I cannot work out why an OSPF neighbor is stuck in init state. Using torch I can see MT is receiving MC traffic from neighbor, but there is nothing going from the MT to the same MC address. Why?
I use a default block rule on firewall (after all permit rules) for input/output/forward with log=yes, so I know the firewall is not blocking MT to MC address otherwise it would show in log.
An export of the config is highly recommended to diagnose the problem:
/export file=anynameyouwish (minus sensitive info)
Besides an export, what are your initial thoughts?
Matching router IDs, addressing errors, some forgotten setting... Could be any of those
... MTU, hello interval
these need to be same on both side
From Cisco:
This state specifies that the router has received a hello packet from its neighbor, but the receiving router ID was not included in the hello packet.
When a router receives a hello packet from a neighbor, it must list the sender router ID in its hello packet as an acknowledgment that it received a valid hello packet.
I have two MT routers (R-A and R-B) neighbored with the same peer. R-A is stuck in init state, but not R-B.
If what Cisco says is true, my R-B should also be in same init state, but it isn't. It is showing 'full'.
I have also run a few sniffs. I can also see through tcpdump on the interface at the neighbor's end, the packet sent includes its ID. Sniffing from R-A, I can see the hello packet is received with the neighbors ID present. Interestingly, I can see R-A is trying to send a packet back to the MC address, but from the neighbor's side, I don't see these come in.
Thanks - MTU's match. Intervals match.
There may be an underlying issue with the IPsec tunnel, that must be resolved first, because after a reboot of all equipment, the gre tunnels don't come back up. Dynamic routing through gre and gre over ipsec. Ipsec establishes, but gre tunnels do not. There's always something breaking....
I can't spot the problem. Here's the export.
/interface bridge add fast-forward=no name=site1-ospf-lo port-cost-mode=short protocol-mode=none
/interface bridge add fast-forward=no name=site1-vpn-lo port-cost-mode=short protocol-mode=none
/interface ethernet set [ find default-name=ether1 ] disable-running-check=no
/interface ethernet set [ find default-name=ether2 ] disable-running-check=no
/interface gre add allow-fast-path=no local-address=172.80.3.2 name=site1-site2-gre remote-address=172.80.3.1
/interface gre add allow-fast-path=no local-address=172.80.2.2 name=site1-vpn-gre remote-address=172.80.2.1
/interface list add name=WAN
/interface list add name=VPN
/interface list add name=LAN
/interface list add name=GRE
/ip ipsec mode-config add name=s2s-abc responder=no
/ip ipsec mode-config add name=test-vpn-s2s responder=no
/ip ipsec policy group add name=s2s-abc
/ip ipsec policy group add name=test-vpn-s2s
/ip ipsec profile add dh-group=ecp384 dpd-interval=30s dpd-maximum-failures=3 enc-algorithm=aes-256 hash-algorithm=sha384 name=s2s-abc nat-traversal=no prf-algorithm=sha384
/ip ipsec profile add dh-group=ecp384 dpd-interval=10s dpd-maximum-failures=3 enc-algorithm=aes-256 hash-algorithm=sha384 name=vpn.test.net nat-traversal=no prf-algorithm=sha384
/ip ipsec peer add address=site2.test.net exchange-mode=ike2 name=site2.test.net profile=s2s-abc
/ip ipsec peer add address=vpn.test.net exchange-mode=ike2 name=vpn.test.net profile=vpn.test.net
/ip ipsec proposal add auth-algorithms=sha512,sha256 enc-algorithms=aes-256-cbc name=b1.test.net pfs-group=ecp384
/ip ipsec proposal add auth-algorithms=sha512,sha256 enc-algorithms=aes-256-cbc name=vpn.test.net pfs-group=ecp384
/routing id add disabled=no id=10.10.0.3 name=ospf_id select-dynamic-id=""
/routing ospf instance add disabled=no name=ospf-instance-1 originate-default=never out-filter-chain=ospf-out redistribute=dhcp router-id=ospf_id
/routing ospf area add disabled=no instance=ospf-instance-1 name=backbone
/ip neighbor discovery-settings set discover-interface-list=none mode=rx-only
/ip settings set secure-redirects=no send-redirects=no
/ipv6 settings set accept-router-advertisements=yes disable-ipv6=yes forward=no
/interface list member add interface=ether1 list=WAN
/interface list member add interface=ether2 list=LAN
/interface list member add interface=site1-site2-gre list=GRE
