OSPFv2
******

OSPF (Open Shortest Path First) version 2 is a routing protocol which is described in RFC2328, OSPF Version 2.  OSPF is an IGP (Interior Gateway Protocol).  Compared with RIP, OSPF can provide scalable network support and faster convergence times.  OSPF is widely used in large networks such as ISP (Internet Service Provider) backbone and enterprise networks.

Configuring ospfd
=================

There are no ospfd specific options.  Common options can be specified (see Common Invocation Options) to ospfd. ospfd needs to acquire interface information from zebra in order to function. Therefore zebra must be running before invoking ospfd. Also, if zebra is restarted then ospfd must be too.

Like other daemons, ospfd configuration is done in OSPF specific configuration file ospfd.conf.

OSPF router
===========

To start OSPF process you have to specify the OSPF router.  As of this writing, ospfd does not support multiple OSPF processes.

 -- Command: router ospf
 -- Command: no router ospf
     Enable or disable the OSPF process.  ospfd does not yet support multiple OSPF processes.  So you can not specify an OSPF process number.

 -- OSPF Command: ospf router-id A.B.C.D
 -- OSPF Command: no ospf router-id
     This sets the router-ID of the OSPF process. The router-ID may be an IP address of the router, but need not be - it can be any arbitrary 32bit number. However it MUST be unique within the entire OSPF domain to the OSPF speaker - bad things will happen if multiple OSPF speakers are configured with the same router-ID! If one is not specified then ospfd will obtain a router-ID automatically from zebra.

 -- OSPF Command: ospf abr-type TYPE
 -- OSPF Command: no ospf abr-type TYPE
     TYPE can be cisco|ibm|shortcut|standard. The "Cisco" and "IBM" types are equivalent.

     The OSPF standard for ABR behaviour does not allow an ABR to consider routes through non-backbone areas when its links to the backbone are down, even when there are other ABRs in attached non-backbone areas which still can reach the backbone - this restriction exists primarily to ensure routing-loops are avoided.

     With the "Cisco" or "IBM" ABR type, the default in this release of Quagga, this restriction is lifted, allowing an ABR to consider summaries learnt from other ABRs through non-backbone areas, and hence route via non-backbone areas as a last resort when, and only when, backbone links are down.

     Note that areas with fully-adjacent virtual-links are considered to be "transit capable" and can always be used to route backbone traffic, and hence are unaffected by this setting (see OSPF virtual-link).

     More information regarding the behaviour controlled by this command can be found in RFC 3509, Alternative Implementations of OSPF Area Border Routers, and draft-ietf-ospf-shortcut-abr-02.txt.

     Quote: "Though the definition of the ABR (Area Border Router) in the OSPF specification does not require a router with multiple attached areas to have a backbone connection, it is actually necessary to provide successful routing to the inter-area and external destinations. If this requirement is not met, all traffic destined for the areas not connected to such an ABR or out of the OSPF domain, is dropped.  This document describes alternative ABR behaviors implemented in Cisco and IBM routers."

 -- OSPF Command: ospf rfc1583compatibility
 -- OSPF Command: no ospf rfc1583compatibility
     RFC2328, the sucessor to RFC1583, suggests according to section G.2 (changes) in section 16.4 a change to the path preference algorithm that prevents possible routing loops that were possible in the old version of OSPFv2. More specifically it demands that inter-area paths and intra-area backbone path are now of equal preference but still both preferred to external paths.

     This command should NOT be set normally.

 -- OSPF Command: log-adjacency-changes [detail]
 -- OSPF Command: no log-adjacency-changes [detail]
     Configures ospfd to log changes in adjacency.  With the optional detail argument, all changes in adjacency status are shown.  Without detail, only changes to full or regressions are shown.

 -- OSPF Command: passive-interface INTERFACE
 -- OSPF Command: no passive-interface INTERFACE
      Do not speak OSPF interface on the given interface, but do advertise the interface as a stub link in the router-LSA (Link State Advertisement) for this router. This allows one to advertise addresses on such connected interfaces without having to originate AS-External/Type-5 LSAs (which have global flooding scope) - as would occur if connected addresses were redistributed into OSPF (see Redistribute routes to OSPF). This is the only way to advertise non-OSPF links into stub areas.

 -- OSPF Command: timers throttle spf DELAY INITIAL-HOLDTIME MAX-HOLDTIME
 -- OSPF Command: no timers throttle spf
     This command sets the initial DELAY, the INITIAL-HOLDTIME and the MAXIMUM-HOLDTIME between when SPF is calculated and the event which triggered the calculation. The times are specified in milliseconds and must be in the range of 0 to 600000 milliseconds.

     The DELAY specifies the minimum amount of time to delay SPF calculation (hence it affects how long SPF calculation is delayed after an event which occurs outside of the holdtime of any previous SPF calculation, and also serves as a minimum holdtime).

     Consecutive SPF calculations will always be seperated by at least 'hold-time' milliseconds. The hold-time is adaptive and initially is set to the INITIAL-HOLDTIME configured with the above command. Events which occur within the holdtime of the previous SPF calculation will cause the holdtime to be increased by INITIAL-HOLDTIME, bounded by the MAXIMUM-HOLDTIME configured with this command. If the adaptive hold-time elapses without any SPF-triggering event occuring then the current holdtime is reset to the INITIAL-HOLDTIME. The current holdtime can be viewed with show ip ospf, where it is expressed as a multiplier of the INITIAL-HOLDTIME.

          router ospf
           timers throttle spf 200 400 10000

     In this example, the DELAY is set to 200ms, the INITIAL HOLDTIME is set to 400ms and the MAXIMUM HOLDTIME to 10s. Hence there will always be at least 200ms between an event which requires SPF calculation and the actual SPF calculation. Further consecutive SPF calculations will always be seperated by between 400ms to 10s, the hold-time increasing by 400ms each time an SPF-triggering event occurs within the hold-time of the previous SPF calculation.

     This command supercedes the timers spf command in previous Quagga releases.

 -- OSPF Command: max-metric router-lsa [on-startup|on-shutdown] <5-86400>
 -- OSPF Command: max-metric router-lsa administrative
 -- OSPF Command: no max-metric router-lsa [on-startup|on-shutdown|administrative]
     This enables RFC3137, OSPF Stub Router Advertisement support, where the OSPF process describes its transit links in its router-LSA as having infinite distance so that other routers will avoid calculating transit paths through the router while still being able to reach networks through the router.

     This support may be enabled administratively (and indefinitely) or conditionally. Conditional enabling of max-metric router-lsas can be for a period of seconds after startup and/or for a period of seconds prior to shutdown.

     Enabling this for a period after startup allows OSPF to converge fully first without affecting any existing routes used by other routers, while still allowing any connected stub links and/or redistributed routes to be reachable. Enabling this for a period of time in advance of shutdown allows the router to gracefully excuse itself from the OSPF domain.

     Enabling this feature administratively allows for administrative intervention for whatever reason, for an indefinite period of time. Note that if the configuration is written to file, this administrative form of the stub-router command will also be written to file. If ospfd is restarted later, the command will then take effect until manually deconfigured.

     Configured state of this feature as well as current status, such as the number of second remaining till on-startup or on-shutdown ends, can be viewed with the show ip ospf command.

 -- OSPF Command: auto-cost reference-bandwidth <1-4294967>
 -- OSPF Command: no auto-cost reference-bandwidth
     This sets the reference bandwidth for cost calculations, where this bandwidth is considered equivalent to an OSPF cost of 1, specified in Mbits/s. The default is 100Mbit/s (i.e. a link of bandwidth 100Mbit/s or higher will have a cost of 1. Cost of lower bandwidth links will be scaled with reference to this cost).

     This configuration setting MUST be consistent across all routers within the OSPF domain.

 -- OSPF Command: network A.B.C.D/M area A.B.C.D
 -- OSPF Command: network A.B.C.D/M area <0-4294967295>
 -- OSPF Command: no network A.B.C.D/M area A.B.C.D
 -- OSPF Command: no network A.B.C.D/M area <0-4294967295>
     This command specifies the OSPF enabled interface(s).  If the interface has an address from range 192.168.1.0/24 then the command below enables ospf on this interface so router can provide network information to the other ospf routers via this interface.

          router ospf
           network 192.168.1.0/24 area 0.0.0.0

     Prefix length in interface must be equal or bigger (ie. smaller network) than prefix length in network statement. For example statement above doesn't enable ospf on interface with address 192.168.1.1/23, but it does on interface with address 192.168.1.129/25.

     Note that the behavior when there is a peer address defined on an interface changed after release 0.99.7. Currently, if a peer prefix has been configured, then we test whether the prefix in the network command contains the destination prefix.  Otherwise, we test whether the network command prefix contains the local address prefix of the interface.

