assume that I have 4 buildings which all connected to main building and in each building I have privileged subnet ( red circles ). privileged subnet must be able to connect each other, and rest of the subnet connect together. Can someone explain how can I do this using OSPF ? Thanks


  • I'm sorry, but I can't understand what you're trying to accomplish here. Are you wanting to add OSPF to the existing network? Or are you trying to do some sort of "private" OSPF setup? Please explain further your design goals on this one. – Keller G Apr 16 '13 at 19:18
  • Thanks for reply. I would like to isolate one subnet from each building. I tried to add two ospf id in each router in order to isolate one subnet from others but it doesn't work. All pc can ping. – Soheil Apr 16 '13 at 19:28

I think you might be going about this the wrong way. If you're wanting to prevent certain subnets from communicating with other subnets, you need a firewall, not separate OSPF instances. The 'OSPF ID' in Cisco devices is not like an AS number in EIGRP. The ID is locally-significant and 'router ospf 1' and 'router ospf 999' will happily form neighborships and work fine.

You can use a dedicated firewall device (probably near your edge routers) or just plain ACLs to restrict access between subnets. For instance, on R4 you might do this...

! from the into the router interface and towards other private subnets
ip access-list extended acl-private-subnet-in
permit ip
permit ip

! from other private subnets and out of the router interface and towards
ip access-list extended acl-private-subnet-out
permit ip
permit ip

interface <interface towards switch6>
ip access-group acl-private-subnet-in in
ip access-group acl-private-subnet-out out

If you really wanted to go to crazy town, you could also create a separate vrf for your "private" subnets, run MPLS in your core, enable MP-BGP to exchange labels, and treat the whole network as a L3VPN. But I'm betting that's a little more than what you're needing here. =)

Hope this helps,


  • For complete blocking ACL's should be plenty, or just specify what subnets OSPF should advertise instead of using This really looks like a homework question though. – cpt_fink Apr 18 '13 at 4:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.