05-26-2023 06:50 PM
I have set up a PA-VM version 10.2.5 on VMware ESXi as I was not able to get it to work properly on EVE-NG. On ESXi I did the following:
I have a Cisco vIOS router running Version 15.8(3)M2 that connects to (Cloud1) and in turn connects to other VMs on the same Port Group including a Cisco C9800-CL-K9_IOSXE. Version 16.12.4a, which can also run OSPF, running directly on my ESXi host, which I also added into the same Port Group.
I am able to form a full OSPF adjacency with the C9800, but am not able to do so with the PA-VM. The configuration on the PA-VM appears to be correct as I followed the steps to configure OSPF on the PA-VM and I am seeing the Hello messages arrive on the Cisco router running on EVE-NG as well as the C9800 running on ESXi.
From Cisco router on EVE-NG:
From C9800 on ESXi:
As you can see. This is a rather simple setup. It appears that the PA-VM is not receiving the Hello packets from the other devices and thus not responding with updated Hello packets to the other devices to include their own Router-IDs. Hence why the it remains in the INIT state.
Basically, the PA-VMs Hello messages get out, but it is not able to receive them so that it updates it own Hello messages to the other devices and thus proceed to the 2-WAY state and so on.
Has anyone seen this before? If so, can you help me out or provide some feedback as to what I can try?
I've included the PA-VM configuration.
Thank you all in advance!
05-31-2023 06:18 AM
could you please go through this KB ?
Could you also check whether intrazone-default security policy has action set to allow?
05-31-2023 07:21 AM
I appreciate the suggestions.
I've reviewed the document regarding troubleshooting OSPF adjacencies. It is in fact very helpful. I'm lead to believe that the PA-VM is not receiving the OSPF hello packets and thus not including the other router's Router-ID in the hello packets. I've done Wireshark captures that show that the PA-VM does not initiate a unicast to the Cisco router.
The intrazone-default security policy action is set to allow. The behavior I'm seeing on the PA-VM is that traffic can exit but return traffic is not able to get through.
Are you aware of anything else that's worth checking out?
05-31-2023 03:20 PM
Thank you for reply @Spiterman
To me it looks like that initial OSPF neighbor discovery to 126.96.36.199 does not get to PA-VM. Would it be possible to look into logs: tail follow yes mp-log routed.log to see whether it can provide more insight. Also, would it be possible for a test to change OSPF network type to p2mp (point to multipoint)? With this interface type you have to configure all neighbors manually and initial discovery will be sent by unicast instead of multicast. You will have to match the interface type on Cisco side (I think the interface type will be: ip ospf network point-to-multipoint non-broadcast).
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!