OSPF passive interfaces question

[Sec101]

What is best practice to advertise connected networks on a single VR where you have OSPF running and neighboring on an Internal Firewall  interface to router, and want to advertise multiple segmented/firewalled networks directly attached the same firewall?

Is it best to mark the segmented networks as Passive ospf interfaces, and allow OSPF to advertise these networks to internal router

Are there any risks of rogue routers/devices  that could be installed on a segmented section and send updates to the passive OSPF interface on the firewall?  A passive OSPF interface won't accept incoming advertisements because an adjacency isn't established iirc.  But there aren't any risks I'm missing on this are there?

Citing below link for background information:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXsCAK

[michelealbrigo]

I'd mark as passive any interface that should not form OSPF adjacences, to avoid route hijacking (either by rogue or misconfigured devices). Not sure if that's a "unviersal enough" thing to be named a "best practice", though. Authenticating OSPF can also mitigate the same problem, esp. if some of your links transit on somebody else's network or if some of your devices need to offer Anycast services and are mixed with others which should not take part in OSPF (e.g. a DNS server member of an Anycast pool on the same subnet with regular servers).

[Sec101]

OSPF authentication is a good idea, but something we are not doing as of yet.   There isn't any way for an opsf passive interface to accept any inputs or ingest routes from the passive link I'm thinking?

[OtakarKlier]

Hello,

Another option is to utilize metrics. Allow the adjacencies to form and then apply metrics to the routes to that are less favorable.

Cheers!