OSPF area
=========

 -- OSPF Command: area A.B.C.D range A.B.C.D/M
 -- OSPF Command: area <0-4294967295> range A.B.C.D/M
 -- OSPF Command: no area A.B.C.D range A.B.C.D/M
 -- OSPF Command: no area <0-4294967295> range A.B.C.D/M
     Summarize intra area paths from specified area into one Type-3 summary-LSA announced to other areas. This command can be used only in ABR and ONLY router-LSAs (Type-1) and network-LSAs (Type-2) (ie. LSAs with scope area) can be summarized. Type-5 AS-external-LSAs can't be summarized - their scope is AS. Summarizing Type-7 AS-external-LSAs isn't supported yet by Quagga.

          router ospf
           network 192.168.1.0/24 area 0.0.0.0
           network 10.0.0.0/8 area 0.0.0.10
           area 0.0.0.10 range 10.0.0.0/8

     With configuration above one Type-3 Summary-LSA with routing info 10.0.0.0/8 is announced into backbone area if area 0.0.0.10 contains at least one intra-area network (ie. described with router or network LSA) from this range.

 -- OSPF Command: area A.B.C.D range IPV4_PREFIX not-advertise
 -- OSPF Command: no area A.B.C.D range IPV4_PREFIX not-advertise
     Instead of summarizing intra area paths filter them - ie. intra area paths from this range are not advertised into other areas. This command makes sense in ABR only.

 -- OSPF Command: area A.B.C.D range IPV4_PREFIX substitute IPV4_PREFIX
 -- OSPF Command: no area A.B.C.D range IPV4_PREFIX substitute IPV4_PREFIX
     Substitute summarized prefix with another prefix.

          router ospf
           network 192.168.1.0/24 area 0.0.0.0
           network 10.0.0.0/8 area 0.0.0.10
           area 0.0.0.10 range 10.0.0.0/8 substitute 11.0.0.0/8

     One Type-3 summary-LSA with routing info 11.0.0.0/8 is announced into backbone area if area 0.0.0.10 contains at least one intra-area network (ie. described with router-LSA or network-LSA) from range 10.0.0.0/8. This command makes sense in ABR only.

 -- OSPF Command: area A.B.C.D virtual-link A.B.C.D
 -- OSPF Command: area <0-4294967295> virtual-link A.B.C.D
 -- OSPF Command: no area A.B.C.D virtual-link A.B.C.D
 -- OSPF Command: no area <0-4294967295> virtual-link A.B.C.D

 -- OSPF Command: area A.B.C.D shortcut
 -- OSPF Command: area <0-4294967295> shortcut
 -- OSPF Command: no area A.B.C.D shortcut
 -- OSPF Command: no area <0-4294967295> shortcut
     Configure the area as Shortcut capable. See RFC3509. This requires that the 'abr-type' be set to 'shortcut'.

 -- OSPF Command: area A.B.C.D stub
 -- OSPF Command: area <0-4294967295> stub
 -- OSPF Command: no area A.B.C.D stub
 -- OSPF Command: no area <0-4294967295> stub
     Configure the area to be a stub area. That is, an area where no router originates routes external to OSPF and hence an area where all external routes are via the ABR(s). Hence, ABRs for such an area do not need to pass AS-External LSAs (type-5s) or ASBR-Summary LSAs (type-4) into the area. They need only pass Network-Summary (type-3) LSAs into such an area, along with a default-route summary.

 -- OSPF Command: area A.B.C.D stub no-summary
 -- OSPF Command: area <0-4294967295> stub no-summary
 -- OSPF Command: no area A.B.C.D stub no-summary
 -- OSPF Command: no area <0-4294967295> stub no-summary
     Prevents an ospfd ABR from injecting inter-area summaries into the specified stub area.

 -- OSPF Command: area A.B.C.D default-cost <0-16777215>
 -- OSPF Command: no area A.B.C.D default-cost <0-16777215>
     Set the cost of default-summary LSAs announced to stubby areas.

