ASA causing OSPF adjacency cycles

[bkoch1]

Putting together a lab setup for an upcoming network project. I have OSPF configured between the core router (6509 VSS) and a border router (7206VXR). Everything works great to/from ultimate destination (routing updates, etc). However, when I place an ASA 5540 (in transparent mode) between the core and the border router, the OSPF adjacency regularly fails and then re-establishes.

Core router messages:

CORE#
*Feb 11 15:08:31: %OSPF-5-ADJCHG: Process 100, Nbr 1.1.1.1 on Vlan201 from LOADING to FULL, Loading Done
*Feb 11 15:09:36: %OSPF-5-ADJCHG: Process 100, Nbr 1.1.1.1 on Vlan201 from LOADING to FULL, Loading Done
*Feb 11 15:10:43: %OSPF-5-ADJCHG: Process 100, Nbr 1.1.1.1 on Vlan201 from LOADING to FULL, Loading Done
*Feb 11 15:11:49: %OSPF-5-ADJCHG: Process 100, Nbr 1.1.1.1 on Vlan201 from LOADING to FULL, Loading Done

Border router messages:

*Mar  3 03:59:40.482: %OSPF-5-ADJCHG: Process 100, Nbr 10.100.8.254 on GigabitEthernet1/0/1 from FULL to DOWN, Neighbor Down: Dead timer expired
*Mar  3 03:59:42.487: %OSPF-5-ADJCHG: Process 100, Nbr 10.100.8.254 on GigabitEthernet1/0/1 from LOADING to FULL, Loading Done
*Mar  3 04:00:40.822: %OSPF-5-ADJCHG: Process 100, Nbr 10.100.8.254 on GigabitEthernet1/0/1 from FULL to DOWN, Neighbor Down: Dead timer expired
*Mar  3 04:00:49.000: %OSPF-5-ADJCHG: Process 100, Nbr 10.100.8.254 on GigabitEthernet1/0/1 from LOADING to FULL, Loading Done

I've added ACL entries for allowing ospf and tcp port 89 (which is probably a bit redundant) on the Outside interface, and it's still cycling. What am I missing?

[bkoch1]

After reading the ASDM information messages a little more closely, the firewall wasn't allowing the multicast ospf messages from the Inside interface to the Outside border router. After allowing OSPF on the Inside interface for the router point-to-point network, the adjacency issues ceased.

[Jon Marshall · Accepted solution]

Thanks for getting back to us and letting us know the solution.

Jon