OSPF overload protection limits the number of Link State Advertisements a router will process, preventing excessive LSA floods from consuming CPU, memory, and bandwidth. The max-lsa command controls LSA thresholds, warning percentages, temporary shutdown behavior, and reset timers.
OSPF Overload Protection
Open shortest path first, or OSPF, is a powerful routing protocol. These routers exchange link state advertisements, updates of what's happening on the network, so each router has an understanding of the whole map of how the network is set up.
The problem is that the network is constantly changing and things are going up and down. It can cause a flood of these link state advertisements on our network and cause problems. It can eat up resources such as router CPU, VI, and bandwidth and memory. So we may need to be able to protect our routers and our network against too many link state advertisements. We can do an overload protection with OSPF.
When it comes to OSPF, here are some of the packets that get exchanged back and forth. Although it's powerful at finding the right route and getting to certain networks, it also can cause problems when there's a flood of this information going back and forth.
What we can do on our routers for our OSPF processes is set up a certain amount of LSAs that can come through. Perhaps we set it up to 50,000, and so we'll accept 50,000 LSAs from other routers. But at that point in time, what will happen to it?
First of all, we have a warning that will happen. Before we actually hit 50,000, there is some sort of warning that gets triggered. Perhaps it gets triggered at the 75% mark, so at 37,500 we see a warning that comes. Then next, if it continues to go up and hits this 50,000, then it will go into a temporary shutdown. If that happens enough, then it will go into a permanent shutdown, and then manual intervention is going to need to be required to get it back up and running, because there's probably something wrong on the network.
If we find that we need to change any of the numbers or any of the thresholds on here, we can use this command, max-lsa, and then with a set of parameters in order to change things from the default settings.
The very basic part of this command is this max-lsa and then a number. This number is represented by this maximum LSA threshold, so that's what that is, and the default is 50,000. But let's say we wanted it to be more sensitive. Let's say we wanted to set it to 25,000. So if we set it to 25,000 instead, that means once it's reached 25,000 LSAs, that's when it's going to stop accepting LSAs.
The other aspect to this is a reset time. The reset time comes right here at the end, with reset time and then a specification in minutes. That means it will reset this counter in whatever that's going to be. So 10 minutes is the default, but let's say we wanted this to be more sensitive, then we would set it higher, so we would set it to maybe 20 minutes. Or maybe we wanted to reset it more often, so maybe it's every 5 minutes.
But whatever you set it to, let's say it's set to 10 minutes. So we have 10 minutes here, and that means that it's going to count how many LSAs are coming in throughout time here. If it reaches 25,000 before it hits this 10-minute mark, that's when it's going to hit that threshold and shut things down and stop listening. Otherwise, if it goes past this 10 minutes, at that point in time it resets the counter and things are okay.
Before things get shut down, there is going to be something else that we'll receive, and that is a warning. We'll get a warning at whatever percent that we set this to be. The default is 75%. What that means is once it hits 75% of 50,000, which happens to be 37,500, we will get a warning at that point in time.
We can change that percentage here. If we want to get warned sooner, then we would set something at 50%. Or if we wanted to get warned a little bit later in the process, then maybe it's at 90%. So then we would set this percentage right here in the command to whatever percent that we wanted to get warned at.
Let's say we do get to the 50,000 within our 10 minutes. Then what's going to happen is it's going to go into temporary shutdown. The temporary shutdown phase means that it's going to stop listening to new LSAs, that it's not going to process those new LSAs. So it's going to do that, but we need to also say, okay, when do we want to recover from this? And there's this ignore time. So five minutes, so after 5 minutes then it starts listening to LSAs again.
The temporary shutdown helps if there are some outliers and something happens on our network that's just a little crazy for that moment in time. It solves itself, and then our SPF is running normally again.
However, if we continually have that problem, then we need something more permanent, and so there is this ignore count. The default is five, and we can specify something different that we see right here. So ignore count and then the count number, and that is the number of times that the temporary shutdown is reached, and then what will happen is it'll go into the permanent shutdown. So if we get temporary shut down four times, then the fifth time it will actually go into a permanent shutdown.
Let's see what that looks like on our router. I'm on router 1 right here, and what I'm going to do is get into the global configuration mode, and then we'll get into our router process, so router ospf 10. Here's where I'm going to set this, so I'm going to do max-lsa and then we have the number. Let's say we're setting this to 40,000, we're making it just a little more sensitive here. And we want to be warned a little bit sooner as well, so maybe we're going to hit 70% rather than the 75%.
And then the ignore time. Let's say we're going to set the ignore time to 5 minutes. And then we'll do the ignore count, and we'll set the ignore count to, let's say, we'll do four, so we're going to set it into permanent shutdown a little sooner. Or maybe we want it to trigger the temporary more often but the permanent less often, so maybe we set this to 10 right here.
And then we'll do our reset time, and we're going to set that to 20 minutes, once again making it a little more sensitive there. So then I'd execute this. And of course I could use the no command.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →