Troubleshooting Tip: Unable to see OSPF Neighbor: No 'Hello' Packets

[jiahoong112]

Description	This article describes how to troubleshoot no Hello packets seen on FortiGate to establish OSPF neighborship.
Scope	FortiGate.
Solution	Topology: Fortigate-A --direct connection--> Fortigate-B. Fortigate-A: port1 IP: 10.56.241.52/22 port3 IP: 10.191.1.52/20 Fortigate-B: port1 IP: 10.56.241.56/22 port3 IP: 10.193.1.56/20  OSPF packet capture does not show any output, no Hello packets. diag sniffer packet any 'proto 89' 6 0 a   OSPF debugs do not show anything relevant, with no errors: diagnose debug disable diagnose debug reset diagnose debug console timestamp enable diagnose ip router ospf all enable diagnose ip router ospf level info diagnose debug enable  OSPF Neighborship information:  OSPF configuration: As seen here, port3 is connected between the 2 FortiGates. However, port3 on both of these FortiGates do not share the same subnet and mask.  To form OSPF adjacency, the following criteria must be met: OSPF Version: Must run the same OSPF version between the peers. IP addresses of peers must be in the same subnet with the same mask. Interfaces of peers are the same type and in the same OSPF area. Hello and dead intervals of peers match. Each peer has a unique router ID.  MTU of both sides must match or MTU-ignore must be configured.  Successful OSPF authentication, if enabled.(authentication type and keys must match) Check the OSPF network type configuration on both ends. A mismatch in network types, such as Broadcast vs. Point-to-Point, can prevent neighbors from discovering each other. To resolve this issue, it is necessary to advertise the correct prefixes to the neighbor. In this case, it is necessary to meet the criteria of 'IP addresses of peers must be in the same subnet with the same mask'. So aside from advertising the LAN prefixes that are not of the same subnet/mask (10.191.1.52/20 and 10.193.1.56/20) through OSPF, it will also be necessary to advertise another IP that is of common subnet/mask between both firewalls which are (10.56.241.52/22 and 10.56.241.56/22). In conclusion, both firewalls must advertise a common subnet/mask shared amongst them. Result: Note: For OSPF over IPsec, it is possible to configure a common prefix using the IPsec Interface subnet. The Router ID should be a 32-bit number that uniquely identifies a participating router with a routing domain or Autonomous System. A Router ID of 0.0.0.0 is not allowed as this value is used during the designated router and BDR elections. Related article:  Technical-Tip-Integrating-a-FortiGate-into-an-OSPF-environment