/interface list member add interface=site1-vpn-gre list=GRE
/interface list member add interface=site1-ospf-lo list=GRE
/ip address add address=172.80.2.2/30 interface=site1-vpn-lo network=172.80.2.0
/ip address add address=172.16.5.2/30 interface=site1-site2-gre network=172.16.5.0
/ip address add address=172.16.7.2/30 interface=site1-vpn-gre network=172.16.7.0
/ip address add address=10.10.0.3 interface=site1-ospf-lo network=10.10.0.3
/ip address add address=172.80.3.2/30 interface=site1-vpn-lo network=172.80.3.0
/ip dhcp-client add interface=ether1 use-peer-ntp=no
/ip dhcp-client add interface=ether2 use-peer-ntp=no
/ip firewall address-list add address=192.168.90.0/25 list=INTERNAL_NETS
/ip firewall address-list add address=192.168.96.0/25 list=INTERNAL_NETS
/ip firewall address-list add address=0.0.0.0/8 comment="Self-Identification [RFC 3330]" list=BOGONS
/ip firewall address-list add address=10.0.0.0/8 comment="Private [RFC 1918] - CLASS A" list=BOGONS
/ip firewall address-list add address=127.0.0.0/8 comment="Loopback [RFC 3330]" list=BOGONS
/ip firewall address-list add address=169.254.0.0/16 comment="Link Local [RFC 3330]" list=BOGONS
/ip firewall address-list add address=172.16.0.0/12 comment="Private [RFC 1918] - CLASS B" list=BOGONS
/ip firewall address-list add address=192.168.0.0/16 comment="Private [RFC 1918] - CLASS C" list=BOGONS
/ip firewall address-list add address=192.0.2.0/24 comment="Reserved - IANA - TestNet1" list=BOGONS
/ip firewall address-list add address=192.88.99.0/24 comment="6to4 Relay Anycast [RFC 3068]" list=BOGONS
/ip firewall address-list add address=198.18.0.0/15 comment="NIDB Testing - dont know what this is" list=BOGONS
/ip firewall address-list add address=198.51.100.0/24 comment="Reserved - IANA - TestNet2" list=BOGONS
/ip firewall address-list add address=203.0.113.0/24 comment="Reserved - IANA - TestNet3" list=BOGONS
/ip firewall address-list add address=224.0.0.0/4 comment="MC, Class D, IANA" list=BOGONS
/ip firewall address-list add address=192.0.0.0/24 comment="IANA [RFC 6890]" list=BOGONS
/ip firewall address-list add address=100.64.0.0/10 comment="[RFC 6890]" list=BOGONS
/ip firewall address-list add address=192.0.0.0/29 comment="[RFC 6890]" list=BOGONS
/ip firewall address-list add address=255.255.255.255 comment="[RFC 6890]" list=BOGONS
/ip firewall address-list add address=172.16.5.0/30 list=GRE_NET
/ip firewall address-list add address=172.80.3.0/30 list=IPSEC_NET
/ip firewall address-list add address=172.16.7.0/30 list=GRE_NET
/ip firewall address-list add address=192.168.2.0/30 list=HQ_LAN
/ip firewall address-list add address=10.10.0.0/29 list=OSPF_NET
/ip firewall address-list add address=224.0.0.0/24 list=OSPF_MC
/ip firewall address-list add address=172.80.2.0/30 list=IPSEC_NET
/ip firewall address-list add address=vpn.test.net list=HQ
/ip firewall address-list add address=vpn.test.net list=TEST_DOMAINS
/ip firewall address-list add address=site1.test.net list=TEST_DOMAINS
/ip firewall address-list add address=site2.test.net list=TEST_DOMAINS
/ip firewall address-list add address=159.148.147.251 list=MT_UPDATE
/ip firewall filter add action=accept chain=icmp comment="echo reply" icmp-options=0:0 protocol=icmp
/ip firewall filter add action=accept chain=icmp comment="net unreachable" icmp-options=3:0 protocol=icmp
/ip firewall filter add action=accept chain=icmp comment="host unreachable" icmp-options=3:1 protocol=icmp
/ip firewall filter add action=accept chain=icmp comment="protocol unreachable" icmp-options=3:2 protocol=icmp
/ip firewall filter add action=accept chain=icmp comment="port unreachable" icmp-options=3:3 protocol=icmp
/ip firewall filter add action=accept chain=icmp comment="host unreachable fragmentation required" icmp-options=3:4 protocol=icmp
/ip firewall filter add action=accept chain=icmp comment="allow echo request" icmp-options=8:0 protocol=icmp
/ip firewall filter add action=accept chain=icmp comment="allow time exceed" icmp-options=11:0 protocol=icmp
/ip firewall filter add action=accept chain=icmp comment="allow parameter bad" icmp-options=12:0 protocol=icmp
/ip firewall filter add action=drop chain=icmp comment="deny all other types"
/ip firewall filter add action=drop chain=input comment="Drop BOGONS inbound on WAN" in-interface-list=WAN ipsec-policy=in,none src-address-list=BOGONS