 -- OSPF Command: area A.B.C.D export-list NAME
 -- OSPF Command: area <0-4294967295> export-list NAME
 -- OSPF Command: no area A.B.C.D export-list NAME
 -- OSPF Command: no area <0-4294967295> export-list NAME
     Filter Type-3 summary-LSAs announced to other areas originated from intra- area paths from specified area.

          router ospf
           network 192.168.1.0/24 area 0.0.0.0
           network 10.0.0.0/8 area 0.0.0.10
           area 0.0.0.10 export-list foo
          !
          access-list foo permit 10.10.0.0/16
          access-list foo deny any

     With example above any intra-area paths from area 0.0.0.10 and from range 10.10.0.0/16 (for example 10.10.1.0/24 and 10.10.2.128/30) are announced into other areas as Type-3 summary-LSA's, but any others (for example 10.11.0.0/16 or 10.128.30.16/30) aren't.

     This command is only relevant if the router is an ABR for the specified area.

 -- OSPF Command: area A.B.C.D import-list NAME
 -- OSPF Command: area <0-4294967295> import-list NAME
 -- OSPF Command: no area A.B.C.D import-list NAME
 -- OSPF Command: no area <0-4294967295> import-list NAME
     Same as export-list, but it applies to paths announced into specified area as Type-3 summary-LSAs.

 -- OSPF Command: area A.B.C.D filter-list prefix NAME in
 -- OSPF Command: area A.B.C.D filter-list prefix NAME out
 -- OSPF Command: area <0-4294967295> filter-list prefix NAME in
 -- OSPF Command: area <0-4294967295> filter-list prefix NAME out
 -- OSPF Command: no area A.B.C.D filter-list prefix NAME in
 -- OSPF Command: no area A.B.C.D filter-list prefix NAME out
 -- OSPF Command: no area <0-4294967295> filter-list prefix NAME in
 -- OSPF Command: no area <0-4294967295> filter-list prefix NAME out
     Filtering Type-3 summary-LSAs to/from area using prefix lists. This command makes sense in ABR only.

 -- OSPF Command: area A.B.C.D authentication
 -- OSPF Command: area <0-4294967295> authentication
 -- OSPF Command: no area A.B.C.D authentication
 -- OSPF Command: no area <0-4294967295> authentication
     Specify that simple password authentication should be used for the given area.

 -- OSPF Command: area A.B.C.D authentication message-digest
 -- OSPF Command: area <0-4294967295> authentication message-digest

     Specify that OSPF packets must be authenticated with MD5 HMACs within the given area. Keying material must also be configured on a per-interface basis (see ip ospf message-digest-key).

     MD5 authentication may also be configured on a per-interface basis (see ip ospf authentication message-digest). Such per-interface settings will override any per-area authentication setting.

OSPF interface
==============

 -- Interface Command: ip ospf authentication-key AUTH_KEY
 -- Interface Command: no ip ospf authentication-key
     Set OSPF authentication key to a simple password.  After setting AUTH_KEY, all OSPF packets are authenticated. AUTH_KEY has length up to 8 chars.

     Simple text password authentication is insecure and deprecated in favour of MD5 HMAC authentication (see ip ospf authentication message-digest).

 -- Interface Command: ip ospf authentication message-digest
     Specify that MD5 HMAC authentication must be used on this interface. MD5 keying material must also be configured (see ip ospf message-digest-key). Overrides any authentication enabled on a per-area basis (see area authentication message-digest).

     Note that OSPF MD5 authentication requires that time never go backwards (correct time is NOT important, only that it never goes backwards), even across resets, if ospfd is to be able to promptly reestabish adjacencies with its neighbours after restarts/reboots. The host should have system time be set at boot from an external or non-volatile source (eg battery backed clock, NTP, etc.) or else the system clock should be periodically saved to non-volative storage and restored at boot if MD5 authentication is to be expected to work reliably.

 -- Interface Command: ip ospf message-digest-key KEYID md5 KEY
 -- Interface Command: no ip ospf message-digest-key
     Set OSPF authentication key to a cryptographic password.  The cryptographic algorithm is MD5.

     KEYID identifies secret key used to create the message digest. This ID is part of the protocol and must be consistent across routers on a link.

     KEY is the actual message digest key, of up to 16 chars (larger strings will be truncated), and is associated with the given KEYID.

 -- Interface Command: ip ospf cost <1-65535>
 -- Interface Command: no ip ospf cost
     Set link cost for the specified interface.  The cost value is set to router-LSA's metric field and used for SPF calculation.

 -- Interface Command: ip ospf dead-interval <1-65535>
 -- Interface Command: ip ospf dead-interval minimal hello-multiplier <2-20>
 -- Interface Command: no ip ospf dead-interval
      Set number of seconds for RouterDeadInterval timer value used for Wait Timer and Inactivity Timer.  This value must be the same for all routers attached to a common network.  The default value is 40 seconds.

