IOS XR OSPF NSSA Configuration (nssa / totally nssa)

How to Configure OSPF NSSA on Cisco IOS XR

These are the commands for configuring an NSSA and a totally NSSA on Cisco IOS XR. You specify them in the area submode under router ospf. How an NSSA carries external routes as Type 7 and how the ABR translates them into Type 5 are explained in OSPF NSSA and Totally NSSA.

IOS XR OSPF NSSA Configuration
router ospf [PROCESS_NAME]
 area [AREA_ID]
  nssa [no-summary | default-information-originate | translate type7 always]
  default-cost [COST]
 !
!

Field	Value
`no-summary`	With it, the area becomes a totally NSSA (Type 3 is blocked as well). Without it, an NSSA
`default-information-originate`	The ABR injects a default route as Type 7. An NSSA gets no default route unless you configure this
`translate type7 always`	Makes that ABR always act as the Type 7 to Type 5 translator
[COST]	With `no-summary`, the metric of the Type 3 default route the ABR injects. The default is 1

The commands go on different routers.

Command	Where to configure it
`nssa`	Every router attached to the area (both ABRs and internal routers). If even one router is missing it, the N bit in Options does not match and the adjacency does not come up
`nssa no-summary`	Only the ABRs of the area. If the area has several ABRs, configure all of them. Internal routers keep plain `nssa`
`nssa default-information-originate`	Only the ABRs
`default-cost`	Only the ABRs. The value can differ per ABR and per area

The keyword after nssa overwrites the previous one

This is the point to watch on IOS XR. The keywords after nssa cannot be combined: whichever you configure last replaces the previous one. If you add nssa no-summary to an area that already has nssa default-information-originate, the default-information-originate disappears. The same happens the other way round.

An example of the overwrite
(before)  nssa default-information-originate
(enter)   nssa no-summary
(after)   nssa no-summary              <- default-information-originate is gone

No error or warning is printed, so you only notice it in show running-config. If you want both effects, configure no-summary alone. In a totally NSSA the ABR injects a Type 3 default route automatically, so default-information-originate is not needed.

On IOS XE you can combine the keywords, as in area [AREA_ID] nssa [no-summary] [default-information-originate]. IOS XR differs in that they go inside the area submode and that the keyword overwrites the previous one.

Cisco IOS XR NSSA Verification Commands

Command	What it shows
`show running-config router ospf`	The keyword that is configured. The only way to confirm the result of the overwrite
`show ospf`	The type of each area (`It is a NSSA area`), whether this router is the translator (`Perform type-7/type-5 LSA translation`), and whether it originates a Type 7 default route (`generates NSSA default route with cost`)
`show ospf database`	The LSAs in each area. An NSSA has `Type-7 AS External Link States` and no `Type-5`; in a totally NSSA, `Summary Net Link States` contains only `0.0.0.0`
`show ospf database nssa-external`	The contents of Type 7 LSAs. `Type 7/5 translation` in `Options` is the P bit
`show ospf database external`	Type 5 LSAs as seen from area 0. For a translated one, `Advertising Router` is the ABR and `Forward Address` is the original ASBR
`show ospf database summary 0.0.0.0`	In a totally NSSA, the Type 3 default route from each ABR and its `Metric`
`show route ospf`	The default route on an internal router: `ON2` in an NSSA, `OIA` in a totally NSSA

show ospf cannot tell an NSSA from a totally NSSA. There is no NSSA equivalent of the stub area’s It is a stub area, no summary LSA in this area; both print only It is a NSSA area. To confirm that no-summary is in effect, check show running-config, or check that Type 3 is blocked in show ospf database on an internal router.

Verification on Real Devices

Five routers, XR1 to XR5, with area 1 as an NSSA and area 2 as a totally NSSA. XR2 and XR3 are the two ABRs, both attached to areas 0, 1 and 2. XR1 is an ASBR that redistributes the static route 172.16.1.0/24. XR4 is an ASBR inside the NSSA and redistributes 172.16.4.0/24. Unlike a stub area, an NSSA can host an ASBR.

