How to Configure OSPF Dynamic Routing Between Layer 3 Switches

Step by step

1. Understand when OSPF helps

   Static routes are fine for one or two sites. With several buildings, a campus core or redundant links, OSPF learns routes automatically and reroutes when a link fails. All switches in one area share the same map of the network.

2. Plan area 0 and router IDs

   Start with a single backbone area 0. Give each switch a stable router ID, usually a loopback address such as 10.255.0.1, 10.255.0.2 and so on. Write the plan down before you touch any device.

3. Create loopbacks

   Loopbacks never go down, which keeps the router ID and management address stable.

   interface loopback 0
    ip address 10.255.0.1 255.255.255.255
   

4. Configure point-to-point links

   Use a small subnet per link and set the OSPF network type to point-to-point, which avoids DR/BDR elections and speeds up convergence.

   interface vlan 900
    ip address 10.0.0.1 255.255.255.254
    ip ospf network point-to-point
   

5. Enable OSPF and advertise networks

   Advertise the loopback, the transit links and the user VLANs that should be reachable.

   router ospf 1
    router-id 10.255.0.1
    network 10.255.0.1 0.0.0.0 area 0
    network 10.0.0.0 0.0.0.1 area 0
    network 10.10.0.0 0.0.255.255 area 0
    passive-interface default
    no passive-interface vlan 900
   

6. Make user VLANs passive

   Passive interfaces are advertised but never form neighbours, so a laptop on a user VLAN cannot inject routes. 'passive-interface default' with exceptions for transit links is the safest pattern.

7. Authenticate neighbours

   Use message-digest or SHA authentication so rogue devices cannot join OSPF.

   interface vlan 900
    ip ospf authentication message-digest
    ip ospf message-digest-key 1 md5 <strong-key>
   

8. Originate a default route

   On the switch that connects to the firewall, inject a default route into OSPF.

   router ospf 1
    default-information originate
   

9. Verify neighbours and routes

   Every neighbour should reach the FULL state, and remote subnets should show as O routes.

   show ip ospf neighbor
   show ip route ospf
   

10. Test failover

    Shut one link in a maintenance window and confirm traffic moves to the alternate path within seconds. Bring it back and confirm routes return.

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.