Short answer: On Cisco IOS/IOS XE, default-information originate advertises an OSPF default when the originating router has a qualifying default route; always removes that prerequisite.[1] Neither option proves that Internet access works: treat origination and upstream-health measurement as separate checks.[1][5] Tie your upstream route to a health check, and verify withdrawal rather than just adjacency.[5]
This guide builds a proposed IPv4 lab, not a production deployment: one Internet edge, one internal router, normal OSPF area 0, and a deliberately failed upstream. The reusable asset is a failure-test matrix you can take into a change review. No router execution is claimed.
1. A default route is a promise, not a health check
In a normal area, installing a static default on an edge does not automatically advertise it through OSPF.[3] Explicit default origination creates an external advertisement; the advertising edge becomes an ASBR, an autonomous-system boundary router.[3]
Separate three questions during diagnosis: does the edge have a route, does OSPF advertise it, and can a real client reach the intended service? Cisco's tracked-static example demonstrates controlling a local default with IP SLA reachability, rather than relying only on a connected interface.[5]
For this lab, success means all three checks pass while the simulated provider works. Failure means the internal router loses its OSPF default when the health check fails, even though the Ethernet handoff remains up. Keep an out-of-band management path throughout testing.
2. Conditional origination versus always
Without a route map, ordinary default origination depends on a local default route.[1] Adding always advertises regardless of that route's existence; do not confuse this advertisement with an upstream forwarding path.[1]
router ospf 100
default-information originate metric 20 metric-type 1
The alternative below is not part of the recommended lab configuration:
router ospf 100
default-information originate always metric 20 metric-type 1
Use unconditional origination only when your design deliberately accepts advertisement without a local default.[1] For upstream-health testing, inspect IP SLA and object tracking separately from OSPF neighbor state.[4][5]
Route-map trap: Cisco documents different semantics when a route map is attached: origination depends on satisfying the route map, is not bound to a local default, and ignores always.[1] Review the exact route-map matches before assuming this is a stricter version of ordinary origination.[1]
3. E1 versus E2: which exit does an internal router choose?
For the same destination within OSPF, E1 external paths take preference over E2 paths.[2] E1 incorporates internal cost plus the external metric; E2 compares external metrics first and can use internal distance to distinguish otherwise equal candidates.[2] Multi-area external-path preference rules also apply: the simple arithmetic below assumes equally eligible, reachable exits in one normal area.[2]
Consider this invented design exercise, with no policy routing or competing non-OSPF defaults:
- Edge A: internal cost 10, external default metric 20.
- Edge B: internal cost 40, external default metric 60.
- Both E1: calculated totals are 30 through A and 100 through B, so A wins.[2]
- Both E2: external metric 20 beats 60, so A wins before internal-distance comparison.[2]
- Both E2 with equal external metrics: inspect internal reachability and cost rather than assuming a random choice.[2]
Do not configure the intended primary as E2 and the backup as E1 expecting a larger backup metric to preserve the primary. Path type is considered before that metric comparison.[2]
Explicitly setting metric and type also avoids relying on conflicting Cisco documentation defaults: the command reference lists a default metric of 10, while the older default-route support article describes 1.[1][3] This lab deliberately specifies 20 and E1.
4. Cisco-style lab: advertise only while the upstream probe works
Topology and assumptions
C1 --- 10.0.0.0/30 --- EDGE --- 192.0.2.0/30 --- simulated ISP
.2 .1 .2 .1
C1 loopback: 10.10.10.1/32
EDGE loopback: 10.255.0.1/32
Controlled probe target beyond ISP: 198.51.100.10
All addresses are lab placeholders. Configure the simulated provider's return route to 192.0.2.2, permit ICMP, and make the probe target reachable through it. Do not send probes to documentation addresses on the public Internet. Addressing, forwarding and the target are prerequisites, not resources supplied by these snippets.
The proposed edge configuration adapts Cisco's IP SLA/tracked-static mechanism.[5] The explicit host route is this lab's probe-path guard; the tracked default is the advertisement's local prerequisite under ordinary origination.[1][5]
! EDGE: adapt interface names to your platform
interface GigabitEthernet0/0/0
description LAB-UPSTREAM
ip address 192.0.2.2 255.255.255.252
no shutdown
!
interface GigabitEthernet0/0/1
description LAB-INTERNAL-C1
ip address 10.0.0.1 255.255.255.252
ip ospf 100 area 0
no shutdown
!
interface Loopback0
ip address 10.255.0.1 255.255.255.255
ip ospf 100 area 0
!
ip route 198.51.100.10 255.255.255.255 192.0.2.1
!
ip sla 10
icmp-echo 198.51.100.10 source-ip 192.0.2.2
timeout 1000
frequency 5
ip sla schedule 10 life forever start-time now
!
track 10 ip sla 10 reachability
delay down 10 up 30
!
ip route 0.0.0.0 0.0.0.0 192.0.2.1 track 10
!
router ospf 100
router-id 10.255.0.1
passive-interface default
no passive-interface GigabitEthernet0/0/1
default-information originate metric 20 metric-type 1
Object tracking supports delayed up/down notifications.[4] The proposed delays above are lab choices, not Cisco-recommended universal timers. Record observed failover time rather than equating a tracking delay with end-to-end convergence.