Router	Role	NSSA configuration
XR1	Internal router in area 0, ASBR	None
XR2	ABR	`nssa default-information-originate` in area 1, `nssa no-summary` in area 2
XR3	ABR	`nssa default-information-originate` in area 1, `nssa no-summary` and `default-cost 50` in area 2
XR4	Internal router in area 1 (NSSA), ASBR inside the NSSA	`nssa`
XR5	Internal router in area 2 (totally NSSA)	`nssa` (no `no-summary`)

NSSA configuration

XR1 OSPF configuration
router static
 address-family ipv4 unicast
  172.16.1.0/24 Null0
 !
!
router ospf 1
 router-id 1.1.1.1
 redistribute static
 area 0
  interface Loopback0
   passive enable
  !
  interface Loopback1
   passive enable
  !
  interface GigabitEthernet0/0/0/0
  !
  interface GigabitEthernet0/0/0/1
  !
 !
!

XR2 OSPF configuration
router ospf 1
 router-id 2.2.2.2
 area 0
  interface Loopback0
   passive enable
  !
  interface GigabitEthernet0/0/0/0
  !
 !
 area 1
  nssa default-information-originate
  interface GigabitEthernet0/0/0/1
  !
 !
 area 2
  nssa no-summary
  interface GigabitEthernet0/0/0/2
  !
 !
!

XR3 OSPF configuration
router ospf 1
 router-id 3.3.3.3
 area 0
  interface Loopback0
   passive enable
  !
  interface GigabitEthernet0/0/0/0
  !
 !
 area 1
  nssa default-information-originate
  interface GigabitEthernet0/0/0/1
  !
 !
 area 2
  nssa no-summary
  default-cost 50
  interface GigabitEthernet0/0/0/2
  !
 !
!

XR4 OSPF configuration
router static
 address-family ipv4 unicast
  172.16.4.0/24 Null0
 !
!
router ospf 1
 router-id 4.4.4.4
 redistribute static
 area 1
  nssa
  interface Loopback0
   passive enable
  !
  interface Loopback1
   passive enable
  !
  interface GigabitEthernet0/0/0/0
  !
  interface GigabitEthernet0/0/0/1
  !
 !
!

XR5 OSPF configuration
router ospf 1
 router-id 5.5.5.5
 area 2
  nssa
  interface Loopback0
   passive enable
  !
  interface GigabitEthernet0/0/0/0
  !
  interface GigabitEthernet0/0/0/1
  !
 !
!

XR4 and XR5 have plain nssa. Since no-summary belongs on the ABRs, XR5 does not get it either, even though it sits inside the totally NSSA.

Confirming the keyword overwrite

On the ABRs, nssa default-information-originate was configured in area 2 first, and nssa no-summary was added afterwards. The committed difference is the single line nssa no-summary.

XR2 show configuration commit changes last 1 after adding nssa no-summary
RP/0/RP0/CPU0:XR2#show configuration commit changes last 1
Sun Sep 20 09:49:54.218 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
router ospf 1
 area 2
  nssa no-summary
 !
!
end

In show running-config afterwards, default-information-originate is gone from area 2. Area 1 was not touched, so it still has it.

XR2 show running-config router ospf 1 after no-summary
router ospf 1
 router-id 2.2.2.2
 area 0
  interface Loopback0
   passive enable
  !
  interface GigabitEthernet0/0/0/0
  !
 !
 area 1
  nssa default-information-originate
  interface GigabitEthernet0/0/0/1
  !
 !
 area 2
  nssa no-summary
  interface GigabitEthernet0/0/0/2
  !
 !
!

Verifying the configuration

show ospf

Check the type of each area on the ABRs. Both area 1 and area 2 report It is a NSSA area; area 2, which has no-summary, gets no special line.

XR2 show ospf (area sections)
    Area 1
	Number of interfaces in this area is 1
	It is a NSSA area
        generates NSSA default route with cost 1
	SPF algorithm executed 8 times
	Number of LSA 26.  Checksum Sum 0x0eb570
	Number of opaque link LSA 0.  Checksum Sum 00000000
	Number of DCbitless LSA 0
	Number of indication LSA 0
	Number of DoNotAge LSA 0
	Flood list length 0
	Number of LFA enabled interfaces 0, LFA revision 0
	Number of Per Prefix LFA enabled interfaces 0
	Number of neighbors forming in staggered mode 0, 1 full
    Area 2
	Number of interfaces in this area is 1
	It is a NSSA area
	SPF algorithm executed 8 times
	Number of LSA 7.  Checksum Sum 0x03b69f
	Number of opaque link LSA 0.  Checksum Sum 00000000
	Number of DCbitless LSA 0
	Number of indication LSA 0
	Number of DoNotAge LSA 0
	Flood list length 0
	Number of LFA enabled interfaces 0, LFA revision 0
	Number of Per Prefix LFA enabled interfaces 0
	Number of neighbors forming in staggered mode 0, 1 full

