Network Addressing and Edge Routing

The public-facing infrastructure utilizes distinct subnets for serial links. The ISP device restricts configuration strictly to IP assignments and forwarding. All branch routers establish static default routes toward the public gateway.

sysname ISP_Node
interface Serial4/0/0
 ip address 203.0.113.2 30
interface Serial3/0/0
 ip address 198.51.100.2 30
interface Serial4/0/1
 ip address 192.0.2.2 30
interface GigabitEthernet0/0/0
 ip address 203.0.113.10 29

sysname HUB_R3
interface Serial4/0/0
 ip address 203.0.113.1 30
ip route-static 0.0.0.0 0 203.0.113.2

sysname SPOKE_R5
interface Serial4/0/0
 ip address 198.51.100.1 30
interface LoopBack0
 ip address 10.50.2.1 24
ip route-static 0.0.0.0 0 198.51.100.2
# Remaining spokes (R6, R7) apply identical logic with unique 10.50.3.1/24 and 10.50.4.1/24 loopbacks

NHRP-Based Multipoint GRE Overlay

Deploy a Point-to-Multipoint GRE tunnel framework. The hub router hosts the NHRP registration service, while spoke interfaces dynamically register their physical source addresses to establish direct overlay connectivity.

sysname HUB_R3
interface Tunnel0/0/0
 ip address 10.50.1.1 29
 tunnel-protocol gre p2mp
 source 203.0.113.1
 nhrp domain-id 100
 nhrp registration whitelist enable
 nhrp entry multicast dynamic

sysname SPOKE_R5
interface Tunnel0/0/0
 ip address 10.50.1.2 29
 tunnel-protocol gre p2mp
 source Serial4/0/0
 nhrp domain-id 100
 nhrp entry 10.50.1.1 203.0.113.1 register
# Spokes R6 and R7 map their respective physical interfaces as sources using the same tunnel logic

Multi-Area OSPF Initialization and Redistribution

Distribute routing information across five logical OSPF domains. Configure area boundaries, inject physical and loopback interfaces, and redistribute legacy RIP routes into the OSPF process at the domain edge.

sysname CORE_R3
ospf 1 router-id 10.50.0.3
 area 0.0.0.1
  network 10.50.32.0 0.0.3.255
  network 10.50.36.0 0.0.0.255
 area 0.0.0.0
  network 10.50.1.1 0.0.0.0

sysname SPOKE_R5
ospf 1 router-id 10.50.0.5
 area 0.0.0.0
  network 10.50.0.0 0.0.255.255

sysname BRANCH_R12
rip 2
 version 2
 network 10.50.0.0
 undo summary
ospf 1 router-id 10.50.0.12
 area 0.0.0.2
  network 10.50.65.0 0.0.0.255
 import-route rip 2
# Remaining routers declare their specific subnets within Area 3 and Area 4 following the same process hierarchy

Route Aggregation and Loop Prevention

Compress inter-area and external routing advertisements at ABR and ASBR nodes. Install summary routes pointing too the Null0 interface on aggregating routers to absorb unmatched traffic and prevent routing loops.

sysname CORE_R3
ospf 1
 area 0.0.0.1
  summary 10.50.32.0 255.255.224.0
ip route-static 10.50.32.0 19 NULL 0

sysname AGG_R9
ospf 1
 asbr-summary 10.50.128.0 255.255.224.0
ip route-static 10.50.128.0 19 NULL 0
# Repeat summary binding on R6, R7, and R12 with their respective aggregated prefixes

Special Area Topologies

Restrict LSA propagation by converting peripheral areas into Stub or Totally NSSA types. This forces leaf routerrs to rely on default routes for external and inter-area traffic, drastically reducing the local routing table size.

# Area 1 configured as Totally Stub
sysname R1
ospf 1
 area 0.0.0.1
  stub no-summary

# Areas 2 and 3 configured as Totally NSSA to permit controlled external route injection
sysname R6
ospf 1
 area 0.0.0.2
  nssa no-summary
sysname R7
ospf 1
 area 0.0.0.3
  nssa no-summary
# Adjacent routers in Areas 2 and 3 declare standard NSSA without the no-summary parameter to match ABR configuration

Egress Translation, Authentication, and Convergence

Implement source NAT for private subnets exiting toward the ISP. Secure OSPF area updates using MD5 authentication. Reduce OSPF hello timers on NBMA tunnel interfaces to accelerate link failure detection.

sysname CORE_R3
acl number 2010
 rule permit source 10.50.0.0 0.0.255.255
interface Serial4/0/0
 nat outbound 2010
ospf 1
 area 0.0.0.1
  authentication-mode md5 1 cipher NetSec@Key
interface Tunnel0/0/0
 ospf timer hello 5
# Apply identical ACL, NAT binding, MD5 keys, and timer adjustments across all edge routers (R5, R6, R7)