Palo Alto Networks Knowledgebase: OSPF graceful restart is not working as expected during the high availability failover

OSPF graceful restart is not working as expected during the high availability failover

5236
Created On 02/07/19 23:56 PM - Last Updated 02/07/19 23:56 PM
Mobile Network Infrastructure
Symptom

Symptoms

In an active/passive high availability environment, during the HA failover, OSPF graceful restart is not working as expected due to which OSPF neigbor terminates the adjacency and initiates a new adjacency process after an HA failover event.

Diagnosis

In an active/passive environment, when customers use OSPF protocol, with the graceful restart feature enabled, during the high availability failover the OSPF graceful restart directs OSPF neighbors to continue using routes through a device during a short transition when it is out of service. This increases network stability by reducing the frequency of routing table reconfiguration and the related route flapping that can occur during short periodic down times.

 

Graceful Restart1.png

 

How graceful restart works

When the firewall is down for a short period of time or is unavailable for short intervals, it sends grace LSAs (LSA type 9) to its OSPF neighbors. Upon receiving the grace LSAs, the neighbor continues to forward routes through the firewall and to send LSAs that announce routes through the firewall. If the firewall resumes operation or the passive device changes the state to active before expiration of the grace period or the neighbor's max restart time, traffic forwarding will continue as before without network disruption. If the firewall does not resume operation or there is an issue in HA failover, after the grace period has expired or the neighbour's max restart time expired, the neighbors will exit helper mode and resume normal operation, which will involve reconfiguring the routing table to bypass the firewall.

 

Here is a sample packet capture:

 

Graceful LSA.png

 

Sometimes even though OSPF graceful restart is configured on the Palo Alto Networks devices, during the HA failover, users notice traffic disruption due to the route not available to forward the traffic.



Resolution

OSPF neighbors must be configured with grace restart helper. If the graceful helper is not configured on the neighboring devices, it will reject the grace LSA and it will not be processed.

 

In order to have OSPF graceful restart work correctly, enable graceful restart and graceful helper mode on both local and neighboring devices.

 

Please follow the below steps to configure a graceful restart.

 

From the GUI:

  1. Go to network.
  2. Select the appropriate virtual router.
  3. Enable OSPF.
  4. Choose advanced and enable "Graceful Restart" and commit the changes.

 

From the CLI:

Run this command:

admin@PA-Firewall> configure

Entering configuration mode

[edit]

admin@PA-Firewall# set network virtual-router default protocol ospf graceful-restart enable yes

admin@PA-Firewall# commit

 

When graceful helper mode is configuredif the OSPF neighbor is down for a short period of time or is unavailable for short intervals, the OSPF neighbour will send a graceful LSA to the firewall.  Upon receiving the graceful LSA Firewall enters helper mode and maintains OSPF full state with the neighbor until the grace period or neighbor's max restart time expires.

 

Please follow the below steps to configure graceful helper mode.

 

From the GUI:

  1. Go to Network.
  2. Select the appropriate Virtual Router.
  3. Enable OSPF.
  4. Choose Advanced and "Enable Helper Mode."

 

From the CLI:

admin@PA-Firewall> configure

Entering configuration mode

[edit]

admin@PA-Firewall# set network virtual-router default protocol ospf graceful-restart helper-enable yes

admin@PA-Firewall# commit

 



Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEECA0&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language