| Description |
This article explains how to resolve an OSPF neighbor issue where the OSPF is stuck in the INIT state. |
| Scope |
FortiGate v6.2, v6.4, v7.0, v7.2, v7.4 and v7.6. |
| Solution |
Topology: OSPF uses multicast IP 224.0.0.5 to send HELLO and to share routing information such as link-state advertisement (LSA) to its neighbor(s). Sometimes, the multicast packets can get dropped between the source and destination. When this happens, the other side will not receive the HELLO packets and will therefore be unable to pass the INIT state.
For clarity, these are the states OSPF routers pass through to form neighbors:
Until the neighbors are in FULL State, the network will not function.
Neighbor routers get stuck in an INIT state when an OSPF router fails to receive its neighbor HELLO packets. This can be due to a couple of reasons.
Below are some common causes and suggested solutions.
See Technical Tip: How to configure OSPF over Non-Broadcast link.
Example of 1-way HELLOs:
diagnose sniffer packet any "proto 89" 4 0 l
Line 26: 2.523359 portX out 192.168.X.Y -> 224.0.0.5: ip-proto-89 60
To resolve this, configure authentication on both sides or remove it from the side that has it configured. See Technical Tip: How to configure OSPF MD5 authentication and Technical Tip: Configuring and Verifying OSPF HMAC-SHA Authentication on FortiOS
Troubleshoot the switched network, especially if it was working before. Check for what changed. This may also be a result of broken hardware. Look for Tx and Rx HELLO packets. If HELLOs are being dropped, fix the drops.
Enabling some features can cause the switch to lose Multicast capability. The details of this are beyond this article's scope.
Check the MTU. If there is a mismatch, set the OSPF neighbors to ignore MTU. Alternatively, adjust the MTU to the same size.
The following details are shown within the hello packet:
The following commands assist with troubleshooting an OSPF stuck in an INIT state: Note: Run this on both neighbors.
get router info ospf interface
Example:
get router info ospf interface portX is up, line protocol is up Internet Address 192.168.X.Y/30, Area 0.0.0.0, MTU 1500 Process ID 0, VRF 0, Router ID 192.168.X.Y, Network Type POINTOPOINT, Cost: 1 Transmit Delay is 1 sec, State Point-To-Point Timer intervals configured, Hello 10.000, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:08 Neighbor Count is 0, Adjacent neighbor count is 0 Crypt Sequence Number is 7900942 Hello received 14467 sent 75124, DD received 780 sent 906 <----- HELLOs are being dropped. LS-Req received 78 sent 261, LS-Upd received 27423 sent 376 LS-Ack received 298 sent 24409, Discarded 0 Cryptographic authentication enabled <----- Authentication is configured. Sending SA: Key 1
diagnose sniffer packet any 'host 224.0.0.5' 4
Or:
diagnose sniffer packet any " proto 89 " 4 0 a
Run the following debug commands and check the reason for OSPF failure getting stuck in the INIT state.
diagnose debug reset diagnose ip router ospf all enable diagnose ip router ospf level info
diagnose debug disable <----- Disable the debug.
Related documents: |
