 192.168.13.0
Mon Sep  7 14:56:39.933 UTC


            OSPF Router with ID (2.2.2.2) (Process ID 1)

		Type-5 AS External Link States

  Routing Bit Set on this LSA
  LS age: 67
  Options: (No TOS-capability, DC)
  LS Type: AS External Link
  Link State ID: 192.168.13.0 (External Network Number)
  Advertising Router: 3.3.3.3
  LS Seq Number: 80000001
  Checksum: 0xd811
  Length: 36
  Network Mask: /24
	Metric Type: 2 (Larger than any link state path)
	TOS: 0 
	Metric: 20 
	Forward Address: 13.13.13.13
	External Route Tag: 0

RP/0/RP0/CPU0:R2#show route 192.168.13.0/24
Mon Sep  7 14:56:40.828 UTC

Routing entry for 192.168.13.0/24
  Known via "ospf 1", distance 110, metric 20, type extern 2
  Installed Sep  7 14:55:34.333 for 00:01:06
  Routing Descriptor Blocks
    10.0.23.3, from 3.3.3.3, via GigabitEthernet0/0/0/1
      Route metric is 20
  No advertising protos. 

When it comes back (STEP 3)

Restoring R4’s link gives the role back to R4, which has the higher router ID.

The configuration applied in STEP 3
(R4)
interface GigabitEthernet0/0/0/1
 no shutdown

STEP 3 R2 show ospf database external 192.168.13.0 (back on R4)
RP/0/RP0/CPU0:R2#show ospf database external 192.168.13.0
Mon Sep  7 15:01:35.330 UTC


            OSPF Router with ID (2.2.2.2) (Process ID 1)

		Type-5 AS External Link States

  Routing Bit Set on this LSA
  LS age: 98
  Options: (No TOS-capability, DC)
  LS Type: AS External Link
  Link State ID: 192.168.13.0 (External Network Number)
  Advertising Router: 4.4.4.4
  LS Seq Number: 80000001
  Checksum: 0xba2b
  Length: 36
  Network Mask: /24
	Metric Type: 2 (Larger than any link state path)
	TOS: 0 
	Metric: 20 
	Forward Address: 13.13.13.13
	External Route Tag: 0

The capture from the backbone side has the whole handover with timestamps. Filtering it down to LS Updates gives this sequence.

Packet	Relative time	Content
No.3	5.2 s	R4 withdraws the type 5 it had translated (LS Age 3600)
No.15	43.4 s	R3 takes over as translator (about 38 seconds later)
No.78	307.9 s	R3 steps down (withdrawn with metric 16777215, LSInfinity)
No.79	307.9 s	R4 becomes the translator again (7 ms after No.78)

The 38 seconds before the takeover come from TranslatorStabilityInterval, 40 seconds by default in RFC 3101. It keeps the translator role — and the translated type 5 LSAs — from flapping. When R4 with the higher router ID came back, on the other hand, the handover was immediate.

The translator handover (tshark filtered on ospf.msg == 4)
 5.184670    10.0.24.4 → 224.0.0.5    OSPF 294 LS Update
 5.234330    10.0.24.4 → 224.0.0.5    OSPF 122 LS Update
 5.481905    10.0.24.4 → 224.0.0.5    OSPF 258 LS Update
43.396324    10.0.24.2 → 224.0.0.5    OSPF 98 LS Update
296.678527    10.0.24.4 → 224.0.0.5    OSPF 122 LS Update
296.839300    10.0.24.4 → 224.0.0.5    OSPF 90 LS Update
300.576839    10.0.24.4 → 224.0.0.5    OSPF 230 LS Update
307.853064    10.0.24.2 → 224.0.0.5    OSPF 98 LS Update
307.859918    10.0.24.4 → 224.0.0.5    OSPF 98 LS Update

Download the capture of the translator handover (STEP 2 and 3)

Adding a default route to the NSSA (STEP 4)

As STEP 1 showed, an NSSA gets no default route on its own. It has to be configured on the ABRs.

The configuration applied in STEP 4
(the two ABRs, R3 and R4)
router ospf 1
 area 2
  nssa default-information-originate

0.0.0.0/0 appears on R13. In a stub area it was O*IA (an inter-area route from a type 3); in an NSSA it is O*N2, an NSSA external type 2 — the default travels as a type 7 as well. Note also that the Options of these LSAs read No Type 7/5 translation (the P bit is clear): a default originated by an ABR is not translated or propagated into the backbone.

