Technical Tip: OSPF MTU mismatch after upgrade

Description

This article deals with an issue that may occur with OSPF peering not coming up after an upgrade of FortiOS. For example, in FortiOS 6.4 and later there was a change to how IPsec interface MTU is calculated.

Related document:

IPsec interface MTU value

As a side effect of this change, an issue can be observed where OSPF over an IPsec interface does not form a neighborship due to a mismatch of MTU sizes on each side. Peers can see each other but neighborship get stuck in ExStart/Exchange states.

Scope

FortiGate.

Solution

The solution is to set MTU on the OSPF interface or configure mtu-ignore under ‘config router ospf’ which stops OSPF from comparing the MTU when trying to form an adjacency.

1. Configuring MTU.

config router ospf
    config ospf-interface

        edit int_1
            set mtu xxxx <----- Desired MTU size.
        next
    end
end

2. Enable mtu-ignore on the OSPF interface.

config router ospf

    config ospf-interface
        edit int_1
            set mtu-ignore enable
        end
    end

In most cases, set the following on both sides:

config router ospf

    config ospf-interface

        edit int_1

            set mtu 1300.

        next

    end
 end

The current MTU on an OSPF interface can be verified with the following command:

get router info ospf interface

IKE is up, line protocol is up
  Internet Address 10.10.0.1/32, Area 0.0.0.0, MTU 1446