FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Article Id 252855
Description This article describes how to troubleshoot OSPF neighborship between firewalls/routers.
Scope FortiGate.



gbamania_2-1681795249253.png --> Router id: --> Router id:


1) Init to 2-way state:

- In the 'Init' state, the firewall has sent the OSPF 'hello' packet but has not received the 'hello' packet from the neighbor firewall.

- The firewall stays in this state until it receives its router-id information in a 'hello' packet sent by the neighbor firewall or router.





- In the snippet above, when the neighboring firewall/router receives the OSPF hello from, it enters the init state. It will stay in the init state until it receives the following type of hello packet from




- In the above snippet, an active neighbor router-id is added and sent over a multicast address.

- Once its neighbor receives this hello packet, it will change the state from 'init' to a 2-way state.

- To add the active neighbor in the 'hello' packet, the following parameters are checked:

- Same Area.

- Same Layer3 broadcast network.

- Subnet mask.

- Hello and dead time intervals.

- Authentication.

- Matching stub flags.


2) 2-way to ExStart/Exhange/ Loading state:

The 2-way state is a bi-directional communication between routers.


- Once DR and BDR are elected, both routers consider them as 'Master' and set the flag to 'Y'. MTU values are also exchanged between them at this stage. Keep a note of the MTU.






- Once the master/slave relationship is established, DBD (Database Descriptor) packets were exchanged.

- MTU needs to be matched, otherwise, the neighbor-ship stuck in the Exstart state.



Sometimes, MTU does match on both sides but still, the neighbor-ship is stuck in the Exstart state because DBD/LSU packets are getting expired and they are unable to reach the other side.

This could be caused by an L2 switch or L2-WAN device (MPLS) which is placed between OSPF routers and does not forward packets at this MTU.


FortiGate can only send and received 5 Database Descriptors (DD) packets at a given point of time in a queue for all interfaces trying to form neighbor-ship. If multiple OSPF interfaces are negotiating at the same time, it will take some time to form the neighbor-ship between routers.



If OSPF interfaces are stuck in ExStart/Exchange state for some reason and the OSPF process queue is 5/5, then other OSPF interfaces will not be able to form neighbor-ship to 'Full' as well.






Some user commands:


# diag sniffer packet any “proto 89” 6 0 l

# diag sniffer packet any “ host” 6 0 l

# get router info ospf neighbor

# get router info ospf interface