Description

OSPF is set up on the st0 interface but the OSPF state is flapping between Full and Init

Topology is:

|-------|                                        |-------|
|  SRX  +ge-0/0/0-------- Switch ----------eth1/0+  SSG  |
|---+---|                                        |---+---|
    |                                                |
  st0.0================route based VPN=============tunnel.0

The SRX and SSG are connected bac-to-back in the same network segment
IP address of the ge-0/0/0 is 192.168.0.1/30
IP address of the eth1/0 is 192.168.0.2/30

Un-numbered st0.0 is the tunnel interface of the SRX
Un-numbered tunnel.0 is the tunnel interface of the SSG

Symptoms

We will explain why the OSPF will come up but it will go down as soon as it comes up.

Solution

When the st0 interface is used as an un-numbered interface, the source IP address for sending OSPF packets is borrowed from the external ethernet interface.

1. This makes the OSPF to assume the link network to be 192.168.0.0/30, and installs the route (192.168.0.2/32 via st0.0) in the routing table of SRX.

2. The route (192.168.0.2/32 via st0.0) is more specific than the direct route (192.168.0.0/30 via ge-0/0/0)

3. This forces the Tunnel ESP packets to try to leave the SRX via st0.0, and this breaks the IPSEC peering

4. This in turn breaks the OSPF peering, as the OSPF payload is carried in an ESP packet

5. Hence the OSPF goes to "Init" again after the tunnel goes down. All OSPF routes are removed from the routing table along with route (192.168.0.2/32 via st0.0)

6. The route (192.168.0.0/30 via ge-0/0/0) is prefered now and the tunnel comes up again.

7. As a result the OSPF peering starts and completes and the OSPF shows "full".

8. This again leads to the OSPF routes being installed wrongly and the complete cycle (1 to 8) repeats.

When we give a different network IP to the st0.0 interface, it no longer borrows IP address from the external (ethernet) interface and the link network is now the new network that we just chose for the tunnel interfaces, for example, lets say, 192.168.0.4/30

Workaround is to configure the st0 interface with a specific IP address (i.e. numbered st0 interface).  Additionally, the SSG device needs to be configured with numbered tunnel interface as well.