passive-interface
Silences dynamic routing protocol traffic on a specific interface. When applied, OSPF completely stops sending Hello packets out of the port, preventing any neighbor adjacencies from forming on that link. However, the router still advertises the interface's subnet to the rest of the OSPF domain.
Quick Reference
Router(config-router)#passive-interface defaultSyntax & Scope Mechanics
If you enable OSPF on an interface connected to a switch full of PCs, the router will broadcast OSPF Hello packets to those PCs every 10 seconds. This wastes bandwidth, burns CPU cycles, and presents a massive security risk (a user could run Kali Linux, intercept the Hellos, and inject fake routes).
- Targeted Mode: Use
passive-interface g0/1to silence a single, specific interface while leaving all others active. - Default Mode: Use
passive-interface defaultto instantly silence every interface on the router. You must then manually wake up the specific uplinks connected to other routers. This is the enterprise best practice.
CLI Deployment Scenarios
Scenario 1: Silencing a Local Subnet
GigabitEthernet0/1 connects to the local Sales VLAN. You want other routers to know the Sales subnet exists, but you do not want to send OSPF traffic to the Sales PCs.
Scenario 2: The "Default-Deny" Architecture
You have a router with 20 interfaces. Only 2 of them connect to other OSPF routers. Instead of typing passive-interface 18 times, you invert the logic.
CCNA Exam Gotchas
The Dead Adjacency Trap
If a troubleshooting ticket shows that Router A and Router B are directly connected and their IP addresses are in the correct OSPF network statements, but they are stuck in an INIT state or have no adjacency at all—check the passive interfaces. If an admin accidentally applied passive-interface to the point-to-point link connecting the two routers, the OSPF relationship will completely fail to form.
Passive vs. Removing the Network
Do not confuse passive-interface with no network....
If you use no network, the router completely forgets about the subnet, and other routers will not be able to route traffic to it. If you use passive-interface, the router successfully shares the route with its neighbors, it just stops sending multicast Hellos out of that specific local port.