STEP 4 R13 show route 0.0.0.0/0, show ospf database nssa-external 0.0.0.0 and ping
RP/0/RP0/CPU0:R13#show route 0.0.0.0/0
Mon Sep  7 15:05:32.019 UTC

Routing entry for 0.0.0.0/0
  Known via "ospf 1", distance 110, metric 1, candidate default path, type NSSA extern 2
  Installed Sep  7 15:05:07.378 for 00:00:24
  Routing Descriptor Blocks
    10.1.11.11, from 3.3.3.3, via GigabitEthernet0/0/0/0
      Route metric is 1
  No advertising protos. 
RP/0/RP0/CPU0:R13#show ospf database nssa-external 0.0.0.0
Mon Sep  7 15:05:32.297 UTC


            OSPF Router with ID (13.13.13.13) (Process ID 1)

		Type-7 AS External Link States (Area 2)

  Routing Bit Set on this LSA
  LS age: 27
  Options: (No TOS-capability, No Type 7/5 translation, DC)
  LS Type: AS External Link
  Link State ID: 0.0.0.0 (External Network Number)
  Advertising Router: 3.3.3.3
  LS Seq Number: 80000001
  Checksum: 0xb2f2
  Length: 36
  Network Mask: /0
	Metric Type: 2 (Larger than any link state path)
	TOS: 0 
	Metric: 1 
	Forward Address: 0.0.0.0
	External Route Tag: 0

  LS age: 13
  Options: (No TOS-capability, No Type 7/5 translation, DC)
  LS Type: AS External Link
  Link State ID: 0.0.0.0 (External Network Number)
  Advertising Router: 4.4.4.4
  LS Seq Number: 80000001
  Checksum: 0x940d
  Length: 36
  Network Mask: /0
	Metric Type: 2 (Larger than any link state path)
	TOS: 0 
	Metric: 1 
	Forward Address: 0.0.0.0
	External Route Tag: 0

RP/0/RP0/CPU0:R13#ping 192.168.1.1 source 13.13.13.13
Mon Sep  7 15:05:32.871 UTC
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1 timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/20/45 ms
RP/0/RP0/CPU0:R13#traceroute 192.168.1.1 source 13.13.13.13
Mon Sep  7 15:05:33.758 UTC

Type escape sequence to abort.
Tracing the route to 192.168.1.1

 1  10.1.11.11 6 msec  6 msec  4 msec 
 2  172.16.3.3 8 msec  7 msec  7 msec 
 3  10.0.23.2 10 msec  9 msec  10 msec 
 4  10.0.12.1 14 msec  *  15 msec 

Making it a totally NSSA (STEP 5)

Adding no-summary on the ABRs stops type 3 as well.

The configuration applied in STEP 5
(the two ABRs, R3 and R4)
router ospf 1
 area 2
  nssa no-summary

The inter-area routes go away and the default route becomes an O*IA from a type 3, exactly as in a totally stubby area. What differs from a totally stubby area is that the type 7 R13 originates stays where it is.

STEP 5 R13 show route ospf and show ospf database (totally NSSA)
RP/0/RP0/CPU0:R13#show route ospf
Mon Sep  7 15:09:29.716 UTC

O*IA 0.0.0.0/0 [110/3] via 10.1.11.11, 00:00:28, GigabitEthernet0/0/0/0
O    11.11.11.11/32 [110/2] via 10.1.11.11, 00:21:56, GigabitEthernet0/0/0/0
O    12.12.12.12/32 [110/2] via 10.1.12.12, 00:21:51, GigabitEthernet0/0/0/1
O    172.16.3.0/24 [110/2] via 10.1.11.11, 00:21:56, GigabitEthernet0/0/0/0
O    172.16.4.0/24 [110/11] via 10.1.12.12, 00:21:51, GigabitEthernet0/0/0/1
RP/0/RP0/CPU0:R13#show ospf database
Mon Sep  7 15:09:29.908 UTC


            OSPF Router with ID (13.13.13.13) (Process ID 1)

		Router Link States (Area 2)

Link ID         ADV Router      Age         Seq#       Checksum Link count
3.3.3.3         3.3.3.3         1343        0x80000005 0x0072dc 2
4.4.4.4         4.4.4.4         580         0x80000008 0x002407 2
11.11.11.11     11.11.11.11     1321        0x80000007 0x006af4 5
12.12.12.12     12.12.12.12     580         0x80000009 0x000a2b 5
13.13.13.13     13.13.13.13     1316        0x80000007 0x00373f 5

		Summary Net Link States (Area 2)

Link ID         ADV Router      Age         Seq#       Checksum
0.0.0.0         3.3.3.3         31          0x80000001 0x00de4b
0.0.0.0         4.4.4.4         15          0x80000001 0x00c065

		Type-7 AS External Link States (Area 2)