XR3 show ospf (excerpt of the area sections)
    Area 1
	Number of interfaces in this area is 1
	It is a NSSA area
        Perform type-7/type-5 LSA translation
        generates NSSA default route with cost 1
    Area 2
	Number of interfaces in this area is 1
	It is a NSSA area
        Perform type-7/type-5 LSA translation

There are three things to read here.

generates NSSA default route with cost 1 in area 1 is the effect of default-information-originate. Area 2 has no such line because the overwrite removed it
Only XR3 reports Perform type-7/type-5 LSA translation. The translator is elected automatically, and the router with the higher router ID wins (XR3 is 3.3.3.3, XR2 is 2.2.2.2)
default-cost 50 does not appear here. To see the value, look at the LSA on the internal router

show ospf database

The LSDB of the internal routers shows the difference between an NSSA and a totally NSSA clearly.

XR4 show ospf database
RP/0/RP0/CPU0:XR4#show ospf database
Sun Sep 20 09:53:06.322 UTC


            OSPF Router with ID (4.4.4.4) (Process ID 1)

		Router Link States (Area 1)

Link ID         ADV Router      Age         Seq#       Checksum Link count
2.2.2.2         2.2.2.2         477         0x80000003 0x00777a 1
3.3.3.3         3.3.3.3         477         0x80000003 0x004d99 1
4.4.4.4         4.4.4.4         476         0x80000003 0x00466c 4

		Net Link States (Area 1)

Link ID         ADV Router      Age         Seq#       Checksum
10.2.4.4        4.4.4.4         476         0x80000001 0x00ea0d
10.3.4.4        4.4.4.4         476         0x80000001 0x0001f1

		Summary Net Link States (Area 1)

Link ID         ADV Router      Age         Seq#       Checksum
1.1.1.1         2.2.2.2         498         0x80000001 0x00d850
1.1.1.1         3.3.3.3         487         0x80000001 0x00ba6a
2.2.2.2         2.2.2.2         538         0x80000001 0x00a085
2.2.2.2         3.3.3.3         487         0x80000001 0x009689
3.3.3.3         2.2.2.2         482         0x80000001 0x008699
3.3.3.3         3.3.3.3         527         0x80000001 0x0054c9
5.5.5.5         2.2.2.2         465         0x80000001 0x0020f8
5.5.5.5         3.3.3.3         465         0x80000001 0x000213
10.1.2.0        2.2.2.2         538         0x80000001 0x0058c8
10.1.2.0        3.3.3.3         487         0x80000001 0x0044d7
10.1.3.0        2.2.2.2         498         0x80000001 0x0057c7
10.1.3.0        3.3.3.3         527         0x80000001 0x002fec
10.2.5.0        2.2.2.2         538         0x80000001 0x002bf1
10.2.5.0        3.3.3.3         464         0x80000002 0x001502
10.3.5.0        2.2.2.2         464         0x80000002 0x0027f2
10.3.5.0        3.3.3.3         527         0x80000001 0x000117
172.16.1.1      2.2.2.2         498         0x80000001 0x006c02
172.16.1.1      3.3.3.3         487         0x80000001 0x004e1c

		Type-7 AS External Link States (Area 1)

Link ID         ADV Router      Age         Seq#       Checksum Tag
0.0.0.0         2.2.2.2         539         0x80000001 0x00d0d8 0
0.0.0.0         3.3.3.3         528         0x80000001 0x00b2f2 0
172.16.4.0      4.4.4.4         516         0x80000001 0x00f1c3 0

XR5 show ospf database
RP/0/RP0/CPU0:XR5#show ospf database
Sun Sep 20 09:53:50.484 UTC


            OSPF Router with ID (5.5.5.5) (Process ID 1)

		Router Link States (Area 2)

