|Description||This article describes how to troubleshoot OSPF neighborship between firewalls/routers.|
10.10.10.1 --> Router id: 220.127.116.11
10.10.10.2 --> Router id: 18.104.22.168
1) Init to 2-way state:
- In the 'Init' state, the firewall has sent the OSPF 'hello' packet but has not received the 'hello' packet from the neighbor firewall.
- The firewall stays in this state until it receives its router-id information in a 'hello' packet sent by the neighbor firewall or router.
- In the snippet above, when the neighboring firewall/router receives the OSPF hello from 10.10.10.1, it enters the init state. It will stay in the init state until it receives the following type of hello packet from 10.10.10.1:
- In the above snippet, an active neighbor router-id is added and sent over a multicast address.
- Once its neighbor 22.214.171.124 receives this hello packet, it will change the state from 'init' to a 2-way state.
- To add the active neighbor in the 'hello' packet, the following parameters are checked:
- Same Area.
- Same Layer3 broadcast network.
- Subnet mask.
- Hello and dead time intervals.
- Matching stub flags.
2) 2-way to ExStart/Exhange/ Loading state:
The 2-way state is a bi-directional communication between routers.
- Once DR and BDR are elected, both routers consider them as 'Master' and set the flag to 'Y'. MTU values are also exchanged between them at this stage. Keep a note of the MTU.
- Once the master/slave relationship is established, DBD (Database Descriptor) packets were exchanged.
- MTU needs to be matched, otherwise, the neighbor-ship stuck in the Exstart state.
Sometimes, MTU does match on both sides but still, the neighbor-ship is stuck in the Exstart state because DBD/LSU packets are getting expired and they are unable to reach the other side.
This could be caused by an L2 switch or L2-WAN device (MPLS) which is placed between OSPF routers and does not forward packets at this MTU.
FortiGate can only send and received 5 Database Descriptors (DD) packets at a given point of time in a queue for all interfaces trying to form neighbor-ship. If multiple OSPF interfaces are negotiating at the same time, it will take some time to form the neighbor-ship between routers.
If OSPF interfaces are stuck in ExStart/Exchange state for some reason and the OSPF process queue is 5/5, then other OSPF interfaces will not be able to form neighbor-ship to 'Full' as well.
Some user commands:
# diag sniffer packet any “proto 89” 6 0 l
# diag sniffer packet any “ host 126.96.36.199” 6 0 l
# get router info ospf neighbor
# get router info ospf interface