This article explains the use of dynamic-neighbors and interface-type p2mp commands in an OSPF configuration.

In general, interface-type p2mp is used when a connection is needed between a single source and multiple destinations.

In a nonbroadcast multiaccess (NBMA) network, such as multipoint Asynchronous Transfer Mode (ATM) or Frame Relay, OSPFv2 operates by default in point-to-multipoint mode. In this mode, OSPFv2 treats the network as a set of point-to-point links. There are two ways to establish OSPF neighborship of a p2mp network: manual and dynamic.

With manual configuration, each neighbor must be defined under the OSPF hierarchy, as shown below:

If using dynamic-neighbors , you don't have to specify each neighbor. SRX will send an OSPF hello on 224.0.0.5 and autodiscover the neighbors. This becomes very helpful when there is a large number of devices in the setup.

The other common scenario with SRX where these two options become very handy is full-mesh IPsec VPNs with full-mesh OSPF, as shown in the following topology:

In the above topology, VPN (ST0) is between all three devices and OSPF is enabled on all, but only one neighborship is seen in Full state.

Assuming that the OSPF neighborship is Full between SRX-1 and SRX-2 through VPN-1, you will not see an OSPF neighborship on VPN-2 and VPN-3.

By default, the ST0 interfaces are point-to-point link type, and the OSPF daemon will not be able to understand that in this scenario st0 is connected to two devices and will form a neighborship with only one device.

• Specify interface-type p2mp  under st0 on the OSPF configuration so that the OSPF daemon knows that st0 is operating in point-to-multipoint mode. User can either specify the OSPF neighbors manually or use the dynamic-neighbors statement.
• Specify multipoint  under st0 unit 0.

NOTE: If no dynamic-neighbors configuration or neighbors are specified, SRX will not send any OSPF hellos until it receives one.

Here is the sample configuration from SRX-1

<< SRX-1 configuration snippet >> 

set interfaces ge-0/0/3 unit 0 description ***UNTRUST***
set interfaces ge-0/0/3 unit 0 family inet address 172.16.1.1/29

set interfaces st0 unit 0 description ***VPN**
set interfaces st0 unit 0 multipoint
set interfaces st0 unit 0 family inet address 192.168.1.1/24

set protocols ospf area 0.0.0.0 interface st0.0 interface-type p2mp
set protocols ospf area 0.0.0.0 interface st0.0 dynamic-neighbors

set security ike policy test1 mode main
set security ike policy test1 proposal-set basic
set security ike policy test1 pre-shared-key ascii-text "$9$v/P8xd24Zk.5bs.5QFAtM8X"
set security ike gateway GW1 ike-policy test1
set security ike gateway GW1 address 172.16.1.2
set security ike gateway GW1 external-interface ge-0/0/3.0
set security ike gateway SPOKE2 ike-policy test1
set security ike gateway SPOKE2 address 172.16.1.3
set security ike gateway SPOKE2 external-interface ge-0/0/3.0

set security ipsec policy testpol1 proposal-set standard
set security ipsec vpn VPN-1 bind-interface st0.0
set security ipsec vpn VPN-1 ike gateway GW1
set security ipsec vpn VPN-1 ike ipsec-policy testpol1
set security ipsec vpn VPN-1 establish-tunnels immediately
set security ipsec vpn VPN-2 bind-interface st0.0
set security ipsec vpn VPN-2 ike gateway SPOKE2
set security ipsec vpn VPN-2 ike ipsec-policy testpol1
set security ipsec vpn VPN-2 establish-tunnels immediately

set security zones security-zone untrust screen untrust-screen
set security zones security-zone untrust host-inbound-traffic system-services all
set security zones security-zone untrust host-inbound-traffic protocols all
set security zones security-zone untrust interfaces ge-0/0/3.0

set security zones security-zone vpn host-inbound-traffic system-services all
set security zones security-zone vpn host-inbound-traffic protocols all
set security zones security-zone vpn interfaces st0.0

<< Verification commands >> 

root@SRX-1> show ospf neighbor
Address          Interface              State           ID               Pri  Dead
192.168.1.2      st0.0                  Full            29.29.29.29      128    34
192.168.1.3      st0.0                  Full            10.85.57.12      128    38

root@SRX-1> show security ike active-peer
Remote Address                      Port     Peer IKE-ID                         AAA username                        Assigned IP
172.16.1.2                          500      172.16.1.2                                 not available                0.0.0.0
172.16.1.3                          500      172.16.1.3                                 not available                0.0.0.0

2025-01-06: Article content udpated based on the feedabck(  aAlDp000000oniJ ) referring KB86202 [juniper.net]. 

2020-06-25: Article reviewed for accuracy; no changes required.

• Configuring OSPF Interfaces
• https://supportportal.juniper.net/s/article/SRX-P2MP-OSPF-not-establishing-on-tunnel-interface