Link ID         ADV Router      Age         Seq#       Checksum Tag
192.168.13.0    13.13.13.13     1320        0x80000001 0x0017a0 0
RP/0/RP0/CPU0:R13#show route 0.0.0.0/0
Mon Sep  7 15:09:30.497 UTC

Routing entry for 0.0.0.0/0
  Known via "ospf 1", distance 110, metric 3, candidate default path, type inter area
  Installed Sep  7 15:09:01.372 for 00:00:29
  Routing Descriptor Blocks
    10.1.11.11, from 3.3.3.3, via GigabitEthernet0/0/0/0
      Route metric is 3
  No advertising protos. 
RP/0/RP0/CPU0:R13#ping 192.168.1.1 source 13.13.13.13
Mon Sep  7 15:09:30.699 UTC
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1 timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/14/18 ms

Restoring (STEP 6)

Removing no-summary returns the area to an NSSA with a default route. On IOS XR the keyword after nssa replaces the previous one, so entering nssa default-information-originate clears no-summary.

The configuration applied in STEP 6 (final state)
(the two ABRs, R3 and R4)
router ospf 1
 area 2
  nssa default-information-originate

STEP 6 R13 show route ospf, show route 0.0.0.0/0 and ping (after the restore)
RP/0/RP0/CPU0:R13#show route ospf
Mon Sep  7 15:13:29.317 UTC

O*N2 0.0.0.0/0 [110/1] via 10.1.11.11, 00:00:19, GigabitEthernet0/0/0/0
O IA 1.1.1.1/32 [110/5] via 10.1.11.11, 00:00:32, GigabitEthernet0/0/0/0
O IA 2.2.2.2/32 [110/4] via 10.1.11.11, 00:00:32, GigabitEthernet0/0/0/0
O IA 3.3.3.3/32 [110/3] via 10.1.11.11, 00:00:32, GigabitEthernet0/0/0/0
O IA 4.4.4.4/32 [110/5] via 10.1.11.11, 00:00:32, GigabitEthernet0/0/0/0
O IA 10.0.12.0/24 [110/4] via 10.1.11.11, 00:00:32, GigabitEthernet0/0/0/0
O IA 10.0.23.0/24 [110/3] via 10.1.11.11, 00:00:32, GigabitEthernet0/0/0/0
O IA 10.0.24.0/24 [110/4] via 10.1.11.11, 00:00:32, GigabitEthernet0/0/0/0
O    11.11.11.11/32 [110/2] via 10.1.11.11, 00:25:55, GigabitEthernet0/0/0/0
O    12.12.12.12/32 [110/2] via 10.1.12.12, 00:25:50, GigabitEthernet0/0/0/1
O    172.16.3.0/24 [110/2] via 10.1.11.11, 00:25:55, GigabitEthernet0/0/0/0
O    172.16.4.0/24 [110/11] via 10.1.12.12, 00:25:50, GigabitEthernet0/0/0/1
RP/0/RP0/CPU0:R13#show route 0.0.0.0/0
Mon Sep  7 15:13:29.476 UTC

Routing entry for 0.0.0.0/0
  Known via "ospf 1", distance 110, metric 1, candidate default path, type NSSA extern 2
  Installed Sep  7 15:13:10.336 for 00:00:19
  Routing Descriptor Blocks
    10.1.11.11, from 3.3.3.3, via GigabitEthernet0/0/0/0
      Route metric is 1
  No advertising protos. 
RP/0/RP0/CPU0:R13#ping 192.168.1.1 source 13.13.13.13
Mon Sep  7 15:13:29.640 UTC
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1 timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 11/12/17 ms

How the LSDB changed

Counting the LSAs of area 2 as R13 sees them, in each state:

State	Router (type 1)	Summary (type 3)	ASBR summary (type 4)	External (type 5)	NSSA external (type 7)	Total	OSPF routes
Normal area (STEP 0)	5	14	2	2	0	23	12
NSSA (STEP 1)	5	14	0	0	1	20	11
NSSA with a default (STEP 4)	5	14	0	0	3	22	12
Totally NSSA (STEP 5)	5	2 (the defaults)	0	0	1	8	5

Turning the area into an NSSA alone hardly changes the count: type 4 and type 5 leave, but type 7 stays. The big reduction comes from a totally NSSA, where 23 LSAs become 8.

How it differs from a stub area

Item	Stub area	NSSA
Can it hold an ASBR	No	Yes, carried as type 7
Getting external routes out	Not possible	The ABR converts type 7 into type 5
Default route	Injected automatically by the ABRs (type 3)	Must be configured (type 7; a type 3 when `no-summary` is used)
How `show route` shows it	`O*IA 0.0.0.0/0`	`O*N2 0.0.0.0/0`
E bit in the Options	0	0
N bit in the Options	0	1

The default route not being automatic is what bites in practice. Configure an NSSA the way you configure a stub area and the area loses its way out, exactly as reproduced in STEP 1.

