1.10 Troubleshoot OSPF (v2/v3)
📘CCNP Enterprise – ENARSI (300-410)
1. OSPF Neighbor Relationship
OSPF (Open Shortest Path First) is a link-state routing protocol, meaning routers share information about network links to build a map of the network. For OSPF to share this information, routers must form neighbor relationships.
Think of neighbors in IT as routers agreeing to talk to each other to exchange network maps (LSAs – Link-State Advertisements).
1.1 How OSPF Neighbors Are Formed
OSPF uses a 5-step process to establish neighbor relationships:
- Down State
- The router interface is up, but no OSPF hello packets have been sent or received.
- Init State
- The router sends a Hello packet to introduce itself.
- It waits to see if the neighbor sees it back.
- If it sees its own Router ID in a neighbor’s Hello, it moves to the next state.
- Two-Way State
- Both routers see each other in their Hello packets.
- At this point:
- Neighbor relationship is bi-directional.
- They agree on whether they should be DR (Designated Router) or BDR (Backup DR) on multi-access networks like Ethernet.
- ExStart / Exchange State
- Routers decide who starts the exchange of link-state databases (LSDBs).
- They use a master/slave relationship for this process.
- Loading State
- Routers exchange Link-State Requests to get the missing LSAs.
- Full State
- Neighbor adjacency is complete.
- LSDBs are synchronized.
- Routers can now forward traffic using OSPF routes.
✅ Key Exam Tip: For neighbor adjacency, always check interface status, Hello/Dead timers, area type, and Router IDs.
1.2 Neighbor Requirements
OSPF neighbors will only form if certain conditions match:
| Requirement | Description |
|---|---|
| OSPF Area | Both routers must belong to the same OSPF area (unless using NSSA or stub areas). |
| Hello/Dead Timers | Must match (default Hello = 10s, Dead = 40s for broadcast networks). |
| Subnet | Both routers must be on the same IP subnet for that interface. |
| Authentication | If OSPF authentication is enabled, it must match (type and key). |
| Network Type | Broadcast, point-to-point, or NBMA type must match. |
| Router ID | Must be unique on the OSPF domain. Duplicate Router IDs prevent adjacency. |
⚠️ Exam Focus: Misconfigured timers, mismatched areas, or duplicate Router IDs are the most common reasons for neighbor failures.
2. OSPF Authentication
Authentication ensures that only trusted routers can participate in OSPF. In IT environments, this prevents a rogue router from injecting false routes.
OSPF supports 2 types of authentication:
2.1 Simple Password Authentication
- Sends the password in plain text in every Hello packet.
- Configuration example (IPv4 OSPFv2):
router ospf 1
network 10.1.1.0 0.0.0.255 area 0
area 0 authentication
!
interface GigabitEthernet0/0
ip ospf authentication-key MyPass123
- Pros: Easy to configure.
- Cons: Password is sent in clear text → not secure.
2.2 MD5 Authentication (Recommended)
- Uses Message Digest 5 (MD5) hashing.
- More secure; password is not sent in plain text.
- Configuration example (IPv4 OSPFv2):
router ospf 1
network 10.1.1.0 0.0.0.255 area 0
area 0 authentication message-digest
!
interface GigabitEthernet0/0
ip ospf message-digest-key 1 md5 MySecureKey
- Pros: Secure, commonly used in enterprise networks.
- Cons: Slightly more configuration steps.
2.3 Authentication Key Points
- Both routers must use the same authentication type.
- Both routers must have the same key/password.
- OSPFv3 (for IPv6) supports IPSec-based authentication or MD5.
⚠️ Exam Focus: Mismatched authentication (type or key) prevents neighbor adjacency.
3. Common Troubleshooting Commands
To check OSPF neighbors and authentication issues:
| Command | Purpose |
|---|---|
show ip ospf neighbor | Displays OSPF neighbors and their states. |
show ospfv3 neighbor | For OSPFv3 (IPv6) neighbor status. |
show ip ospf interface | Checks OSPF settings on the interface, including timers and authentication. |
debug ip ospf adj | Monitors adjacency formation in real-time (careful in production!). |
ping <neighbor> | Ensure Layer 3 connectivity exists first. |
Common Exam Scenarios:
- Neighbor stuck in Init → Hello packet not acknowledged.
Check: Timers, IP subnet, network type, authentication. - Neighbor stuck in 2-way (on broadcast network) → DR/BDR mismatch.
Check: DR/BDR election process. - Neighbor not forming → Authentication mismatch.
Check: Authentication type and key.
4. Key Exam Tips / Tricks
- Always check Router ID uniqueness; duplicate IDs prevent adjacency.
- Timers must match: Hello, Dead, and optionally Poll timers.
- Authentication is area-specific, so configuring it on the interface may not be enough.
- For multi-area designs, adjacency failures are often area misconfigurations.
✅ Summary (Easy to Remember for Exam)
- Neighbors need: Same area, same subnet, unique Router IDs, compatible timers, and matching authentication.
- States of adjacency: Down → Init → Two-way → ExStart → Loading → Full.
- Authentication: Simple (clear-text) or MD5 (secure, recommended).
- Troubleshoot: Use
show ip ospf neighbor,show ip ospf interface, and check timers, authentication, and Router IDs.
