OSPF graceful restart is not working as expected during the high availability failover

Diagnosis

In an active/passive environment, when customers use OSPF protocol, with the graceful restart feature enabled, during the high availability failover the OSPF graceful restart directs OSPF neighbors to continue using routes through a device during a short transition when it is out of service. This increases network stability by reducing the frequency of routing table reconfiguration and the related route flapping that can occur during short periodic down times.

How graceful restart works

When the firewall is down for a short period of time or is unavailable for short intervals, it sends grace LSAs (LSA type 9) to its OSPF neighbors. Upon receiving the grace LSAs, the neighbor continues to forward routes through the firewall and to send LSAs that announce routes through the firewall. If the firewall resumes operation or the passive device changes the state to active before expiration of the grace period or the neighbor's max restart time, traffic forwarding will continue as before without network disruption. If the firewall does not resume operation or there is an issue in HA failover, after the grace period has expired or the neighbour's max restart time expired, the neighbors will exit helper mode and resume normal operation, which will involve reconfiguring the routing table to bypass the firewall.

Here is a sample packet capture:

Sometimes even though OSPF graceful restart is configured on the Palo Alto Networks devices, during the HA failover, users notice traffic disruption due to the route not available to forward the traffic.