Configuring OSPF Link-State Database Overload Protection
Information About OSPF Link-State Database Overload Protection
- Benefits of Using OSPF Link-State Database Overload Protection
- Overview of OSPF Link-State Database Overload Protection
How to Configure OSPF Link-State Database Overload Protection
- Limiting the Number of Non Self-Generated LSAs for an OSPF Process
- Limiting the Number of Non Self-Generated LSAs for an OSPFv3 Process
Configuration Examples for OSPF Link-State Database Overload Protection
- Example: Setting a Limit for LSA Generation
Feature History for OSPF Link-State Database Overload Protection

Configuring OSPF Link-State Database Overload Protection

Information About OSPF Link-State Database Overload Protection

The OSPF Link-State Database Overload Protection feature allows you to limit the number of nonself-generated link-state advertisements (LSAs) for a given Open Shortest Path First (OSPF) process or OSPFv3 process. Excessive LSAs generated by other devices in the OSPF domain can substantially drain the CPU and memory resources of the device.

The OSPF Link-State Database Overload Protection feature is applicable to OSPF, OSPFv2 and OSPFv3.

Benefits of Using OSPF Link-State Database Overload Protection

The OSPF Link-State Database Overload Protection feature provides a mechanism at the OSPF level to limit the number of nonself-generated LSAs for a given OSPF process. When other devices in the network have been misconfigured, they may generate a high volume of LSAs, for instance, to redistribute large numbers of prefixes. This protection mechanism prevents devices from receiving a large number of LSAs and therefore experiencing CPU and memory shortages.

Overview of OSPF Link-State Database Overload Protection

When the OSPF Link-State Database Overload Protection feature is enabled, the device keeps a count of the number of nonself-generated LSAs that it has received. When the configured threshold number of LSAs is reached, an error message is logged. When the configured maximum number of LSAs is exceeded, the device sends a notification. If the count of received LSAs is still higher than the configured maximum after one minute, the OSPF process takes down all adjacencies and clears the OSPF database. In this ignore state, all OSPF packets received on any interface that belong to this OSPF process are ignored and no OSPF packets are generated on any of these interfaces. The OSPF process remains in the ignore state for the time configured by the ignore-time keyword of the max-lsa command. Each time the OSPF process gets into an ignore state a counter is incremented. If this counter exceeds the number of times configured by the ignore-count keyword, the OSPF process stays permanently in the same ignore state and manual intervention is required to get the OSPF process out of the ignore state. You can get the OSPF process out of the permanent ignore state by restarting the OSPF process. The ignore state counter is reset to 0 when the OSPF process remains in the normal state of operation for the amount of time that was specified by the reset-time keyword. If the warning-only keyword of the max-lsa command is configured, the OSPFprocess will send only a warning that the LSA maximum has been exceeded.

How to Configure OSPF Link-State Database Overload Protection

Limiting the Number of Non Self-Generated LSAs for an OSPF Process

To configure a limit for the number of non self-generated LSAs for an OPSF process, perform this procedure:

Procedure

	Command or Action	Purpose
Step 1	enable Example: `Device> enable`	Enables privileged EXEC mode. Enter your password, if prompted.
Step 2	configure terminal Example: `Device# configure terminal`	Enters global configuration mode.
Step 3	router ospf`process-id` Example: `Device(config)# router ospf 1`	Enables OSPF routing. The `process-id` argument identifies the OSPF process.
Step 4	router-id `ip-address` Example: `Device(config-router)# router-id 10.0.0.1`	Specifies a fixed router ID for an OSPF process.
Step 5	log-adjacency-changes `[` detail`]` Example: `Device(config-router)# log-adjacency-changes`	Configures the device to send a syslog message when an OSPF neighbor goes up or down.
Step 6	max-lsa `maximum number` `[` `threshold-percentage]` `[` warning-only`]` `[` ignore-time `minutes]` `[` ignore-count`count-number]` `[` reset-time`minutes]` Example: `Device(config-router)# max-lsa 12000`	Limits the number of non self-generated LSAs that an OSPF routing process can keep in the OSPF link-state database (LSDB). The default limit for the number of non self-generated LSAs is 50,000 LSAs. The default value for the `threshold` argument is 75 percent. The default value for the ignore-time argument is 5 minutes. The default value for the reset-time argument is 10 minutes. The default value for the ignore-count argument is 5 counts.
Step 7	network `ip-address` `wildcard-mask` area `area-id` Example: `Device(config-router)# network 209.165.201.1 255.255.255.255 area 0`	Defines the interfaces on which OSPF runs and defines the area ID for those interfaces.
Step 8	end Example: `Device(config-router)# end`
Step 9	show ip ospf `[` `process-id` `area-id` `]` database `[` database-summary`]` Example: `Device# show ip ospf 2000 database database-summary`	Displays lists of information related to the OSPF database for a specific device. Use this command to verify the number of non self-generated LSAs on a device.