     If 'minimal' is specified instead, then the dead-interval is set to 1 second and one must specify a hello-multiplier. The hello-multiplier specifies how many Hellos to send per second, from 2 (every 500ms) to 20 (every 50ms). Thus one can have 1s convergence time for OSPF. If this form is specified, then the hello-interval advertised in Hello packets is set to 0 and the hello-interval on received Hello packets is not checked, thus the hello-multiplier need NOT be the same across multiple routers on a common link.

 -- Interface Command: ip ospf hello-interval <1-65535>
 -- Interface Command: no ip ospf hello-interval
     Set number of seconds for HelloInterval timer value.  Setting this value, Hello packet will be sent every timer value seconds on the specified interface. This value must be the same for all routers attached to a common network. The default value is 10 seconds.

     This command has no effect if ip ospf dead-interval minimal is also specified for the interface.

 -- Interface Command: ip ospf network (broadcast|non-broadcast|point-to-multipoint|point-to-point)
 -- Interface Command: no ip ospf network
     Set explicitly network type for specifed interface.

 -- Interface Command: ip ospf priority <0-255>
 -- Interface Command: no ip ospf priority
     Set RouterPriority integer value.  The router with the highest priority will be more eligible to become Designated Router.  Setting the value to 0, makes the router ineligible to become Designated Router. The default value is 1.

 -- Interface Command: ip ospf retransmit-interval <1-65535>
 -- Interface Command: no ip ospf retransmit interval
     Set number of seconds for RxmtInterval timer value.  This value is used when retransmitting Database Description and Link State Request packets. The default value is 5 seconds.

 -- Interface Command: ip ospf transmit-delay
 -- Interface Command: no ip ospf transmit-delay
     Set number of seconds for InfTransDelay value.  LSAs' age should be incremented by this value when transmitting. The default value is 1 seconds.

Redistribute routes to OSPF
===========================

 -- OSPF Command: redistribute (kernel|connected|static|rip|bgp)
 -- OSPF Command: redistribute (kernel|connected|static|rip|bgp) ROUTE-MAP
 -- OSPF Command: redistribute (kernel|connected|static|rip|bgp) metric-type (1|2)
 -- OSPF Command: redistribute (kernel|connected|static|rip|bgp) metric-type (1|2) route-map WORD
 -- OSPF Command: redistribute (kernel|connected|static|rip|bgp) metric <0-16777214>
 -- OSPF Command: redistribute (kernel|connected|static|rip|bgp) metric <0-16777214> route-map WORD
 -- OSPF Command: redistribute (kernel|connected|static|rip|bgp) metric-type (1|2) metric <0-16777214>
 -- OSPF Command: redistribute (kernel|connected|static|rip|bgp) metric-type (1|2) metric <0-16777214> route-map WORD
 -- OSPF Command: no redistribute (kernel|connected|static|rip|bgp)
     Redistribute routes of the specified protocol or kind into OSPF, with the metric type and metric set if specified, filtering the routes using the given route-map if specified. Redistributed routes may also be filtered with distribute-lists, see ospf distribute-list.

     Redistributed routes are distributed as into OSPF as Type-5 External LSAs into links to areas that accept external routes, Type-7 External LSAs for NSSA areas and are not redistributed at all into Stub areas, where external routes are not permitted.

     Note that for connected routes, one may instead use passive-interface, see OSPF passive-interface.

 -- OSPF Command: default-information originate
 -- OSPF Command: default-information originate metric <0-16777214>
 -- OSPF Command: default-information originate metric <0-16777214> metric-type (1|2)
 -- OSPF Command: default-information originate metric <0-16777214> metric-type (1|2) route-map WORD
 -- OSPF Command: default-information originate always
 -- OSPF Command: default-information originate always metric <0-16777214>
 -- OSPF Command: default-information originate always metric <0-16777214> metric-type (1|2)
 -- OSPF Command: default-information originate always metric <0-16777214> metric-type (1|2) route-map WORD
 -- OSPF Command: no default-information originate
     Originate an AS-External (type-5) LSA describing a default route into all external-routing capable areas, of the specified metric and metric type. If the 'always' keyword is given then the default is always advertised, even when there is no default present in the routing table.

