Technical Tip : OSPF MTU mismatch after upgrade

[sagha]

Description

This article deals with an issue that may occur with OSPF peering not coming up after an upgrade of FortiOS. For example, in FortiOS 6.4 and later there was a change to how IPsec interface MTU is calculated.

Related document:

IPsec interface MTU value

As a side effect of this change, an issue can be observed where OSPF over an IPsec interface does not form a neighborship due to a mismatch of MTU sizes on each side.

Scope

FortiGate

Solution

The solution is to set MTU on the OSPF interface or configure mtu-ignore under ‘config router ospf’

1. Configuring MTU.

config router ospf
    config ospf-interface
        edit int_1
            set mtu xxxx <----- Desired MTU size.
        next
    end
end

2. Enable mtu-ignore on the OSPF interface.

config router ospf
    config ospf-interface
        edit int_1
            set mtu-ignore enable
        end
    end

The current MTU on OSPF interface can be verified with the command:

get router info ospf interface

IKE is up, line protocol is up
  Internet Address 10.10.0.1/32, Area 0.0.0.0, MTU 1446