The IOS XR commands

Command	Where it goes	Meaning
`nssa` under `area <ID>`	Every router attached to the area	Makes the area an NSSA. Missing it on one router breaks the adjacency on the N bit
`nssa default-information-originate`	The ABRs only	Injects a default route as a type 7
`nssa no-summary`	The ABRs only	Blocks type 3 as well (totally NSSA); the default then arrives as a type 3

Example (ABR R3: an NSSA with a default route)
router ospf 1
 area 2
  nssa default-information-originate
  interface GigabitEthernet0/0/0/1
   network point-to-point
  !
 !
!

On IOS XR the keyword after nssa replaces the previous one: entering nssa no-summary clears nssa default-information-originate and vice versa (visible in show running-config). On IOS XE they are written together, as in area <ID> nssa [no-summary] [default-information-originate]. Configuration examples are covered in a separate article.

Verification config and show output

For each STEP the following three files were collected from all seven routers, split per router. The verification config is the ..._run.txt file (the final state is the one from STEP 6).

File	Content
`..._show.txt`	`show version` / `show interface description` / `show route` / `show route ospf` / `show ospf` / `show ospf interface` / `show ospf interface brief` / `show ospf neighbor` / `show ospf neighbor detail` / `show ospf database` / `show ospf database router` / `show ospf database network` / `show ospf statistics interface` / `show ospf database nssa-external` / `show ospf database summary` / `show ospf database asbr-summary` / `show ospf database external` / `show ospf border-routers` / `show ospf routes` / `show route 0.0.0.0/0` / `show route 192.168.1.0/24` / `show route 192.168.13.0/24` / `show ospf trace events`
`..._log.txt`	`show logging` narrowed to that STEP. A marker was written with `logmsg` at the start of each STEP and its timestamp passed to `show logging start`
`..._run.txt`	`show running-config` at that point in time (that is, the verification config for that STEP)

The final state has area 2 as an NSSA (nssa default-information-originate on the ABRs, nssa on the internal routers).

STEP 0: a normal area (before the NSSA) — R13’s external route floods the whole AS as a type 5

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R11	show	log	run
R12	show	log	run
R13	show	log	run

This STEP also has a ping and a traceroute from R13 and a ping and a traceroute from R1.

STEP 1: nssa on the five routers of area 2 — the type 5 becomes a type 7 and no external route (nor a default) enters the area

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R11	show	log	run
R12	show	log	run
R13	show	log	run

This STEP also has show ospf database nssa-external and more on R13, show route, ping and traceroute on R13, show ospf database external 192.168.13.0 on R2.

STEP 2: R4’s area 2 link is shut down — the translator role moves to R3 (about 38 seconds later)

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R11	show	log	run
R12	show	log	run
R13	show	log	run

This STEP also has show ospf database external 192.168.13.0 on R2.

STEP 3: R4’s link is restored — the translator role returns to R4

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R11	show	log	run
R12	show	log	run
R13	show	log	run

This STEP also has show ospf database external 192.168.13.0 on R2.

STEP 4: nssa default-information-originate on the two ABRs — O*N2 0.0.0.0/0 arrives and the area can reach outside again

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R11	show	log	run
R12	show	log	run
R13	show	log	run

This STEP also has show route 0.0.0.0/0 and more on R13.

STEP 5: nssa no-summary on the two ABRs (totally NSSA) — type 3 disappears and the default becomes an O*IA

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R11	show	log	run
R12	show	log	run
R13	show	log	run

This STEP also has show route ospf and show ospf database on R13.

STEP 6: the two ABRs go back to nssa default-information-originate (final state) — an NSSA with a default route

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R11	show	log	run
R12	show	log	run
R13	show	log	run

This STEP also has show route ospf and ping on R13, show route 192.168.13.0/24 and ping on R1.

The captures were taken inside area 2 (between R11 and R13) and on the backbone side (between R2 and R4), both filtered with ip proto 89.

Download the capture from inside area 2 (becoming an NSSA, STEP 1)

Download the capture from the backbone side (the translated type 5, STEP 1)

References

RFC	Title	Summary
RFC 3101	The OSPF Not-So-Stubby Area (NSSA) Option	The NSSA specification: the N bit (section 2.1), type 7 LSAs and the forwarding address (section 2.3), the P bit (section 2.4), the translator election and TranslatorStabilityInterval (section 3.1) and the translation itself (section 3.2).
RFC 2328	OSPF Version 2	The definition of stub areas (section 3.6) and the Options field (appendix A.2).