OSPF Loading to Full without a Full to Down message

[epeeler]

We lost connectivity to one our routers. The link between our core router and this router is a ten gig lan link with a firewall in the middle (we don't control the firewall)

While the outage was happening, the core router reported 4 loading to full adjacency messages to the router in question  but never a message in regards to the full state changing to down or anything else.

What would cause me to get loading to full messages on an existing relationship without first seeing the Full/Down message? The buffer on the downed router was too small and any relevant messages had already scrolled off by the time everything came back and we were able to get back into it.  Syslog server was blank since the network connection to this router was down.  It all came back by itself after the last Loading to Full message.

Thanks in advance.

Jun 13 13:35:29: %OSPF-5-ADJCHG: Process 3, Nbr 10.1.1.11 on Vlan127 from LOADING to FULL, Loading Done

Jun 13 13:36:32: %OSPF-5-ADJCHG: Process 3, Nbr  10.1.1.11 on Vlan127 from LOADING to FULL, Loading Done

Jun 13 13:38:50: %OSPF-5-ADJCHG: Process 3, Nbr 10.1.1.11 on Vlan127 from LOADING to FULL, Loading Done

Jun 13 13:43:20: %OSPF-5-ADJCHG: Process 3, Nbr 10.1.1.11 on Vlan127 from LOADING to FULL, Loading Done

[Peter Paluch]

Hello,

To be completely honest, I am not sure about this. While I believe I've seen a similar situation arise in certain cases, I have been never able to reproduce that. The only thing I can currently recommend is to use the log-adjacency-changes detail OSPF configuration command to log the neighbor changes in more detail, not just LOADING->FULL transition. That may help you get more clues the next time this issue reappears.

Best regards,

Peter

[epeeler]

Thanks Peter. Yeah, it's weird. Looking in the logs on the same router, I can see where other neighbors have gone down and then come back up in the past but with this one, all I can see is the "back up" part.  The one difference is that there is a PaloAlto firewall between these two but I'm not sure why that would be relevant to not getting a neighbor down message on the  router that lost connectivity to it's neighbor.

[Calin C.]

Hello,

I had the same experience about an hour ago. Common points:

- only OSPF loading to full message, without any down message

- Firewalls (Cisco PIX) are involved (I have a square from 2 routers and 2 firewalls in one OSPF area)

On the firewall I had not OSPF messages, just on the routers. Strange.

If I'll find a possible root cause I will add it here.

Cheers,

Calin

[browne312]

Hi,

I know this post is old but I hope it helps someone - I had this same issue connecting L3  switches to a Firewall.  Configuring the firewall it to accept OSPF traffic fixed the issue.

Cheers,
Eric

[Vasilii Mikhailovskii]

Hello.

I see the topic is really old, I noticed it's not rear when people face the issue.

Ok, whenever you see LOADING to FULL without FULL to DOWN, yes it would be better to configure " log-adjacency-changes detail" under router configuration (for additional details).

I found the most often cause for the issue is occasional unidirectional communication.

And it works this way:

 - remote peer lose traffic from yourself (miss hello packets);
 - but you don't experience packet loss (you have all the hellos);
 - remote peer typically hit "Dead timer expired" event and drops adjacency;
 - on your local side you see OSPF hello without yourself in a list, so you change state not to Down, but to 1-Way; that is why we don't have any logs for "FULL to DOWN";
 - once the connectivity restores, your side goes from 1-Way to LOADING and finally to FULL (that is logged).

I would say, most typically the issue is caused by underlying L1/L2 (including physical cable or Etherchannel) or by CPU or CoPP related issue.