Disabling Graceful restart for OSPF

[sahithyan.subbu]

Hi team,

When performing a failover in our office we completely lose connectivity in or out. When troubleshooting we noticed we could not see the OSPF peer on the router or firewall. Looking through the system logs I notice:
routed-OSPF-stopped-graceful-restart description: OSPF stopped graceful restart. Protocol: OSPFv2. Exit reason: time out

the router ospf settings are:
router ospf 64800
router-id 1.1.1.1
redistribute static subnets
redistribute bgp 64800.2007 subnets route-map rm-default-rfc1918-net
passive-interface default
no passive-interface GigabitEthernet0/0/2.101
no passive-interface GigabitEthernet0/0/2.102
network 10.24.255.244 0.0.0.0 area 0
network 10.24.255.252 0.0.0.0 area 0
default-information originate
distribute-list prefix pfx-filter-from-Palo in GigabitEthernet0/0/2.101
distribute-list prefix pfx-filter-from-Palo in GigabitEthernet0/0/2.102

I wanted to ask about graceful restart. This is set on the firewalls. With this is it a case of waiting for the routes to time out before they move across?

If we unchecked the boxes, will it cause any issues? will failover be instant?

Thanks & regards

Sahithyan S

[S.Cantwell]

Graceful restart allows a routing device undergoing a restart to inform its adjacent neighbors and peers of its condition. During a graceful restart, the restarting device and its neighbors continue forwarding packets without disrupting network performance. Because neighboring devices assist in the restart (these neighbors are called helper routers), the restarting device can quickly resume full operation without recalculating algorithms.

When a device enabled for OSPF graceful restart restarts, it retains routes learned before the restart in its forwarding table. The device does not allow new OSPF link-state advertisements (LSAs) to update the routing table. This device continues to forward traffic to other OSPF neighbors (or helper routers), and sends only a limited number of LSAs during the restart period. To reestablish OSPF adjacencies with neighbors, the restarting device must send a grace LSA to all neighbors. In response, the helper routers enter helper mode (the ability to assist a neighboring device attempting a graceful restart) and send an acknowledgment back to the restarting device. If there are no topology changes, the helper routers continue to advertise LSAs as if the restarting device had remained in continuous OSPF operation.

[jeremy.larsen]

Is this Active/Active or Active/Passive.  Big difference in operation when using dynamic routing protocols.

[sahithyan.subbu]

Thanks for the reply.

It is Active/Passive.

[sahithyan.subbu]

Thanks for the knowledge sharing.

Fast failover can be achieved using a Bidirectional Forwarding Detection (BFD). Am i Right ?

[jeremy.larsen · Accepted solution]

BFD can really help with floating static routes but I probably wouldn't use if in conjunction with OSPF.  I think I see what's happening here.  Do you have HA Passive Link State set to Auto?  This keeps the passive member's physical interface up.  Setting this to "Disabled" may be causing your issue.  Also, if you are using LACP you will need to enable "LACP Pre-Negotiation" to accomplish the same thing for bonded ethernet links.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5ZCAS

Set the Passive link state to "Auto". Auto setting will bring the interfaces on the passive firewall to UP physical state, the interface will not pass any data traffic.  This facilitates faster failover times.

[sahithyan.subbu]

Thank you for the knowledge sharing.

[jeremy.larsen]

Did this solve the problem Sahithyan?

[sahithyan.subbu]

Yes, It Did. !  🙂

[jeremy.larsen]

Fantastic!  Glad to help.