 -- OSPF Command: distribute-list NAME out (kernel|connected|static|rip|ospf
 -- OSPF Command: no distribute-list NAME out (kernel|connected|static|rip|ospf
     Apply the access-list filter, NAME, to redistributed routes of the given type before allowing the routes to redistributed into OSPF (see OSPF redistribute).

 -- OSPF Command: default-metric <0-16777214>
 -- OSPF Command: no default-metric

 -- OSPF Command: distance <1-255>
 -- OSPF Command: no distance <1-255>

 -- OSPF Command: distance ospf (intra-area|inter-area|external) <1-255>
 -- OSPF Command: no distance ospf

 -- Command: router zebra
 -- Command: no router zebra

Showing OSPF information
========================

 -- Command: show ip ospf
     Show information on a variety of general OSPF and area state and configuration information.

 -- Command: show ip ospf interface [INTERFACE]
     Show state and configuration of OSPF the specified interface, or all interfaces if no interface is given.

 -- Command: show ip ospf neighbor
 -- Command: show ip ospf neighbor INTERFACE
 -- Command: show ip ospf neighbor detail
 -- Command: show ip ospf neighbor INTERFACE detail

 -- Command: show ip ospf database

 -- Command: show ip ospf database (asbr-summary|external|network|router|summary)
 -- Command: show ip ospf database (asbr-summary|external|network|router|summary) LINK-STATE-ID
 -- Command: show ip ospf database (asbr-summary|external|network|router|summary) LINK-STATE-ID adv-router ADV-ROUTER
 -- Command: show ip ospf database (asbr-summary|external|network|router|summary) adv-router ADV-ROUTER
 -- Command: show ip ospf database (asbr-summary|external|network|router|summary) LINK-STATE-ID self-originate
 -- Command: show ip ospf database (asbr-summary|external|network|router|summary) self-originate

 -- Command: show ip ospf database max-age

 -- Command: show ip ospf database self-originate

 -- Command: show ip ospf route
     Show the OSPF routing table, as determined by the most recent SPF calculation.

Debugging OSPF
==============

 -- Command: debug ospf packet (hello|dd|ls-request|ls-update|ls-ack|all) (send|recv) [detail]
 -- Command: no debug ospf packet (hello|dd|ls-request|ls-update|ls-ack|all) (send|recv) [detail]

 -- Command: debug ospf ism
 -- Command: debug ospf ism (status|events|timers)
 -- Command: no debug ospf ism
 -- Command: no debug ospf ism (status|events|timers)

 -- Command: debug ospf nsm
 -- Command: debug ospf nsm (status|events|timers)
 -- Command: no debug ospf nsm
 -- Command: no debug ospf nsm (status|events|timers)

 -- Command: debug ospf lsa
 -- Command: debug ospf lsa (generate|flooding|refresh)
 -- Command: no debug ospf lsa
 -- Command: no debug ospf lsa (generate|flooding|refresh)

 -- Command: debug ospf zebra
 -- Command: debug ospf zebra (interface|redistribute)
 -- Command: no debug ospf zebra
 -- Command: no debug ospf zebra (interface|redistribute)

 -- Command: show debugging ospf

OSPF Configuration Examples
===========================

A simple example, with MD5 authentication enabled:

     !
     interface bge0
      ip ospf authentication message-digest
      ip ospf message-digest-key 1 md5 ABCDEFGHIJK
     !
     router ospf
      network 192.168.0.0/16 area 0.0.0.1
      area 0.0.0.1 authentication message-digest

An ABR router, with MD5 authentication and performing summarisation of networks between the areas:

     !
     password ABCDEF
     log file /var/log/quagga/ospfd.log
     service advanced-vty
     !
     interface eth0
      ip ospf authentication message-digest
      ip ospf message-digest-key 1 md5 ABCDEFGHIJK
     !
     interface ppp0
     !
     interface br0
      ip ospf authentication message-digest
      ip ospf message-digest-key 2 md5 XYZ12345
     !
     router ospf
      ospf router-id 192.168.0.1
      redistribute connected
      passive interface ppp0
      network 192.168.0.0/24 area 0.0.0.0
      network 10.0.0.0/16 area 0.0.0.0
      network 192.168.1.0/24 area 0.0.0.1
      area 0.0.0.0 authentication message-digest
      area 0.0.0.0 range 10.0.0.0/16
      area 0.0.0.0 range 192.168.0.0/24
      area 0.0.0.1 authentication message-digest
      area 0.0.0.1 range 10.2.0.0/16
     !