We're having a similar issue. In our case, we're running a pair of Palo 3220's in an Active/Passive HA running 8.1.6-h2 and a pair of 3850-24-XUs running 16.3.6. The Palo Alto is configured with two OSPF areas: 0 and xx which is a stub area. We're seeing OSPF adjacency going down every 12-20 hours for about 9-10 minutes each time for the xx area only. After working with Palo TAC and doing several packet captures, they determined that the Cisco 3850 stops sending hello packets with the "Active Neighbor" specified.
Palo Alto IP - 1.1.1.1/30
3850 IP - 1.1.1.2/30
Last hello packet from 3850 before adjacency was lost:
Frame 110186: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0
Ethernet II, Src: Cisco_93:b1:5c (00:bf:77:93:b1:5c), Dst: IPv4mcast_05 (01:00:5e:00:00:05)
Internet Protocol Version 4, Src: 1.1.1.2, Dst: 224.0.0.5
Open Shortest Path First
OSPF Header
OSPF Hello Packet
Network Mask: 255.255.255.252
Hello Interval [sec]: 10
Options: 0x10, (L) LLS Data block
Router Priority: 1
Router Dead Interval [sec]: 40
Designated Router: 1.1.1.2
Backup Designated Router: 1.1.1.1
Active Neighbor: 1.1.1.1
OSPF LLS Data Block
Hello packet from Palo just before adjacency was lost
Frame 110187: 82 bytes on wire (656 bits), 82 bytes captured (656 bits) on interface 0
Ethernet II, Src: PaloAlto_e0:40:10 (b4:0c:25:e0:40:10), Dst: IPv4mcast_05 (01:00:5e:00:00:05)
Internet Protocol Version 4, Src: 1.1.1.1, Dst: 224.0.0.5
Open Shortest Path First
OSPF Header
OSPF Hello Packet
Network Mask: 255.255.255.252
Hello Interval [sec]: 10
Options: 0x00
Router Priority: 1
Router Dead Interval [sec]: 40
Designated Router: 1.1.1.2
Backup Designated Router: 1.1.1.1
Active Neighbor: 1.1.1.2
Hello packet from 3850 when adjacency was lost
Frame 110194: 90 bytes on wire (720 bits), 90 bytes captured (720 bits) on interface 0
Ethernet II, Src: Cisco_93:b1:5c (00:bf:77:93:b1:5c), Dst: IPv4mcast_05 (01:00:5e:00:00:05)
Internet Protocol Version 4, Src: 1.1.1.2, Dst: 224.0.0.5
Open Shortest Path First
OSPF Header
OSPF Hello Packet
Network Mask: 255.255.255.252
Hello Interval [sec]: 10
Options: 0x10, (L) LLS Data block
Router Priority: 1
Router Dead Interval [sec]: 40
Designated Router: 1.1.1.2
Backup Designated Router: 0.0.0.0
--->missing active neighbor<---
OSPF LLS Data Block
When the Palo receives the hello from the 3850 without the Active Neighbor, the Palo brings down the adjacency. The Palo continues to send hello packets with the active neighbor set to 1.1.1.2, but the hellos received from the 3850 do not contain the active neighbor during this time. After about 9-10 minutes, the 3850 sends out a DB description packet and then starts including the Active Neighbor in the hello packets and the adjacency comes back up.
We're going to upgrade our 3850s to 16.3.8 and see if the issue goes away. This is the only pair of 3850s that are running the 16.3.6 code.
DB description packet from the 3850 just before adjacency comes back up
Frame 110859: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
Ethernet II, Src: Cisco_93:b1:5c (00:bf:77:93:b1:5c), Dst: PaloAlto_e0:40:10 (b4:0c:25:e0:40:10)
Internet Protocol Version 4, Src: 1.1.1.2, Dst: 1.1.1.1
Open Shortest Path First
OSPF Header
Version: 2
Message Type: DB Description (2)
Packet Length: 32
Source OSPF Router: 1.1.1.2
Area ID: 0.0.0.xx
Checksum: 0x89eb [correct]
Auth Type: Null (0)
Auth Data (none): 0000000000000000
OSPF DB Description
Interface MTU: 1500
Options: 0x50, O, (L) LLS Data block
DB Description: 0x07, (I) Init, (M) More, (MS) Master
DD Sequence: 5326
OSPF LLS Data Block
Hello from 3850 just before adjacency comes back up
Frame 110860: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0
Ethernet II, Src: Cisco_93:b1:5c (00:bf:77:93:b1:5c), Dst: PaloAlto_e0:40:10 (b4:0c:25:e0:40:10)
Internet Protocol Version 4, Src: 1.1.1.2, Dst: 1.1.1.1
Open Shortest Path First
OSPF Header
Version: 2
Message Type: Hello Packet (1)
Packet Length: 48
Source OSPF Router: 1.1.1.2
Area ID: 0.0.0.xx
Checksum: 0xd21a [correct]
Auth Type: Null (0)
Auth Data (none): 0000000000000000
OSPF Hello Packet
Network Mask: 255.255.255.252
Hello Interval [sec]: 10
Options: 0x10, (L) LLS Data block
Router Priority: 1
Router Dead Interval [sec]: 40
Designated Router: 1.1.1.2
Backup Designated Router: 0.0.0.0
Active Neighbor: 1.1.1.1
OSPF LLS Data Block
