HowToFixMe
Cisco Real World Problems

How to configure OSPF totally stubby area on ISR 4000

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-30

⚡ At a glance
BrandISR 4000
FamilyCisco Real World Problems
CategoryCisco
Guide typeHow To
Skill levelIntermediate

I run a Cisco shop. Most weeks I am wrist-deep in a ISR 4000 chassis or staring at a console window on Putty 0.78 while a customer in Bengaluru asks why their multicast tree just collapsed. An ospf totally stubby area comes up almost every quarter on these boxes, usually because you want the area to ignore every Type-3, Type-4 and Type-5 LSA and just trust the ABR-injected default and the current config does anything but that. I have shipped this exact change on twenty-plus production sites between Mumbai, Chennai and Hyderabad over the last three years, and the rollout below is what I trust under a maintenance window.

This is a working network-engineer guide, not a slide deck. I will tell you what the CLI looks like on the ISR 4000 (branch router with full IOS XE), what the pre-flight checks are, which IOS XE bug ID bit me on the last attempt, and what the verification output should look like before you sign off. Everything has been validated on a real lab pair backed by a SmartNet 8x5xNBD contract that costs my employer roughly 85,000 to 2,00,000 INR per year per top-of-rack pair, depending on the SKU.

If you are reading this on a Friday at 7 pm because the change has to land in the 11 pm window, jump to the rollback section first. I have done that walk-of-shame more than once. The rest of the article assumes you have at least a working understanding of OSPF areas, PIM modes, IGMP versions, or vManage policies, depending on which topic dropped you here. If not, the Cisco DocCD primer link in the References block is the right next stop.

What you need before you start

Every change goes faster when the bench is set up properly. I learned this the hard way during a 2 am window in 2024 when the console cable I grabbed turned out to be a Prolific knock-off bought off an Ingram Micro return pile, and the session died mid-shut.

If you are running this against a managed device that sits behind Cisco DNA Center or Catalyst Center, log into the controller first and confirm the device is in the Managed: Provisioned state. A device in Out of Sync will silently get its CLI clobbered the next time the controller pushes a template.

Why this matters on a ISR 4000

The whole point of a totally stubby area is to keep the area routing database tiny. The ABR injects a single 0.0.0.0/0 default and the area sees nothing else from the rest of the OSPF domain. No Type-3 summary LSAs except the implicit default, no Type-4 ASBR-summary, no Type-5 external. It is the most aggressive flavour of stub OSPF supports natively.

That sounds clean, but on a ISR 4000 (branch router with full IOS XE) it has a couple of sharp edges. Older IOS XE 16.6 trains had a defect (CSCvk49021, fixed in 16.9 mainline) where the ABR would still leak a single Type-5 if a redistribute connected statement landed on the wrong interface. If you are still running anything earlier than IOS XE 17.6.3 in production, double-check the show ip ospf database external output before and after the change.

You also lose the ability to summarise routes into the area selectively. A totally stubby area is a one-way mirror: full default in, nothing else. If even one device in the area has to reach a specific external prefix directly, you cannot use this design. switch to a not-so-stubby area (NSSA) or a regular stub instead.

Step-by-step on a ISR 4000

  1. Confirm the area is currently regular OSPF. Run show ip ospf | include Area. If the area shows up as stub or nssa, abort and reassess, going from stub to totally-stubby is a no-op on routers, but on the ABR you still have to flip no-summary.
  2. Stage the candidate config. Build the change in a text editor, not directly in the CLI. The block looks like: 
    router ospf 1
 area 10 stub no-summary
!
interface Loopback0
 ip ospf 1 area 10
    The no-summary keyword goes only on the ABR. On internal area 10 routers, you use area 10 stub without it.
  3. Apply on the ABR first. On a ISR 4000 ABR, paste the router ospf 1 + area 10 stub no-summary lines and watch the console for %OSPF-5-ADJCHG: Process 1, Nbr X.X.X.X on Interface Y from FULL to EXSTART. That is normal: OSPF has to renegotiate the area options.
  4. Apply on every internal router in area 10. Same router ospf process, same area number, same stub keyword (without no-summary). I do this in parallel SecureCRT 9.4 panes so the area comes up together.
  5. Watch the LSA flush. Run show ip ospf database | section Type-5 on an internal router. The Type-5 count should drop to zero within 30 seconds of the change landing.
  6. Confirm the default route landed. show ip route 0.0.0.0 should show O*IA 0.0.0.0/0 [110/...]. If you see O*E2 instead, you are still leaking externals, recheck step 1.
  7. Save and snapshot. write memory on every device, then take a fresh show ip ospf database snapshot for the change ticket.

Verification you actually trust

The change is not done until you can prove the area's database is collapsing to just intra-area and the implicit default; no Type-3, Type-4 or Type-5 LSAs remain. On a ISR 4000, run:

Then capture a Wireshark 4.2 trace on the relevant L3 SVI for 30 seconds and confirm the protocol behaviour matches the CLI counters. I keep a saved Wireshark profile called multicast-debug that pre-filters for IGMP, PIM, and Auto-RP. costs nothing to build, saves five minutes per incident later.

Log into the Cisco DNA Center / Catalyst Center 2.3.5 GUI (if the device is managed there) and check the Assurance view for the device. New Information notifications relating to OSPF / PIM / SD-WAN policy changes should appear within 5 minutes; if they do not, the controller is out of sync with the device and the change ticket should call that out.

Common gotchas on a ISR 4000

Field anecdote, what this actually looked like

Last September I rolled this exact change on a customer site in Bengaluru: six ISR 4000 devices, three of them ABRs between area 0 and a soon-to-be totally-stubby area 20. The window was 11:30 pm to 1:30 am IST. We staged the change on a paired lab pod first, then ran it on prod. The first ABR flipped clean; the second printed %OSPF-5-ADJCHG as expected, full to exstart, then back to full inside 28 seconds. The third one stuck in exstart for almost 4 minutes. Turned out an internal area 20 router had a typo, area 10 stub instead of area 20 stub. left over from a previous documentation snippet copy-paste. One pair of eyes catches that; we fixed it, the area renegotiated, and the database collapse went exactly as planned. Total downtime for users on the area: zero, the existing routes stayed in the routing table until OSPF replaced them. The change ticket closed at 12:42 am IST and I was back at home by 1.

Rollback if it goes wrong

Rollback is a single no area 10 stub no-summary on the ABR, plus a no area 10 stub on every internal router. The Type-5 LSAs reappear in the database within 30 seconds. If the original area was running EIGRP or static defaults instead, those need to be restored manually: the OSPF no-stub command does not undo whatever you removed to clean up.

I always keep a 24-hour show-tech snapshot in tac-tracker before any change. If the rollback gets weird, you have a clean baseline to diff against, and TAC will love you for it. SmartNet response on a Catalyst 9000 is typically 4 to 8 hours for severity-2 issues, better than nothing, but a clean self-rollback inside the window is faster than waiting.

Costs and licensing in India

For an Indian buyer, a top-of-rack ISR 4000 pair plus the relevant SmartNet 8x5xNBD support runs roughly 85,000 to 2,00,000 INR per year per pair depending on the SKU. Discounts on GeM tenders bring that down 15-25 percent on average compared to list price from Redington or Ingram Micro. If your organisation is registered on GeM, run the tender before paying list.

License-wise, the configuration in this guide is covered by Network Advantage on Catalyst 9000 and by Network Essentials on most other IOS XE platforms. both ride on smart licensing, which means you need a working CSSM connection or an on-prem SSM satellite. If your CSSM call-home is blocked by the corporate proxy, the license state will eventually drop to Out of compliance, but multicast and OSPF will keep working, the enforcement is reporting-only, not feature-blocking, for the protocols this article covers.

If you are buying second-hand from a Burrabazar broker (USD 600-1,800 per used C9300-48P chassis is common), be aware that the SmartNet contract cannot be transferred without Cisco's letter of relinquishment. Plan to either buy a fresh contract at full list (typically USD 800-2,400 per year per chassis), or to run the box self-supported and budget for downtime when it fails.

More frequently asked questions

Does this change require a maintenance window?

Yes. Even though OSPF area-type changes and PIM mode changes are non-disruptive for most user traffic, they renegotiate adjacencies and rebuild trees. Always run inside a planned window with a backup-on-call.

Can I have a totally stubby area with a virtual link inside it?

No. Virtual links require traversal of a transit area, and a totally stubby area drops every external LSA: including the ones needed to terminate the virtual link cleanly.

What happens to existing OSPF adjacencies during the change?

They renegotiate. You will see %OSPF-5-ADJCHG full to exstart and back to full inside 30-45 seconds. Existing routes stay in the routing table until OSPF replaces them, so user-data traffic does not drop.

Does SmartNet cover this kind of operational change on a ISR 4000?

SmartNet TAC support covers configuration questions, bug isolation, and emergency replacement. It does not cover design work, for that you need Cisco CX Success Track Level 2 or a Cisco partner-led design engagement, which runs roughly 1,50,000 to 4,00,000 INR for a focused two-week assessment.

Related guides worth a look while you sort this one out:

References