topic Re: OSPF stopped gracefully restarted in General Topics

OSPF stopped gracefully restarted

Vijaygvasan — Thu, 19 Aug 2021 16:55:17 GMT

Hi Team,

We are facing issue with OSPF is not working properly over the firewall as per the configuration part seems fine we checked with the below given document.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5ZCAS

All the configuration for HA is configured as per above given document.

We checked with the configuration of OSPF as per below document which is fine.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEECA0

We checked with ping status from firewall but the packet is not reaching the neighbor device also not able to see the same over monitor tab.

But on the other hand from Peer device we are able to see ping happening to the core device which is the neighbor

Also we cannot find neighbor details over the OSPF tab. There is no LACP configured on any aggregate interface.

Provide your output on the earliest to sort this out.

Re: OSPF stopped gracefully restarted

TomYoung — Fri, 20 Aug 2021 03:17:56 GMT

You are not getting ping responses and the neighbor is not up. These are the root issues. You should see the traffic, permit or deny, in the Monitor tab. This traffic should be allowed by the intrazone-default rule. Have you configured that rule to log at session end?

Re: OSPF stopped gracefully restarted

Vijaygvasan — Fri, 20 Aug 2021 08:35:46 GMT

Yes we have enabled log at session end. But from one device we are able to see the ping happening from on PA device which is a active one.

Later while pining the neighbor with passive by making the passive to active then we are not able to find any ping or deny rule over monitor logs

Re: OSPF stopped gracefully restarted

Vijaygvasan — Fri, 20 Aug 2021 08:36:36 GMT

Neighbor is up and pingable with one PA device but not using another PA device

Re: OSPF stopped gracefully restarted

OtakarKlier — Fri, 20 Aug 2021 18:05:44 GMT

Hello,

So your HA is Active/Passive? If yes then the passive device will never establish an adjacency. This is because the passive device has its interfaces in a down state.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIbCAK

Regards,

Re: OSPF stopped gracefully restarted

TomYoung — Sat, 21 Aug 2021 13:11:11 GMT

Excellent point. It also makes sense that you cannot source a ping from the data interfaces on the standby since the IP addresses are active on the active. So, the standby never sends out a ping which is why it is not logged.

Re: OSPF stopped gracefully restarted

Vijaygvasan — Mon, 23 Aug 2021 06:29:39 GMT

Yes that i agree. When i change the passive to active and the active to passive. The current active device is not getting the OSPF neighbor device details.