Link ID         ADV Router      Age         Seq#       Checksum Link count
2.2.2.2         2.2.2.2         509         0x80000003 0x007978 1
3.3.3.3         3.3.3.3         509         0x80000003 0x006d76 1
5.5.5.5         5.5.5.5         508         0x80000002 0x0094e2 3

		Net Link States (Area 2)

Link ID         ADV Router      Age         Seq#       Checksum
10.2.5.2        2.2.2.2         509         0x80000001 0x00629a
10.3.5.5        5.5.5.5         508         0x80000001 0x00ffe8

		Summary Net Link States (Area 2)

Link ID         ADV Router      Age         Seq#       Checksum
0.0.0.0         2.2.2.2         239         0x80000001 0x00fc31
0.0.0.0         3.3.3.3         231         0x80000002 0x00c82f

Item	XR4 (NSSA)	XR5 (totally NSSA)
`Summary Net Link States` (Type 3)	Every route outside the area	Only the two `0.0.0.0` entries (one per ABR)
`Type-7 AS External Link States`	The `0.0.0.0` default from the ABRs and XR4’s own `172.16.4.0`	None
`Type-5 AS External Link States`	None (blocked at the NSSA boundary)	None

XR5 has no Type 7 because no-summary overwrote default-information-originate, so the ABRs stopped originating the Type 7 default. A Type 3 0.0.0.0 takes its place.

show ospf database summary 0.0.0.0 (checking default-cost)

This is the metric of the default route the ABRs inject into the totally NSSA. Only XR3 has default-cost 50, so the two ABRs advertise different values.

XR5 show ospf database summary 0.0.0.0
RP/0/RP0/CPU0:XR5#show ospf database summary 0.0.0.0
Sun Sep 20 09:50:28.777 UTC


            OSPF Router with ID (5.5.5.5) (Process ID 1)

		Summary Net Link States (Area 2)

  Routing Bit Set on this LSA
  LS age: 37
  Options: (No TOS-capability, DC)
  LS Type: Summary Links (Network)
  Link State ID: 0.0.0.0 (Summary Network Number)
  Advertising Router: 2.2.2.2
  LS Seq Number: 80000001
  Checksum: 0xfc31
  Length: 28
  Network Mask: /0
	TOS: 0 	Metric: 1 

  LS age: 28
  Options: (No TOS-capability, DC)
  LS Type: Summary Links (Network)
  Link State ID: 0.0.0.0 (Summary Network Number)
  Advertising Router: 3.3.3.3
  LS Seq Number: 80000002
  Checksum: 0xc82f
  Length: 28
  Network Mask: /0
	TOS: 0 	Metric: 50 

show ospf database nssa-external (the P bit and the Type 7 contents)

The P bit in the Options of a Type 7 LSA decides whether the ABR translates it into Type 5. In show output it appears as the string Type 7/5 translation.

XR4 show ospf database nssa-external (excerpt)
		Type-7 AS External Link States (Area 1)

  Routing Bit Set on this LSA
  Options: (No TOS-capability, No Type 7/5 translation, DC)
  LS Type: AS External Link
  Link State ID: 0.0.0.0 (External Network Number)
  Advertising Router: 2.2.2.2
  Network Mask: /0
	Metric Type: 2 (Larger than any link state path)
	Metric: 1 
	Forward Address: 0.0.0.0

  Routing Bit Set on this LSA
  Options: (No TOS-capability, No Type 7/5 translation, DC)
  LS Type: AS External Link
  Link State ID: 0.0.0.0 (External Network Number)
  Advertising Router: 3.3.3.3
  Network Mask: /0
	Metric Type: 2 (Larger than any link state path)
	Metric: 1 
	Forward Address: 0.0.0.0

  LS age: 519
  Options: (No TOS-capability, Type 7/5 translation, DC)
  LS Type: AS External Link
  Link State ID: 172.16.4.0 (External Network Number)
  Advertising Router: 4.4.4.4

The default route from the ABRs is No Type 7/5 translation (P bit 0). It does not need to leave the area, so it is not translated. The 172.16.4.0 that XR4 redistributed is Type 7/5 translation (P bit 1), so the ABR rebuilds it as Type 5 and floods it through the AS.

show ospf database external (the translated Type 5)

Seen from XR1 in area 0, there are two Type 5 LSAs.

