Verifying Equal Cost Paths in OSPF

Note: This article applies to PAN-OS 5.0, 5.1, 6.0, 6.1.  Support for equal cost multi-path (ECMP) routing was added in PAN-OS 7.0.

Details

In any given OSPF domain, there may exist multiple paths to the same destination. In cases where these paths all have the same cost, only one route will be injected into the routing table. In the example below, the firewall is receiving two equal cost paths for the default route (0.0.0.0/0), but only one path is displayed in the routing table. The routing table can be viewed by navigating to Network > Virtual Routers and clicking the "More Runtime Stats" link for the virtual router you want to check. The routing table can also be verified from the CLI using the "show routing route" command:

Cause

Palo Alto Networks next-generation firewalls running PAN-OS versions prior to 7.0 do not support equal cost multi-path (ECMP) routing and will only inject one equal cost route into the routing table at a time. If one of the paths becomes unavailable it will then inject the alternate equal cost route into the routing table.

Verification

In order to verify that OSPF is learning both the equal cost routes, verify that both routes are present in the OSPF Link State Database (LSDB). In the example below, the firewall is receiving two external link state advertisements (LSA). These LSAs are both type 2 external advertisements, with equal metrics.

The LSDB can be viewed by running the following command from the CLI:

> show routing protocol ospf dumplsdb

The following screenshot shows the change in the routing table when the currently selected route is removed from the routing table. Note that the second equal cost route is now injected into the routing table.

See Also

For OSPF configuration assistance, see How to Configure OSPF.

For information on ECMP in PAN-OS 7.0 see Equal Cost Multipath in PAN-OS 7.0

owner: jperry