When a firewall filter is configured on a router and applied on an interface used for OSPF neighborship process, the OSPF neighbors remain in INIT state with a syslog error.
Topology:
R1 (ge-0/0/1.0) --------(ge-0/0/1.0) R2 R1 (100.1.1.1 Lo0) ------ R2(100.1.1.2 Lo0)
The firewall filter is configured on R1, the 224.0.0.5 address is the multicast address used by OSPF to send and discover Hello’s for neighborship.
set firewall filter BLOCK physical-interface-filter set firewall filter BLOCK term 1 from destination-address 224.0.0.5/32 set firewall filter BLOCK term 1 then count ospf set firewall filter BLOCK term 1 then log set firewall filter BLOCK term 1 then reject set firewall filter BLOCK term 2 then accept
R1 is stuck in INIT state.
R1# run show ospf neighbor 100.1.12.1 Address Interface State ID Pri Dead 100.1.12.1 ge-0/0/1.0 Init 100.1.1.2 128 31 R1# run show ospf neighbor 100.1.12.1 extensive
Address Interface State ID Pri Dead 100.1.12.1 ge-0/0/1.0 Init 100.1.1.2 128 33 Area 0.0.0.0, opt 0x12, DR 0.0.0.0, BDR 0.0.0.0 Topology default (ID 0) -> Forward Only
Syslog message observed on R1.
RPD_OSPF_NBRDOWN: OSPF neighbor 100.1.12.1 (realm ospf-v2 ge-0/0/1.0 area 0.0.0.0) <-- state changed from ExStart to Init due to 1WayRcvd (event reason: neighbor is in one-way mode)
While R2 does not show anything with R1:
{MASTER} R2> show ospf neighbor 100.1.1.1
The peer can be reachable since the ICMP is not blocked.
R2> ping 100.1.1.1 PING 100.1.1.1 (100.1.1.1): 56 data bytes 64 bytes from 100.1.1.1: icmp_seq=0 ttl=63 time=3.907 ms 64 bytes from 100.1.1.1: icmp_seq=1 ttl=63 time=3.586 ms ^C --- 100.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max/stddev = 3.586/3.747/3.907/0.160 ms R1# run ping 100.1.1.2 PING 100.1.1.2 (100.1.1.2): 56 data bytes 64 bytes from 100.1.1.2: icmp_seq=0 ttl=63 time=5.111 ms 64 bytes from 100.1.1.2: icmp_seq=1 ttl=63 time=3.565 ms ^C --- 100.1.1.2 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max/stddev = 3.565/4.338/5.111/0.773 ms
The firewall filter counters for OSPF are incrementing, including firewall logs, indicating FW filter is used and 224.0.0.5 is blocked.
regress@INET-BLOG# run show firewall log Log : Time Filter Action Interface Protocol Src Addr Dest Addr 22:33:01 pfe R ge-0/0/1.0 OSPF 10.100.1.2 224.0.0.5 regress@INET-BLOG# run show firewall filter BLOCK-ge-0/0/1-i Filter: BLOCK-ge-0/0/1-i Counters: Name Bytes Packets ospf-ge-0/0/1-i 240 3 regress@INET-BLOG# run show firewall filter BLOCK-ge-0/0/1-i Filter: BLOCK-ge-0/0/1-i Counters: Name Bytes Packets ospf-ge-0/0/1-i 320 4 regress@INET-BLOG# run show firewall filter BLOCK-ge-0/0/1-i Filter: BLOCK-ge-0/0/1-i Counters: Name Bytes Packets ospf-ge-0/0/1-i 3840 48
This firewall filter can be one of multiple issues that can keep the OSPF router in a two way state. Another issue is described in the KB19074 - Syslog message: RPD_OSPF_NBRDOWN [juniper.net]
Always allow the multicast addresses 224.0.0.5 and 224.0.0.6 since this is the address on which multicast Hello’s are exchanged to become OSPF neighbors.
Remove the firewall filter in order to send the multicast hello on 224.0.0.5. Or deactivate the following filter.
{MASTER}[edit] R1# delete firewall filter BLOCK term 1 from destination-address 224.0.0.5/32 R1# run show ospf neighbor 100.1.12.1 Address Interface State ID Pri Dead 100.1.12.1 ge-0/0/1.0 Full 100.1.1.2 128 31 {MASTER}[edit]
2024-10-14: minor non tech changes