Hi,
We have a transparent firewall (fwsm) between 2 ospf neighbors.
Although the ospf neighorship is formed and the ospf neighors are placed in FULL state the neighborship is teared down after dead timer expires.
It seems to me that ospf hello is not passed through firewall.
To make sure all traffic is allowed, i opened ip instead of ip protocol 89 in access-list.
The firewall permit rule is allowing
access-list outside_access_in line 4 extended permit ip host <ip outside vlan ip 1> host 224.0.0.5
access-list outside_access_in line 5 extended permit ip host <ip outside vlan ip 1> host 224.0.0.6
access-list outside_access_in line 6 extended permit ip host <ip outside vlan ip 1> host <ip inside host ip 1>
access-list outside_access_in line 7 extended permit ip host <ip outside vlan ip 1> host <ip inside host ip 2>
access-list outside_access_in line 8 extended permit ip host <ip outside vlan ip 1> host <inside loopback host>
access-list outside_access_in line 9 extended permit ip host <ip outside vlan ip 2> host 224.0.0.5
access-list outside_access_in line 10 extended permit ip host <ip outside vlan ip 2> host 224.0.0.6
access-list outside_access_in line 11 extended permit ip host <ip outside vlan ip 2> host <ip inside host ip 1>
access-list outside_access_in line 12 extended permit ip host <ip outside vlan ip 2> host <ip inside host ip 2>
access-list outside_access_in line 13 extended permit ip host <ip outside vlan ip 2> host <inside loopback host>
access-list outside_access_in line 14 extended permit ip host 224.0.0.5 host 224.0.0.5
access-list outside_access_in line 15 extended permit ip host 224.0.0.5 host 224.0.0.6
access-list outside_access_in line 16 extended permit ip host 224.0.0.5 host <ip inside host ip 1>
access-list outside_access_in line 17 extended permit ip host 224.0.0.5 host <ip inside host ip 2>
access-list outside_access_in line 18 extended permit ip host 224.0.0.5 host <inside loopback host>
access-list outside_access_in line 19 extended permit ip host 224.0.0.6 host 224.0.0.5
access-list outside_access_in line 20 extended permit ip host 224.0.0.6 host 224.0.0.6
access-list outside_access_in line 21 extended permit ip host 224.0.0.6 host <ip inside host ip 1>
access-list outside_access_in line 22 extended permit ip host 224.0.0.6 host <ip inside host ip 2>
access-list outside_access_in line 23 extended permit ip host 224.0.0.6 host <inside loopback host>
access-list outside_access_in line 24 extended permit ip host <router id 1> host 224.0.0.5
access-list outside_access_in line 25 extended permit ip host <router id 1> host 224.0.0.6
access-list outside_access_in line 26 extended permit ip host <router id 1> host <ip inside host ip 1>
access-list outside_access_in line 27 extended permit ip host <router id 1> host <ip inside host ip 2>
access-list outside_access_in line 28 extended permit ip host <router id 1> host <inside loopback host>
access-list outside_access_in line 29 extended permit ip host <router id 2> host 224.0.0.5
access-list outside_access_in line 30 extended permit ip host <router id 2> host 224.0.0.6
access-list outside_access_in line 31 extended permit ip host <router id 2> host <ip inside host ip 1>
access-list outside_access_in line 32 extended permit ip host <router id 2> host <ip inside host ip 2>
access-list outside_access_in line 33 extended permit ip host <router id 2> host <inside loopback host>
Inside is same access-list permit from inside to outside.
The weird thing is the neighborships are placed in FULL state, after the dead time is expired, the ospf is going from INIT to Full state again, till dead timer expires.
Anyone an idea?
Best regards
J
