Palo Alto Networks OSPF & OSPFv3 Implementation Guide

1. OSPF Overview

Open Shortest Path First (OSPF) is a link-state routing protocol used for routing IP packets within a single routing domain. Palo Alto Networks firewalls support both OSPFv2 (for IPv4) and OSPFv3 (for IPv6).

2. Configuring OSPFv3

  1. Navigate to Network > Virtual Routers and select your virtual router.
  2. Go to the OSPFv3 tab and enable OSPFv3.
  3. Set the Router ID (typically an IPv4 address, even for OSPFv3).
  4. Configure Authentication Profiles using IPsec ESP or AH protocols, as OSPFv3 relies on IPsec for its own authentication mechanisms integrated into the IPv6 header.
  5. Define Areas (e.g., Area 0 for backbone) and assign interfaces to those areas accordingly. Specify interface types (broadcast, point-to-point etc.) and costs.
  6. Set up Export Rules under the OSPFv3 configuration to manage route redistribution from other protocols (like BGP, static) into OSPFv3.
  7. Adjust Advanced Options like SPF calculation delay, LSA intervals, and reference bandwidth if needed.

For detailed steps, refer to the official documentation: Configure OSPFv3 - Palo Alto Networks

3. OSPF Area Types

4. LSA Types

5. Route Redistribution

To redistribute routes from other protocols (e.g., BGP, static, connected) into OSPFv3 on a Palo Alto firewall:

  1. Navigate to Network > Virtual Routers and select your virtual router.
  2. Go to Redistribution Profiles , click Add .
  3. Give the profile a name. Set Priority (lower wins if multiple profiles match).
  4. Under Redistribute , check the source protocol(s) (e.g., static , bgp ).
  5. Optionally configure Filters to selectively redistribute specific routes (by prefix or tag).
  6. Set the desired OSPF Metric (cost) for redistributed routes.
  7. Set the OSPF Metric Type ( Ext 1 or Ext 2 - default is Ext 2).
  8. Go back to the Virtual Router's OSPFv3 configuration.
  9. Under Export Rules , click Add .
  10. Select the Redistribution Profile you just created.

This structure links the profile (defining *what* and *how* to redistribute) to the OSPFv3 process via an Export Rule.

6. Troubleshooting Commands

Use the following CLI commands for troubleshooting OSPF and OSPFv3: 

show routing protocol ospf neighbor        # OSPFv2 neighbors
show routing protocol ospf interface       # OSPFv2 interface status
show routing protocol ospf database        # OSPFv2 LSDB
show routing protocol ospf policy          # OSPFv2 policy/redistribution info
show routing route type ospf               # Routes learned via OSPFv2 in RIB

show routing protocol ospfv3 neighbor      # OSPFv3 neighbors
show routing protocol ospfv3 interface     # OSPFv3 interface status
show routing protocol ospfv3 database      # OSPFv3 LSDB
show routing protocol ospfv3 policy        # OSPFv3 policy/redistribution info
show routing route type ospfv3             # Routes learned via OSPFv3 in RIB

These commands provide insights into OSPF neighbor relationships, interface states, the Link-State Database (LSDB), applied policies, and the final routes installed in the Routing Information Base (RIB).

7. References

OSPF & OSPFv3 Quiz

1. Where in the Palo Alto Networks PAN-OS GUI do you primarily enable OSPFv3 and configure its Router ID?

2. Which OSPF Area Type completely blocks both external routes (Type 5 LSAs) AND summary routes from other areas (Type 3 LSAs), relying solely on a default route from the ABR?

3. An ASBR located within an NSSA needs to advertise external routes learned from BGP. Which LSA type will it use to flood this information *within* the NSSA?

4. What mechanism does OSPFv3 use for authentication between routers, as configured in Palo Alto Networks Authentication Profiles?

5. Which LSA type is specific to OSPFv3 and is used to carry IPv6 prefix information within an area, separating it from the router's link information?

6. To redistribute static routes into OSPFv3 on a Palo Alto firewall, you configure a Redistribution Profile defining the metric and source protocol. How is this profile applied to the OSPFv3 process?

7. When redistributing routes into OSPF, what is the difference between Metric Type Ext 1 (E1) and Ext 2 (E2)?

8. An NSSA ABR receives a Type 7 LSA from within its NSSA. What does it typically do with this LSA when advertising the route to Area 0?

9. Which CLI command would you use on a Palo Alto firewall to check the current state (e.g., Full, Init, 2-Way) of OSPFv3 adjacencies?

10. Which LSA type is responsible for advertising the location (Router ID) of an ASBR residing in a different area?