/ip firewall filter add action=accept chain=input protocol=ospf
/ip firewall filter add action=accept chain=output dst-address-list=OSPF_MC out-interface-list=GRE
/ip firewall filter add action=accept chain=output protocol=ospf
/ip firewall filter add action=accept chain=input in-interface=lo
/ip firewall filter add action=accept chain=input in-interface=site1-ospf-lo
/ip firewall filter add action=accept chain=input in-interface=site1-vpn-lo
/ip firewall filter add action=accept chain=output out-interface=lo
/ip firewall filter add action=accept chain=output out-interface=site1-ospf-lo
/ip firewall filter add action=accept chain=output out-interface=site1-vpn-lo
/ip firewall filter add action=accept chain=input dst-port=22 protocol=tcp src-address-list=HQ
/ip firewall filter add action=accept chain=input in-interface-list=WAN log-prefix=gre-in protocol=gre
/ip firewall filter add action=accept chain=output disabled=yes log=yes log-prefix=gre out-interface-list=WAN protocol=gre
/ip firewall filter add action=accept chain=input disabled=yes dst-address-list=OSPF_MC in-interface-list=GRE protocol=ospf
/ip firewall filter add action=accept chain=output disabled=yes dst-address-list=OSPF_MC protocol=ospf
/ip firewall filter add action=accept chain=input in-interface-list=GRE protocol=ospf
/ip firewall filter add action=accept chain=input in-interface-list=GRE
/ip firewall filter add action=accept chain=output out-interface-list=GRE
/ip firewall filter add action=accept chain=output log-prefix=gre protocol=gre
/ip firewall filter add action=accept chain=input dst-port=4500,500 log-prefix=ipsec-in protocol=udp
/ip firewall filter add action=accept chain=input log-prefix=ipsec-esp protocol=ipsec-esp
/ip firewall filter add action=accept chain=output dst-port=4500,500 log-prefix=ipsec-out protocol=udp
/ip firewall filter add action=accept chain=output log-prefix=ipsec-esp-out protocol=ipsec-esp
/ip firewall filter add action=accept chain=input dst-port=8291 in-interface-list=WAN protocol=tcp src-address-list=HQ
/ip firewall filter add action=accept chain=input disabled=yes in-interface-list=WAN protocol=tcp src-address-list=HQ
/ip firewall filter add action=accept chain=output dst-address-list="" dst-port=2000 protocol=tcp
/ip firewall filter add action=accept chain=output dst-address-list=MT_UPDATE dst-port=443,80 protocol=tcp
/ip firewall filter add action=accept chain=output dst-port=123 protocol=udp
/ip firewall filter add action=accept chain=output dst-port=53 protocol=udp
/ip firewall filter add action=accept chain=output dst-port=67-68 protocol=udp
/ip firewall filter add action=jump chain=output comment="allow outbound icmp" jump-target=icmp protocol=icmp
/ip firewall filter add action=jump chain=input comment="accept incoming ICMP" jump-target=icmp protocol=icmp src-address-list=TEST_DOMAINS
/ip firewall filter add action=jump chain=input comment="accept incoming ICMP" jump-target=icmp protocol=icmp src-address-list=IPSEC_NET
/ip firewall filter add action=jump chain=input comment="accept incoming ICMP" jump-target=icmp protocol=icmp src-address-list=OSPF_NET
/ip firewall filter add action=jump chain=input comment="accept incoming ICMP from LAN" jump-target=icmp protocol=icmp src-address-list=INTERNAL_NETS
/ip firewall filter add action=jump chain=input comment="accept incoming ICMP" jump-target=icmp protocol=icmp src-address-list=GRE_NET
/ip firewall filter add action=jump chain=input comment="accept incoming ICMP" jump-target=icmp protocol=icmp src-address-list=HQ_LAN
/ip firewall filter add action=jump chain=forward comment="accept forwarded ICMP" jump-target=icmp protocol=icmp
/ip firewall filter add action=accept chain=input disabled=yes dst-address=127.0.0.1
/ip firewall filter add action=accept chain=input connection-state=established,related,untracked
/ip firewall filter add action=fasttrack-connection chain=forward connection-mark=no-mark connection-state=established,related
/ip firewall filter add action=accept chain=forward connection-state=established,related,untracked
/ip firewall filter add action=accept chain=forward connection-nat-state="" connection-state="" src-address-list=INTERNAL_NETS
/ip firewall filter add action=accept chain=forward comment="defconf: accept IN ipsec policy" ipsec-policy=in,ipsec