XR1 show ospf database external
RP/0/RP0/CPU0:XR1#show ospf database external
Sun Sep 20 09:50:59.471 UTC


            OSPF Router with ID (1.1.1.1) (Process ID 1)

		Type-5 AS External Link States

  LS age: 422
  Options: (No TOS-capability, DC)
  LS Type: AS External Link
  Link State ID: 172.16.1.0 (External Network Number)
  Advertising Router: 1.1.1.1
  LS Seq Number: 80000001
  Checksum: 0x39a5
  Length: 36
  Network Mask: /24
	Metric Type: 2 (Larger than any link state path)
	TOS: 0 
	Metric: 20 
	Forward Address: 0.0.0.0
	External Route Tag: 0

  Routing Bit Set on this LSA
  LS age: 350
  Options: (No TOS-capability, DC)
  LS Type: AS External Link
  Link State ID: 172.16.4.0 (External Network Number)
  Advertising Router: 3.3.3.3
  LS Seq Number: 80000001
  Checksum: 0xa41f
  Length: 36
  Network Mask: /24
	Metric Type: 2 (Larger than any link state path)
	TOS: 0 
	Metric: 20 
	Forward Address: 4.4.4.4
	External Route Tag: 0

172.16.1.0 is the one XR1 redistributed itself. 172.16.4.0 is the Type 7 from XR4 translated by XR3, so Advertising Router is the translator XR3 and Forward Address is the router ID of the original ASBR, XR4. Traffic goes to XR4, not to XR3, so routers in area 0 head straight for XR4.

show route ospf

The routing tables of the internal routers. The same “default route” is displayed differently depending on where it came from.

XR4 show route ospf
RP/0/RP0/CPU0:XR4#show route ospf
Sun Sep 20 09:53:01.730 UTC

O*N2 0.0.0.0/0 [110/1] via 10.2.4.2, 00:07:50, GigabitEthernet0/0/0/0
               [110/1] via 10.3.4.3, 00:07:50, GigabitEthernet0/0/0/1
O IA 1.1.1.1/32 [110/3] via 10.2.4.2, 00:07:50, GigabitEthernet0/0/0/0
                [110/3] via 10.3.4.3, 00:07:50, GigabitEthernet0/0/0/1
O IA 2.2.2.2/32 [110/2] via 10.2.4.2, 00:07:50, GigabitEthernet0/0/0/0
O IA 3.3.3.3/32 [110/2] via 10.3.4.3, 00:07:50, GigabitEthernet0/0/0/1
O IA 5.5.5.5/32 [110/3] via 10.2.4.2, 00:07:39, GigabitEthernet0/0/0/0
                [110/3] via 10.3.4.3, 00:07:39, GigabitEthernet0/0/0/1
O IA 10.1.2.0/24 [110/2] via 10.2.4.2, 00:07:50, GigabitEthernet0/0/0/0
O IA 10.1.3.0/24 [110/2] via 10.3.4.3, 00:07:50, GigabitEthernet0/0/0/1
O IA 10.2.5.0/24 [110/2] via 10.2.4.2, 00:07:50, GigabitEthernet0/0/0/0
O IA 10.3.5.0/24 [110/2] via 10.3.4.3, 00:07:50, GigabitEthernet0/0/0/1
O IA 172.16.1.1/32 [110/3] via 10.2.4.2, 00:07:50, GigabitEthernet0/0/0/0
                   [110/3] via 10.3.4.3, 00:07:50, GigabitEthernet0/0/0/1

XR5 show route ospf
RP/0/RP0/CPU0:XR5#show route ospf
Sun Sep 20 09:53:45.175 UTC

O*IA 0.0.0.0/0 [110/2] via 10.2.5.2, 00:03:43, GigabitEthernet0/0/0/0

Router	Default route	LSA type
XR4 (NSSA)	`O*N2 0.0.0.0/0`	Type 7 (`default-information-originate`)
XR5 (totally NSSA)	`O*IA 0.0.0.0/0`	Type 3 (injected automatically by the ABR with `no-summary`)

XR5 has only one route because every Type 3 other than the default route is blocked. It points only through XR2 because XR2’s cost of 1 is lower than XR3’s default-cost 50.

