Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

OSPF stopped gracefully restarted

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

OSPF stopped gracefully restarted

L3 Networker
 

Hi Team,

 

We are facing issue with OSPF is not working properly over the firewall as per the configuration part seems fine we checked with the below given document.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5ZCAS

 

All the configuration for HA is configured as per above given document.

We checked with the configuration of OSPF as per below document which is fine.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEECA0

 

We checked with ping status from firewall but the packet is not reaching the neighbor device also not able to see the same over monitor tab.

But on the other hand from Peer device we are able to see ping happening to the core device which is the neighbor

Also we cannot find neighbor details over the OSPF tab. There is no LACP configured on any aggregate interface.

Provide your output on the earliest to sort this out.

 

OSPF issue.jpg

6 REPLIES 6

Cyber Elite
Cyber Elite

You are not getting ping responses and the neighbor is not up.  These are the root issues.  You should see the traffic, permit or deny, in the Monitor tab.  This traffic should be allowed by the intrazone-default rule.  Have you configured that rule to log at session end?

Help the community: Like helpful comments and mark solutions.

Yes we have enabled log at session end. But from one device we are able to see the ping happening from on PA device which is a active one.

Later while pining the neighbor with passive by making the passive to active then we are not able to find any ping or deny rule over monitor logs

 

Neighbor is up and pingable with one PA device but not using another PA device

Cyber Elite
Cyber Elite

Hello,

So your HA is Active/Passive? If yes then the passive device will never establish an adjacency. This is because the passive device has its interfaces in a down state.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIbCAK

 

Regards,

Excellent point.  It also makes sense that you cannot source a ping from the data interfaces on the standby since the IP addresses are active on the active.  So, the standby never sends out a ping which is why it is not logged.

Help the community: Like helpful comments and mark solutions.

Yes that i agree. When i change the passive to active and the active to passive. The current active device is not getting the OSPF neighbor device details.

  • 3037 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!