OSPF Adjecency Change

[sameermunj]

Hi

we have 6509 switch working as Core which is connected to Juniper firewall and running ospf over the point to pint connectivity.the firewall is giving default route in ospf to core switch while core switch is providing lan sisde routes to firewall.multiple subinterfaces have been configured over this link and each subintefcace is part of diffrent vrf.

physical connectivity is little diffrent in which core switch is connected to inside interface of Packetier (Just hub kind of device) and outside dinterface of packetier is connected to firewall inside interface.Point to point link configured between Core anfd firewall packetier is just L2 device.

for someof the processes we get follwoing error in core switch.

Local7.Notice,y.y.y.y,"13241: 17w6d: %OSPF-5-ADJCHG: Process 36, Nbr x.x.x.x on GigabitEthernet1/2.36 from LOADING to FULL, Loading Done"

Local7.Notice,y.y.y.y,"13242: 17w6d: %OSPF-5-ADJCHG: Process 9, Nbr x.x.x.x on GigabitEthernet1/2.100 from LOADING to FULL, Loading Done"

same time no error is observed is juniper firewall and even the connectivty is not affected in terms of data transfer.

can anyone please let me know why the loading to full is happening in between.ospf is not going down completely.also these messages is observed with very less frequency (once in 15 days)

[Reza Sharifi]

Hi Sam,

Do all your OSPF peers reset at the same time?

Reza

[sameermunj]

hi reza

u want me to clear the ospd process once ?? its difficult in live enviornment.let me check the opprtunity.

aby idea why this error is coming .also why its coming for those 2 processes only even when all other processes not giving this error.also ospf changes between loading and full and not going down or impacting traffic.

the document says we get this error just because log neighour changes enabled and no action required.

can anyone pl confirm the same...

regards

sameer

[Giuseppe Larosa]

Hello Sameer,

Reza was suggesting  to check if OSPF neighborship falls on the other side.

If you have no real issue and the event is rare (one time every two weeks) it is better to let it untouched.

You are right that neighborship should fall down before performing a new loading phase.

Hope to help

Giuseppe

[Reza Sharifi]

Hi Sam,

I agree with Giuseppe.  Since it does not effect your peering at all then I just leave it alone.

BTW, any logs on the Netscreens?

Thanks,

Reza

[sameermunj]

Hi

we are not getting any corrosponding error in Junier SSG 1000 firewall.i am ok with keeping it untouched but customer's only worry is the error occurance.

can you please let me know any probable reason for the same.Also its coming for only 2 processes out of the 20 processes configured over that interface.

Thanks

Sameer

[sameermunj]

Hi Giuseppe/Reza

can you please confirm any probabale reason for the same.i ahve checked lot of documents but couldnt find it out.

The core is directly connected to packetier inside interface and packetier outside interface is connected to Juniper SSG firewall.In packetier bandwidth is allocated for each customer and each customer is part of diffrent ospf process (separate vrf).is it the case that the bandwidth allocated for particular customer is getting chocked and because of same some lsp needs retransmition and because of the same w eget those loading-full state.

i think with above details u people can help me in concluding..

[Kevin Dorrell]

A couple of questions:

1. I see you have address y.y.y.y and neighbor RID x.x.x.x.  Is this always the same core switch (y.y.y.y) and always the same neighbor (x.x.x.x)?
2. You see the LOADING-->FULL.  Do you not see any messages about OSPF neighbor lost?
3. Check that all your OSPF routers have unique RIDs at all times.  Do you fix the RID, or do you let it decide theRID on the basis of IP addresses?

Kevin Dorrell

Luxembourg

[sameermunj]

Hi

let me give you the background...

core switch connected to Juniper SSG firewall.Core is connected to Packetier inside & packetier outside connected to Juniper SSG.ospf is configured between firewall and core with packetier is just layer 2 element.

on a physical link multiple subinterfaces  have been creared with each subinterface is part of diffrent vrf (diffrent ospf process).now among multiple ospf processes this error (loading-full) comes for 2-3 processes.no data flow distruption and ospf not going down.

so our neighbour is same.

RID defined manually on core as well as firewall.

do u need any more input please do let me know.,

[Giuseppe Larosa · Accepted solution]

Hello Sameer,

>> In packetier bandwidth is allocated for each customer and each customer  is part of diffrent ospf process (separate vrf).is it the case that the  bandwidth allocated for particular customer is getting chocked and  because of same some lsp needs retransmition and because of the same w  eget those loading-full state.

you have probably found a possible cause of this. You have described the packetier as a L2 device in first posts, now you add that it has the capability to provide a specific bandwidth to each customer /VRF/ OSPF process.

Does it shape or police the traffic?

Is the packetier able to discriminate OSPF packets over user traffic or does it treat all traffic in a Vlan/VRF in the same way?

I think it is able to discriminate OSPF packets or it is doing shaping or you would see OSPF neighborship falling down when traffic for a customer is near the configured BW.

In case the packetier is configured to discriminate OSPF traffic and there is a traffic class for OSPF you need to provide space for LSA refresh.

Every 30 minutes an LSA is regenerated by the originator of the LSA even with no topology change.

Hope to help

Giuseppe

[sameermunj]

Hi Giuseppe

looks right.

packetier is the only device configured by customer in entire setup.what i understood from them is for each customer flow (each vrf/each lan subnet)they can assign bandwidth (shaping) probabaly on source  with destaination any and dont think any provision to distinguish traffic of diffrent traffic like routing protocol update/user traffic.

so as you mentioned when the traffic for the particular vrf reaches the threshold,probabaly few lsa's getting missed or retransmition called and ospf goes from full---loading--full.but definately ospf not going down comepletely.

again the question is why i am not getting the corrosponding update on Juniper SSG firewall.is those packets not reaching the firewall

Regards

[Giuseppe Larosa · Accepted solution]

Hello Sameer,

traffic can be higher in one specific direction, as usually it happens, so that is the only one affected or the first affected.

difficult to say more.

Hope to help

Giuseppe

[sameermunj]

Hi Giuseppe

i agree with your input on last post and its more justified.

thanks for your help..

Sameer