Limiting the Number of Non Self-Generated LSAs for an OSPFv3 Process

To configure a limit for the number of non self-generated LSAs for an OPSFv3 process, perform this procedure:

Procedure

	Command or Action	Purpose
Step 1	enable Example: `Device> enable`	Enables privileged EXEC mode. Enter your password, if prompted.
Step 2	configure terminal Example: `Device# configure terminal`	Enters global configuration mode.
Step 3	router ospfv3`process-id` Example: `Device(config)# router ospfv3 1`	Enables OSPFv3 routing. The `process-id` argument identifies the OSPFv3 process.
Step 4	router-id `ip-address` Example: `Device(config-router)# router-id 10.0.0.1`	Specifies a fixed router ID for an OSPF process.
Step 5	log-adjacency-changes `[` detail`]` Example: `Device(config-router)# log-adjacency-changes`	Configures the device to send a syslog message when an OSPF neighbor goes up or down.
Step 6	max-lsa `maximum number` `[` `threshold-percentage]` `[` warning-only`]` `[` ignore-time `minutes]` `[` ignore-count`count-number]` `[` reset-time`minutes]` Example: `Device(config-router)# max-lsa 12000`	Limits the number of non self-generated LSAs that an OSPF routing process can keep in the OSPF link-state database (LSDB). The default limit for the number of non self-generated LSAs is 50,000 LSAs. The default value for the `threshold` argument is 75 percent. The default value for the ignore-time argument is 5 minutes. The default value for the reset-time argument is 10 minutes. The default value for the ignore-count argument is 5 counts.
Step 7	end Example: `Device(config-router)# end`
Step 8	show ospfv3 `[` `process-id` `area-id` `]` database `[` database-summary`]` Example: `Device# show ospfv3 2000 database database-summary`	Displays lists of information related to the OSPF database for a specific device. Use this command to verify the number of non self-generated LSAs on a device.

Configuration Examples for OSPF Link-State Database Overload Protection

Example: Setting a Limit for LSA Generation

In the following example, the device is configured to not accept any more non self-generated LSAs once a maximum of 14,000 has been exceeded:


Device(config)# router ospf 1
Device(config-router)# router-id 192.168.0.1
Device(config-router)# log-adjacency-changes
Device(config-router)# max-lsa 14000 
Device(config-router)# area 33 nssa 
Device(config-router)# network 192.168.0.10.0.0.0 area 1 
Device(config-router)# network 192.168.5.10.0.0.0 area 1 
Device(config-router)# network 192.168.2.10.0.0.0 area 0

In the following example, the device is configured to not accept any more non self-generated LSAs once a maximum of 12,000 has been exceeded for an OPSFv3 process:


Device> enable
Device# configure terminal
Device(config)# router ospfv3 1
Device(config-router)# router-id 10.0.0.1
Device(config-router)# log-adjacency-changes
Device(config-router)# max-lsa 12000

In the following example, the show ip ospf command is entered to confirm the configuration:

Device# show ip ospf 1
Routing Process "ospf1" with ID 192.168.0.1 
Supports only single TOS(TOS0)routes 
Supports opaque LSA 
Supports Link-local Signaling(LLS)
Supports area transit capability 
Maximum number of nonself-generated LSA allowed 14000 
Threshold for warning message75% 
Ignore-time 5minutes,reset-time 10minutes 
Ignore-countallowed 5,currentignore-count 0

In the following example, the output is displayed when the show ip ospf command is entered when the device is in the ignore state:

Device# show ip ospf 1
Routing Process "ospf1" with ID 192.168.0.1
Supports only single TOS(TOS0)routes 
Supports opaque LSA 
Supports Link-local Signaling(LLS) 
Supports area transit capability 
Maximum number of nonself-generated LSA allowed 14000 
Threshold for warning message 75% 
Ignore-time 5minutes, reset-time 10minutes
Ignore-count allowed 5,current ignore-count 1
Ignoring all neighbors due to max-lsa limit, time remaining: 00:04:52

The following output is displayed when the show ip ospf command is entered after the device left the ignore state:

Device# show ip ospf 1
Routing Process "ospf 1" with ID 192.168.0.1 
Supports only single TOS(TOS0) routes 
Supports opaque LSA Supports Link-local Signaling (LLS) 
Supports area transit capability 
Maximum number of non self-generated LSA allowed 14000 
Threshold for warning message 75% 
Ignore-time 5 minutes, reset-time 10 minutes 
Ignore-count allowed 5, current ignore-count 1- time remaining: 00:09:51

The following output is displayed when the show ip ospf command is entered for a device that is permanently in the ignore state:

Device# show ip ospf 1
Routing Process "ospf 1" with ID 192.168.0.1 
Supports only single TOS(TOS0) routes 
Supports opaque LSA Supports Link-local Signaling (LLS) 
Supports area transit capability 
Maximum number of non self-generated LSA allowed 14000 
Threshold for warning message 75% 
Ignore-time 5 minutes, reset-time 10 minutes 
Ignore-count allowed 5, current ignore-count 6 
Permanently ignoring all neighbors due to max-lsa limit

Feature History for OSPF Link-State Database Overload Protection

This table provides release and related information for features explained in this module.

These features are available on all releases subsequent to the one they were introduced in, unless noted otherwise.


Release	Feature	Feature Information
Cisco IOS XE Dublin 17.11.1	OSPF Link-State Database Overload Protection	The OSPF Link-State Database Overload Protection feature allows you to limit the number of non self-generated link-state advertisements (LSAs) for a given OSPF process. Excessive LSAs generated by other routers in the OSPF domain can substantially drain the CPU and memory resources of the device. The default limit for the number of non self-generated LSAs is 50,000 LSAs.

Use Cisco Feature Navigator to find information about platform and software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn.

IP Routing Configuration Guide, Cisco IOS XE 17.18.x (Catalyst 9600 Switches)

Bias-Free Language

Book Title

IP Routing Configuration Guide, Cisco IOS XE 17.18.x (Catalyst 9600 Switches)

Chapter Title