This document describes how routing loops can occur with the RFC 1583 compatibility enabled, and the benefit of disabling this feature.
Environment
Palo Alto Firewall
PAN-OS 7.1 and above.
OSPF configured.
Cause
Routing loops can occur when the same external destination is advertised by Autonomous System (AS) boundary routers in separate areas. It is caused by OSPF's preference of intra-area routes over inter-area routes. Routes to any given ASBR are selected primarily based on intra-area preference, while the comparison between the ASBRs is done by cost, ignoring the intra-area preference.
Refer to the diagram below:
In the example above, the routers A3 and B3 are advertising an AS-external LSA for 10.0.0.0/8, with the same external type 2 metric.
Router A1 selects B1 as its next hop towards 10.0.0.0/8, based on the shorter cost to the ASBR B3 ( via B1-->B2--->B3 ).
However, the same shorter route to B3 is not available to B1, due to B1's preference for the (higher cost) intra-area route to B3 through Area 1.
This leads to B1 selecting A1 as the next hop for 10.0.0.0/8, causing a routing loop.
Resolution
Disabling the RFC 1583 compatibility results in preferring the type of path (intra-area or inter-area, through backbone or non-backbone area) to the ASBR.
Cost is used only to break the ties.
So by disabling RFC 1583, ASBRs are now chosen based first on intra-area preference, and then by cost.
In this example, A1 will choose A3 as the next hop to 10.0.0.0/8 and B1 will choose B3 as the next hop to 10.0.0.0/8.
Note: In order to prevent routing loops, all the routers in the OSPF domain should have the "RFC 1583 Compatibility" set identically.