OSPF

OSPF lets routers tell each other which networks they have. Add a network and the others know within seconds. Lose a link, and if a second path exists it gets used on its own. That is the gain. The price is a protocol that thinks along, and can therefore do things you did not expect.

When this helps and when it does not

The rule of thumb is dull but it holds: under three routers, or with only one path between your sites, OSPF is overkill. Two static routes are clearer, they do exactly what they say, and you can read them back at a glance.

OSPF starts to pay off once:

• you have more than a handful of routers that need to know each other's networks;
• several paths genuinely exist, so there is something to choose between when one fails;
• networks come and go regularly and you do not want to update a route on every router.

For an office with one router and one uplink you do not need this. Look at Static routes instead.

Where it lives

OSPF sits in the Routing (OSPF, BGP, policy) section, which is off by default. In the wizard you meet it in the Core router role: that role starts without a bridge, with addresses straight on the interfaces, no NAT and no fasttrack, and its first step is called Routing.

First: addresses and a router id

At the top of the section is Addresses on interfaces. A core router usually has no bridge, but an address per port or per VLAN. Put those addresses in before you switch OSPF on; without an address on an interface there is nothing to advertise.

Below that is the loopback/router-id address. Fill it in and the tool creates a bridge called lo with no spanning tree and puts your address on it as a /32. That address then also becomes the router id. A loopback is convenient because it does not go away when a physical port does. You can then leave the Router-ID field under OSPF empty.

Give every router its own router id and keep them apart. Two routers with the same id give you an OSPF neighbour that keeps flapping, and that is an unpleasant hour of searching.

Areas

The tool starts with one area: backbone with area id 0.0.0.0. For almost every network you would use this on that is enough, and you do not have to touch it. You can add areas with a name, an area id written as an IP address, and a type: default, stub or nssa. A second area only makes sense once you have so many routers that you want to split the database, and by then you usually know why.

Interface templates

This is the part that decides where OSPF speaks. Each row picks an area and then either an interface, or one or more networks instead. You do not need both; pick whichever is clearer.

Cost

Default 10. The lower the number, the more OSPF prefers this path. That is how you turn a second link into a backup: give the slow line a higher cost.

Passive

The network is advertised, but no neighbours are looked for on it. Switch this on for anything facing users. An office VLAN has no business seeing OSPF packets.

MD5 auth

Set per template. As soon as one template has it on, the field for the shared OSPF MD5 key appears, with a button to generate one. Every router in the same area needs the same key.

Two choices sit at the bottom: Redistribute (connected by default, plus static, bgp and rip) and Originate default route with never, if-installed or always. Only the router that actually has internet should advertise a default route, and preferably with if-installed, so it stops as soon as its own uplink is gone.

What the tool generates

Three blocks, in this order:

• /routing ospf instance named ospf-v2, version 2, with your router id, the redistribution and optionally originate-default.
• /routing ospf area, one line per area, attached to that instance.
• /routing ospf interface-template, one line per template, with area, interface or networks, cost, passive, and with auth on, auth=md5 and the key.

On the device you check it with /routing ospf neighbor print. Neighbours in Full are good; one stuck in Init or 2-Way means area, netmask, timers or authentication differ between the two ends.

The limits

• The tool generates OSPFv2, so IPv4. IPv6 needs OSPFv3 and the tool does not write that.
• There is one instance. Several instances or VRFs are hand work.
• No routing filters are generated for OSPF. What you redistribute, you redistribute whole.
• A v6 OSPF configuration is not converted. When you import a RouterOS v6 export, every /routing ospf line is kept as a comment labelled "convert by hand" with a pointer to the manual. That is deliberate: the OSPF menu structure is entirely different in v7, and a guessed OSPF configuration is worse than none. Set OSPF up again with this section. See From RouterOS v6 to v7.

Read on

Static routes and policy routing for the simple alternative, BGP for peering with other networks, and Site to site tunnels if OSPF has to run over a tunnel.