! C1
interface GigabitEthernet0/0/0
ip address 10.0.0.2 255.255.255.252
ip ospf 100 area 0
no shutdown
!
interface Loopback0
ip address 10.10.10.1 255.255.255.255
ip ospf 100 area 0
!
router ospf 100
router-id 10.10.10.1
passive-interface default
no passive-interface GigabitEthernet0/0/0
Scope boundary: this lab has exactly one default originator and no other source of a default on EDGE. With two edges, audit alternate defaults, redistribution and route-map conditions separately. Do not copy this single-originator test into a multi-exit network and assume it proves each exit's health independently.
5. Verification and a reusable failure-test matrix
Cisco's failover example uses route, tracking and traceroute checks.[5] Add OSPF database inspection here to distinguish an advertisement from an installed forwarding route.[3]
! EDGE
show ip sla statistics 10
show track 10
show ip route 0.0.0.0
show ip route 198.51.100.10
show ip ospf neighbor
show ip ospf database external 0.0.0.0
show running-config | section router ospf
!
! C1
show ip route 0.0.0.0
show ip ospf database external 0.0.0.0
show ip cef 203.0.113.10
The following are acceptance criteria, not captured router output:
| Test | EDGE expectation | C1 expectation |
|---|---|---|
| Upstream and probe healthy | Track up; static default installed | E1 default through EDGE |
| Block probe beyond the handoff | Track down after configured detection/delay; tracked default removed | External default withdrawn after convergence |
| Restore probe | Track up after recovery delay; static default returns | Default returns |
| Keep Ethernet up but break upstream forwarding | Same withdrawal requirement | No persistent default toward a failed exit |
| Negative control: use always while probe fails | Advertisement persists despite absent local default | Demonstrates why unconditional origination can blackhole traffic |
Run the negative control only in an isolated lab, then restore ordinary origination. For each test, record timestamps, the relevant default's advertising router, the forwarding next hop, and a client-originated connection attempt. Do not treat a configured command as a passed test.
6. Troubleshooting checklist
- Default missing: check the originating router's default and origination configuration before changing OSPF timers.[1]
- Default persists: inspect
always, route maps and every competing default source.[1] - Wrong exit: compare route type before comparing E1 totals or E2 external metrics.[2]
- Track down unexpectedly: verify probe reachability, source address and the return path; inspect
show trackand IP SLA results.[4][5] - Flapping: examine probe behavior and tracking delays instead of hiding the problem with unconditional origination.[4]
- Stub or NSSA mismatch: this normal-area example is not the area's default-injection mechanism.[3] Stub defaults are ABR-generated Type 3 advertisements; NSSA defaults require separate area-specific consideration.[3]
For rollback, first remove default-information originate to stop advertising this exit.[1] Remove only the lab-specific static routes, SLA schedule/operation and tracking object after checking dependencies. Restore the saved pre-change configuration rather than replacing the whole OSPF process.
7. What this controls—and what it cannot
Outbound: OSPF default advertisements and E1/E2 selection guide internal routers toward an exit.[2][3] Treat the IP SLA target as a specific measurement, not a guarantee about all destinations or applications.[5]
Inbound: nothing in these snippets changes an Internet provider's BGP policy. Return-path engineering, NAT and firewall state require their own design and tests; this article does not claim symmetric failover.
Modern use: consider this as a border-to-internal routing pattern, not an EVPN/VXLAN tenant route or a Cisco ACI configuration recipe. If your proposed fabric uses OSPF only for infrastructure reachability, decide explicitly whether its underlay should receive a default at all.
Interview answer
In a normal OSPF area, I explicitly originate the default and set its external metric type.[1][3] Without a route map, ordinary origination depends on a local default; always removes that guard.[1] For failure detection I verify the upstream health condition and resulting withdrawal.[5] E1 and E2 affect exit selection, not Internet service health.[2]
Summary
Use explicit default origination, explicit metrics, and a tested withdrawal condition. The acceptance test is not merely that C1 receives a default: it is that C1 stops using a failed exit under the failure you actually care about.
Related reading
- OSPF route filtering: distribute lists versus ABR filter lists
- OSPF cost and reference bandwidth
- OSPF stub, totally stubby and NSSA areas
- BGP dual-ISP edge design
Post a Comment