A few days ago a member of the cisco-nsp mailing list asked an interesting question: “the passive-interface command is not available in a VRF OSPF process. What can I do?”

It turned out he stumbled across CSCeb86068, which is already fixed in a later software release for his platform.

The passive-interface command tells the routing process to ignore packets received from the specified interface. In case of OSPF, the relevant packets are the hello packets, as an OSPF router will not exchange routing updates without an established adjacency. You can get the same results by deploying an inbound access list on the interface (which is the functionally equivalent workaround for this bug), although this method generates more configuration overhead than the OSPF-specific solution.

On the other hand, it’s a good practice to have inbound access lists dropping unnecessary protocols on the stub (client-only) interfaces, so it might be very simple to add OSPF to the list of undesired protocols.

You could also use another workaround: declare only the transit interfaces in the OSPF process (or use per-interface ip ospf area configuration command) and redistribute stub interface prefixes into OSPF, but this solution unnecessarily pollutes the OSPF database with type-4 and type-5 LSAs.