NSSA ABR doesn't translate LSA7 to LSA5

[conf-t]

Hello,

I have this architecture:

from router372515 database, I can see only one loopback route received from router372517.. Normally, I have to see 2 routes on the database: one from the ABR 372517 and the other from the NSSA ABR 372516?? P Bit is 0 so this NSSA ABR does not translate the LSA7 to LSA5 unless I shutdown the interface

f0/1

of the ASBR!!!

Any solution?

[MHM Cisco World]

Since ..16 learn same prefix E from ..17 router it dont translate from lsa7 to lsa5

You need to add filter in ..15 to not advertise prefix to ..16

[conf-t]

from the output of 

#show ip ospf rib

on router 16:

Router#show ip ospf rib

OSPF local RIB for Process 1
Codes: * - Best, > - Installed in global RIB

*> 1.1.1.0/24, Intra, cost 20, area 0
via 2.2.2.1, FastEthernet0/0
* 2.2.2.0/24, Intra, cost 10, area 0, Connected
via 2.2.2.2, FastEthernet0/0
*> 3.3.3.0/24, Inter, cost 30, area 0
via 2.2.2.1, FastEthernet0/0
* 4.4.4.0/24, Intra, cost 10, area 2, Connected
via 4.4.4.1, FastEthernet0/1
*> 10.10.10.10/32, NSSA2, cost 20, area 2, tag 0
via 4.4.4.2, FastEthernet0/1

As you see, it learns

10.10.10.10

only from the ASBR not from 17 as you said

[MHM Cisco World]

Check ospf DB not RIB and see 

[conf-t]

Here the output of

#show ip ospf

database on router16

Router#show ip ospf database

OSPF Router with ID (3.3.3.3) (Process ID 1)

Router Link States (Area 0)

Link ID ADV Router Age Seq# Checksum Link count
2.2.2.1 2.2.2.1 598 0x8000000B 0x00D808 2
2.2.2.2 2.2.2.2 524 0x80000013 0x0041BB 1
3.3.3.3 3.3.3.3 634 0x80000010 0x003DB2 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# Checksum
1.1.1.2 2.2.2.2 785 0x80000004 0x00BF5B
2.2.2.2 3.3.3.3 634 0x80000009 0x009575

Summary Net Link States (Area 0)

Link ID ADV Router Age Seq# Checksum
3.3.3.0 2.2.2.2 524 0x80000007 0x0039E2
4.4.4.0 3.3.3.3 386 0x80000008 0x00F41F

Summary ASB Link States (Area 0)

Link ID ADV Router Age Seq# Checksum
4.4.4.4 2.2.2.2 1047 0x80000002 0x00E830

Router Link States (Area 2)

Link ID ADV Router Age Seq# Checksum Link count
3.3.3.3 3.3.3.3 1144 0x8000000D 0x004999 1
4.4.4.4 4.4.4.4 1176 0x8000000C 0x000AD1 1

Net Link States (Area 2)

Link ID ADV Router Age Seq# Checksum
4.4.4.1 3.3.3.3 1145 0x80000002 0x007D80

Summary Net Link States (Area 2)

Link ID ADV Router Age Seq# Checksum
1.1.1.0 3.3.3.3 637 0x80000006 0x006F9F
2.2.2.0 3.3.3.3 389 0x80000009 0x00E032
3.3.3.0 3.3.3.3 637 0x80000007 0x008974

Type-7 AS External Link States (Area 2)

Link ID ADV Router Age Seq# Checksum Tag
10.10.10.10 4.4.4.4 1178 0x8000000C 0x006FEB 0

Type-5 AS External Link States

Link ID ADV Router Age Seq# Checksum Tag
10.10.10.10 4.4.4.4 1180 0x80000009 0x0091CE 0







Note that 4.4.4.4 is the ASBR

[MHM Cisco World]

I send you private message 

[Kanan Huseynli · Accepted solution]

Type-7 AS External Link States (Area 2)

Link ID ADV Router Age Seq# Checksum Tag
10.10.10.10 4.4.4.4 1178 0x8000000C 0x006FEB 0

Type-5 AS External Link States

Link ID ADV Router Age Seq# Checksum Tag
10.10.10.10 4.4.4.4 1180 0x80000009 0x0091CE 0

As it is also seen from OSPF DB, your ASBR (4.4.4.4) has generated both type5 and type7. Router16 receives type7 from directly connected nssa area, but type5 from backbone area.

Since, ASBR generated both type5 and type7 , P-bit is cleared, and now Router16 does not do translation.

[conf-t]

Thank you Kanan for your response,

Yes you are right! after, I created another process on the ASBR for only the nssa area and now it's working, I have route with

2 nexthops

on the 15 router! I don't know why but it's working

[Kanan Huseynli]

Another OSPF process, is another routing source. All rules are applicable within routing source.

[Kanan Huseynli]

Hello,

P-bit is cleared on NSSA Border device, if it is also ASBR (attached to another area where it should generate Type5). In order, words if redistributing router generates both type5 and type7 for the same route, then it clears P-bit in type7. Thus, it is can not be translated by NSSA ABR.

When an NSSA border router originates both a Type-5 LSA and a Type-7
   LSA for the same network, then the P-bit must be clear in the Type-7
   LSA so that it isn't translated into a Type-5 LSA by another NSSA
   border router.

https://datatracker.ietf.org/doc/html/rfc3101#section-2.4 

Exactly this happens in your topology. That's why you see P bit value as "zero" and you don't have type5 (translated) from 16 router and 15 router has only one type5 in DB.

[Blue_Bird]

When multiple ABRs connect the NSSA to

area 0

the ABR with the highest router-id is elected as the Type-7 to Type-5 translator, and is responsible for re-originating the Type-5 LSA into

area 0

The re-originated Type-5 External LSA contains the Forwarding Address for the route to the External network. So even though an ABR won an election to translate the Type-7 LSA, it doesn’t mean that it will be in the forwarding path. If other areas have a shorter path to the external route via another ABR, then their traffic will take that path. 

Thanks

[conf-t]

I have only one ABR connect the NSSA to

area 0!

Making NSSA

area and area 1

in different ospf processes on ASBR solve the problem.