Questo sito utilizza cookie di profilazione (propri e di terze parti) per ottimizzare la tua esperienza online e per inviarti pubblicità in linea con le tue preferenze. Continuando a utilizzare questo sito senza modificare le tue preferenze acconsenti all’uso dei cookie. Se vuoi saperne di più o negare il consenso a tutti o ad alcuni cookie clicca qui>
The website that you are visiting also provides Arabian language. Do you wish to switch language version?
يوفر موقع الويب الذي تزوره المحتوى باللغة العربية أيضًا. هل ترغب في تبديل إصدار اللغة؟
The website that you are visiting also provides Russia language Do you wish to switch language version?
Данный сайт есть в английской версии. Желаете ли Вы перейти на английскую версию?
We are trying to establish an OSPFv3 adjacency over an USG6000 firewall, but the adjacency stops in EXSTART state.
Router1------- USG firewall-------- Router2
For configuring the security policies we define the source/destination zones and enable OSPF service
rule name t
source zone trust
destination zone untrust
Well this is not enough because the interface stops in EXSTART. Check the OSPF status below
<usg>displ ospfv peer
OSPFv3 Process (1)
OSPFv3 Area (0.0.0.0)
Neighbor ID Pri State Dead Time Interface Instance ID
18.104.22.168 1 ExStart/Backup 00:00:36 Vlanif1000 0
Interesting fact, is when changing the OSPFv3 network type from broadcast default to P2P, the adjacency went to Full state.
How to explain this?
For Broadcast network type situation, the DB description packets are sent as unicast to the firewall and the firewall will filter the DB description packet according to the security policies. In this situation, the OSPF process does not go further than the Exstart stage because the security policies of the firewall might not allowing traffic exchange between the local zone of the firewall and the zone to which the OSPF enabled interface belonged.
For P2P network type, OSPF hello packets are send in multicast mode, to DIP ff02::5 and ff02::6. Multicast data will not be checked against source IP and destination IP in our defined security policy and because of this it will establish the adjacency.
Going further we can see that for OSPFv3 routers are sending OSFP DBD using link-local IP addresses. Check below a snip from a OSPFv3 packet capture.
We will need to adjust the traffic policy to include local zone and link-local IP addresses.#