172.16.1.1/32 on XR4 is XR1’s Loopback1 advertised by OSPF, so it arrives as Type 3. The redistributed 172.16.1.0/24 is Type 5, so it stops at the NSSA boundary and is not in XR4’s table.

ping / traceroute

XR1 reaches 172.16.4.1, which the ASBR inside the NSSA redistributed, and XR5 reaches 1.1.1.1 in area 0. This confirms that the Type 7 to Type 5 translation and the default route of the totally NSSA actually work.

XR1 ping / traceroute 172.16.4.1
RP/0/RP0/CPU0:XR1#ping 172.16.4.1 source 1.1.1.1 count 50 timeout 1
Success rate is 100 percent (50/50), round-trip min/avg/max = 7/9/45 ms
RP/0/RP0/CPU0:XR1#traceroute 172.16.4.1 source 1.1.1.1 timeout 1 probe 2 maxttl 3
Sun Sep 20 09:50:43.527 UTC

Type escape sequence to abort.
Tracing the route to 172.16.4.1

 1  10.1.2.2 6 msec  5 msec 
 2  10.2.4.4 10 msec  * 

XR5 ping / traceroute 1.1.1.1
RP/0/RP0/CPU0:XR5#ping 1.1.1.1 source 5.5.5.5 count 50 timeout 1
Success rate is 100 percent (50/50), round-trip min/avg/max = 6/8/32 ms
RP/0/RP0/CPU0:XR5#traceroute 1.1.1.1 source 5.5.5.5 timeout 1 probe 2 maxttl 3
Sun Sep 20 09:53:38.959 UTC

Type escape sequence to abort.
Tracing the route to 1.1.1.1

 1  10.2.5.2 6 msec  4 msec 
 2  10.1.2.1 8 msec  *

The backbone cannot be an NSSA

Area 0 (the backbone) cannot be an NSSA. Adding nssa to area 0 on the ABR XR2 is rejected at commit time.

XR2 show configuration failed after adding nssa to area 0
RP/0/RP0/CPU0:XR2(config-ospf-ar)#show configuration failed
Sun Sep 20 09:54:49.899 UTC
!! SEMANTIC ERRORS: This configuration was rejected by 
!! the system due to semantic errors. The individual 
!! errors with each failed configuration command can be 
!! found below.


router ospf 1
 area 0
  nssa
!!% 'OSPF' detected the 'warning' condition 'Error: Backbone area cannot be configured as a stub or NSSA'
 !
!
end

A rejected configuration is not applied, so the configuration of area 0 is unchanged.

Verification Configuration and show Output

The following files were collected from all five routers, separately per router. The verification configuration is ..._run.txt.

File	Contents
`..._show.txt`	`show version` / `show interface description` / `show route` / `show route ospf` / `show ospf` / `show ospf interface` / `show ospf interface brief` / `show ospf neighbor` / `show ospf neighbor detail` / `show ospf database` / `show ospf database router` / `show ospf database network` / `show ospf database nssa-external` / `show ospf database external` / `show ospf database summary` / `show ospf database summary 0.0.0.0` / `show ospf border-routers` / `show ospf routes` / `show router-id` / `show running-config router ospf`
`..._log.txt`	`show logging`, narrowed with `show logging start` to the marker time written with `logmsg` just before the configuration was applied
`..._run.txt`	`show running-config` (the verification configuration)
`..._trace.txt`	`show ospf trace events`
`..._ping.txt`	`ping` / `traceroute`
`..._commit.cfg`	What was committed when the NSSA configuration was applied (`show configuration commit changes last 1`)

Router	show output	syslog	running-config	trace	ping	commit
XR1	show	log	run	trace	ping	commit
XR2	show	log	run	trace	ping	commit
XR3	show	log	run	trace	ping	commit
XR4	show	log	run	trace	ping	commit
XR5	show	log	run	trace	ping	commit

What was committed when nssa no-summary was added to area 2 is available for XR2 and XR3, and the rejected nssa on area 0 of XR2 is here.

How NSSA works is explained in OSPF NSSA and Totally NSSA, stub areas in OSPF Stub and Totally Stubby Areas, basic OSPF configuration in IOS XR OSPF Basic Configuration, and stub area configuration in IOS XR OSPF Stub Area Configuration.