Passive-interface default resets configuration

[joshuacmoore]

Hello all,

I would like to run a scenario by you guys and get your input regarding the "passive-interface default" OSPF command. Let's assume I am working on an existing configured OSPF router with the following configuration:

router ospf 1
 router-id 10.10.10.1
 passive-interface default
 no passive-interface GigabitEthernet6/1
 no passive-interface GigabitEthernet6/2
 network 10.10.10.0

If I go and paste the duplicate configuration in as follows what would the expected result be?

router ospf 1
 router-id 10.10.10.1
 passive-interface default

My thoughts were that there would be no impact to OSPF, routing, or the likes. Unfortunately this is not the case. I have found on my device that when you repaste the "passive-interface default" command in to the config that it actually resets all existing "no passive-interface" commands and enables passive-interface on all interfaces globally.

Router#sh run | sec router ospf
router ospf 1
 router-id 10.10.10.1
 passive-interface default
 no passive-interface GigabitEthernet6/1
 no passive-interface GigabitEthernet6/2
 network 10.10.10.0
Router#config t
Router(config)#router ospf 1
Router(config-router)# passive-interface default
Router(config-router)#end
Router#sh run | sec router ospf
router ospf 1
 router-id 10.10.10.1
 passive-interface default
 network 10.10.10.0

This is especially bad if you are performing maintenance on the router out of network where your connectivity requires a default route to be learned via OSPF. Has anyone else encountered this or do they feel this behavior to be a bit odd?

[daniel.dib]

Documentation says:

"The default keyword sets all interfaces as passive by default. You can then configure individual interfaces where adjacencies are desired using the nopassive-interface command. The default keyword is useful in Internet service provider (ISP) and large enterprise networks where many of the distribution routers have more than 200 interfaces."

I'm not sure why it doesn't honor the existing no passive-interface commands but maybe it was something in the code that was necessary to put them all passive first.

At least it's good that you tested the behavior so you know what to expect. If you already have passive-interface why would you want to enter it again? If you want to make interfaces passive that were non passive before you could do no no-passive interface x/x.

Daniel Dib
CCIE #37149

[joshuacmoore]

I hit this issue while performing actual maintenance. When I build my standardized config templates, I keep an all-inclusive list of commands that should be part of the config and paste them in as a whole. I guess this is just something that I am going to have to omit from the standard config template used for OSPF as there is no way to apply "passive-interface default" command to OSPF without it being service impacting.

Sent from Cisco Technical Support iPhone App

[James Sears]

Hi Joshua,

We recently deployed the passive-interface default command throughout our network and the first time I was configuring it I tried to paste the command in along with the 'no passive-interface [WAN int]'. Of course what happened was that as soon as the passive command hit I lost connection to the router since every interface went passive and the no passive-interface commands never made it to the router. The solution I came up with was to tftp all of my commands to the router as a text file and then copy the *.txt file to the running config. Then it took the new passive-interface command (which wiped out all the non passive interfaces) but then it also added the 'no' version of the command for the WAN interfaces that we didn't want passive. These commands were all together in the same text file I tftp-ed to the router. Worked great for us maybe it'll help you also.

[Richard Burts]

It may be surprising when you first encounter it, but the behavior that passive-interface default will reset the configuration of every interface has been in IOS for quite a while. Using TFTP to send the commands rather then keying them in manually is a good workaround.

HTH

Rick