Palo Alto Networks OSPF & OSPFv3 Implementation Guide

1. OSPF Overview

Open Shortest Path First (OSPF) is a link-state routing protocol used for routing IP packets within a single routing domain. Palo Alto Networks firewalls support both OSPFv2 (for IPv4) and OSPFv3 (for IPv6).

2. Configuring OSPFv3

Navigate to Network > Virtual Routers and select your virtual router.
Go to the OSPFv3 tab and enable OSPFv3.
Set the Router ID (typically an IPv4 address).
Configure Authentication Profiles using ESP or AH protocols as OSPFv3 relies on IPsec for authentication.
Define Areas and assign interfaces accordingly.
Set up Export Rules for route redistribution.
Adjust Advanced Options like SPF calculation delay and LSA intervals.

For detailed steps, refer to the official documentation: Configure OSPFv3 - Palo Alto Networks

3. OSPF Area Types

Normal Area: No restrictions; carries all types of routes.
Stub Area: Does not accept external routes; relies on a default route to reach external networks.
Totally Stubby Area (TSA): A stub area that also blocks summary LSAs (Type 3).
Not-So-Stubby Area (NSSA): Allows external routes (Type 7 LSAs) but does not receive external routes from other areas.

4. LSA Types

Type 1 (Router LSA): Describes the state and cost of the router's links.
Type 2 (Network LSA): Describes the routers attached to a multi-access network.
Type 3 (Summary LSA): Advertises networks from one area to another.
Type 4 (ASBR Summary LSA): Advertises the location of an ASBR.
Type 5 (External LSA): Describes routes to external networks.
Type 7 (NSSA External LSA): Used in NSSA areas to describe external routes.
Type 8 (Link LSA): OSPFv3 specific; provides link-local information.
Type 9 (Intra-Area Prefix LSA): OSPFv3 specific; carries IPv6 prefix information.

5. Route Redistribution

To redistribute routes into OSPFv3:

Navigate to Network > Virtual Routers and select your virtual router.
Go to the OSPFv3 tab and click on Export Rules .
Click Add to create a new export rule.
Specify the source (e.g., static, connected, BGP) and set the desired metric and route type (Ext 1 or Ext 2).

Ensure that the redistribution profile is correctly referenced in the OSPFv3 configuration.

6. Troubleshooting Commands

Use the following CLI commands for troubleshooting OSPF and OSPFv3:

show routing protocol ospf neighbor
show routing protocol ospf interface
show routing protocol ospf database
show routing route
show routing protocol ospfv3 neighbor
show routing protocol ospfv3 interface
show routing protocol ospfv3 database

These commands provide insights into OSPF neighbor relationships, interface states, and the OSPF database.