In standard OSPF architectrues, every non-backbone area must maintain a direct connection to the backbone (Area 0) via an Area Border Router (ABR). Inter-area traffic is required to transit through Area 0. However, network topologies are sometimes constrained by physical limitations, leaving a non-backbone area isolated from the backbone. Similarly, network failures can partition the backbone itself. OSPF Virtual Links resolve these issues by creating a logical connection that bridges non-backbone areas to Area 0 or repairs a fragmented Area 0 through a designated transit area.

Because virtual links encapsulate OSPF traffic across intermediate areas, they introduce potential security vulnerabilities. To mitigate this, interface authentication—supporting plaintext, MD5, HMAC-MD5, and Keychain—should be configured to secure the virtual adjacency.

Topology and Base Configuration

Consider a network with four routers: Router-Alpha and Router-Beta act as ABRs connecting Area 0 and Area 1. Router-Gamma connects Area 1 and Area 2, while Router-Delta resides entirely in Area 2. Area 2 lacks a direct physical link to Area 0.

# Router-Alpha Configuration
sys
sysname Router-Alpha
interface LoopBack0
 ip address 1.1.1.1 255.255.255.255
interface Ethernet0/0/0
 ip address 192.168.12.1 255.255.255.0
interface Ethernet0/0/1
 ip address 192.168.13.1 255.255.255.0
quit
ospf 1 router-id 1.1.1.1
 area 0.0.0.0
  network 1.1.1.1 0.0.0.0
  network 192.168.12.0 0.0.0.255
 area 0.0.0.1
  network 192.168.13.0 0.0.0.255

# Router-Beta Configuration
sys
sysname Router-Beta
interface LoopBack0
 ip address 2.2.2.2 255.255.255.255
interface Ethernet0/0/0
 ip address 192.168.12.2 255.255.255.0
interface Ethernet0/0/1
 ip address 192.168.23.2 255.255.255.0
quit
ospf 1 router-id 2.2.2.2
 area 0.0.0.0
  network 2.2.2.2 0.0.0.0
  network 192.168.12.0 0.0.0.255
 area 0.0.0.1
  network 192.168.23.0 0.0.0.255

# Router-Gamma Configuration
sys
sysname Router-Gamma
interface LoopBack0
 ip address 3.3.3.3 255.255.255.255
interface Ethernet0/0/0
 ip address 192.168.13.3 255.255.255.0
interface Ethernet0/0/1
 ip address 192.168.23.3 255.255.255.0
interface Ethernet0/0/2
 ip address 192.168.34.3 255.255.255.0
quit
ospf 1 router-id 3.3.3.3
 area 0.0.0.1
  network 3.3.3.3 0.0.0.0
  network 192.168.13.0 0.0.0.255
  network 192.168.23.0 0.0.0.255
 area 0.0.0.2
  network 192.168.34.0 0.0.0.255

# Router-Delta Configuration
sys
sysname Router-Delta
interface LoopBack0
 ip address 4.4.4.4 255.255.255.255
interface Ethernet0/0/0
 ip address 192.168.34.4 255.255.255.0
quit
ospf 1 router-id 4.4.4.4
 area 0.0.0.2
  network 4.4.4.4 0.0.0.0
  network 192.168.34.0 0.0.0.255

With this base setup, Router-Delta's Link State Database (LSDB) only contains Type-1 and Type-2 LSAs from Area 2. It lacks the Area 0 LSAs (like 1.1.1.1/32 and 2.2.2.2/32) and inter-area routes because Area 2 is not logically attached to an ABR.

Implementing OSPF Virtual Links with Authentication

To resolve the isolation, a virtual link is configured across Area 1, connecting Router-Gamma to the ABRs (Router-Alpha and Router-Beta). HMAC-MD5 authentication is applied simultaneously to secure the transit traffic.

# Router-Alpha
ospf 1 router-id 1.1.1.1
 area 0.0.0.1
  vlink-peer 3.3.3.3 hmac-md5 10 cipher SecVLink!

# Router-Beta
ospf 1 router-id 2.2.2.2
 area 0.0.0.1
  vlink-peer 3.3.3.3 hmac-md5 10 cipher SecVLink!

# Router-Gamma
ospf 1 router-id 3.3.3.3
 area 0.0.0.1
  vlink-peer 1.1.1.1 hmac-md5 10 cipher SecVLink!
  vlink-peer 2.2.2.2 hmac-md5 10 cipher SecVLink!

Router-Delta can now reach Area 0. By default, the cost of both virtual links is 1, resulting in Equal-Cost Multi-Path (ECMP) load balancing via Router-Alpha and Router-Beta. If the design requires traffic to prefer the path via Router-Alpha with Router-Beta as a backup, you can manually adjust the OSPF cost on the virtual link interfaces.

Replacing Virtual Links with GRE Tunnels

OSPF virtual links are considered a transitional mechanism. A more robust alternative to logically extend Area 0 across a transit area is to establish a Generic Routing Encapsulation (GRE) tunnel and assign it to the OSPF backbone process.

# Router-Alpha
interface Tunnel0
 ip address 172.16.0.1 255.255.255.0
 tunnel-protocol gre
 source 192.168.13.1
 destination 192.168.13.3
ospf 1 router-id 1.1.1.1
 area 0.0.0.0
  network 172.16.0.1 0.0.0.0

# Router-Gamma
interface Tunnel0
 ip address 172.16.0.2 255.255.255.0
 tunnel-protocol gre
 source 192.168.13.3
 destination 192.168.13.1
ospf 1 router-id 3.3.3.3
 area 0.0.0.0
  network 172.16.0.2 0.0.0.0