FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article describes possible reasons why routes appear in the OSPF database, but are not installed in the routing table.
Scope
FortiGate, OSPF.
Solution
The following is a comprehensive list of common reasons why a route appears in the OSPF LSDB but is not installed in the routing table:
OSPF is not in the FULL Adjacency State: a neighbor relationship exists but never reaches the FULL state, so LSA is present but not trusted for installation.
Lower Administrative Distance (AD): Another route to the same prefix exists with a lower AD (e.g., static, connected, BGP).
Route is already installed via another protocol: Even with the same AD, FortiGate prefers routes installed earlier (e.g., connected/static).
Network Type Mismatch: Interface configured with the wrong network type (e.g., point-to-point vs. broadcast), causing incomplete adjacency or DR issues.
Forwarding Address Unreachable: External LSA includes a forwarding address that is not reachable via OSPF.
Invalid or Missing Next-Hop: The next-hop in the LSA is not resolvable or incorrect, preventing installation.
Route Map Filtering on Redistribution: Route is filtered or modified with an invalid metric or tag during redistribution.
Max-LSA Limit or RIB Overflow: OSPF or the router hits a limit on the number of LSAs or total routes in the RIB.
Metric Too High: The cost of the redistributed route is too high and considered unusable.
Route Tagging Conflicts: Route tags used in redistribution may conflict with route maps or policies, preventing installation.
Redistribution Policy Errors: OSPF is configured to redistribute a source (e.g., static), but the actual route is missing or mismatched.
Loop Prevention or OSPF Route Preference: FortiGate detects potential loops or prefers an alternative path based on routing policy.
No OSPF Route to Advertising Router: Although LSAs are received, the originating router is unreachable via OSPF.
Route not re-originated in NSSA Area: Redistribution into an NSSA area without redistribute or nssa default-information-originate properly configured.