/ip firewall filter add action=accept chain=forward comment="defconf: accept OUT ipsec policy" ipsec-policy=out,ipsec
/ip firewall filter add action=drop chain=forward comment="Drop BOGONS forwarded" in-interface-list=WAN src-address-list=BOGONS
/ip firewall filter add action=drop chain=forward comment="Drop BOGONS forwarded" out-interface-list=WAN src-address-list=BOGONS
/ip firewall filter add action=drop chain=forward comment="Drop BOGONS forwarded" dst-address-list=BOGONS in-interface-list=WAN
/ip firewall filter add action=drop chain=forward comment="Drop BOGONS forwarded" dst-address-list=BOGONS out-interface-list=WAN
/ip firewall filter add action=drop chain=forward connection-nat-state=!dstnat connection-state=new in-interface-list=WAN log=yes log-prefix=WAN-drop
/ip firewall filter add action=drop chain=forward comment="drop invalid" connection-state=invalid log=yes log-prefix=fwd-invalid
/ip firewall filter add action=drop chain=output comment="drop invalid" connection-state=invalid log=yes log-prefix=out-invalid
/ip firewall filter add action=drop chain=input comment="drop invalid" connection-state=invalid log=yes log-prefix=in-invalid
/ip firewall filter add action=drop chain=input comment="Drop anything else IN!" log-prefix=FINAL_DROP_RULE_IN
/ip firewall filter add action=drop chain=forward comment="Drop anything else FW!" log=yes log-prefix=FINAL_DROP_RULE_FW
/ip firewall filter add action=drop chain=output comment="Drop anything else OU!" connection-state=!established,related log=yes log-prefix=FINAL_DROP_RULE_OU
/ip firewall mangle add action=change-mss chain=forward connection-mark=v1-mngle1 in-interface=site1-site2-gre new-mss=clamp-to-pmtu protocol=tcp tcp-flags=syn
/ip firewall mangle add action=change-mss chain=forward connection-mark=v1-mngle2 in-interface=site1-vpn-gre new-mss=clamp-to-pmtu protocol=tcp tcp-flags=syn
/ip firewall nat add action=masquerade chain=srcnat ipsec-policy=out,none log=yes out-interface-list=WAN src-address-list=INTERNAL_NETS
/ip firewall raw add action=notrack chain=prerouting dst-address=172.80.2.0/30 src-address=172.80.2.0/30
/ip firewall raw add action=notrack chain=prerouting dst-address=172.80.3.0/30 src-address=172.80.3.0/30
/ip ipsec identity add auth-method=digital-signature certificate=vpn-cert-client-site1 generate-policy=port-strict peer=site2.test.net policy-template-group=s2s-abc
/ip ipsec identity add auth-method=digital-signature certificate=test-vpn-client-site1 generate-policy=port-strict peer=vpn.test.net policy-template-group=test-vpn-s2s
/ip ipsec policy set 0 disabled=yes
/ip ipsec policy add dst-address=172.80.3.1/32 level=unique peer=site2.test.net proposal=b1.test.net src-address=172.80.3.2/32 tunnel=yes
/ip ipsec policy add dst-address=172.80.2.1/32 level=unique peer=vpn.test.net proposal=vpn.test.net src-address=172.80.2.2/32 tunnel=yes
/ip service set www-ssl certificate=https-cert disabled=no max-sessions=2 tls-version=only-1.2
/ip ssh set host-key-size=4096 host-key-type=ed25519 password-authentication=no strong-crypto=yes
/ipv6 nd set [ find default=yes ] disabled=yes
/routing filter rule add chain=ospf-out disabled=no rule="if (dst in 192.168.0.0/16) { accept; }\
\nreject;"
/routing ospf interface-template add area=backbone disabled=no interfaces=site1-ospf-lo,site1-vpn-gre,site1-site2-gre type=ptp-unnumbered
/system clock set time-zone-name=ETC/UTC
/system identity set name=site1.test.net
/system logging add disabled=yes topics=ipsec,!packet
/system ntp client set enabled=yes
/system ntp server set broadcast=yes broadcast-addresses=192.168.96.128
/system ntp client servers add address=pool.ntp.org
/tool bandwidth-server set enabled=no
/tool mac-server set allowed-interface-list=none
/tool mac-server mac-winbox set allowed-interface-list=none
/tool mac-server ping set enabled=no
/tool romon port set [ find default=yes ] forbid=yes
/user settings set minimum-password-length=8
The semicolon after accept in the routing filter rule isn't needed as well as the reject at the end because routing filters by default are deny
And NAT may be changing addresses too, so better to leave out the src-address-list parameter from the masquerade rule
That doesn't make sense?
My reading of that masquerading NAT rule is "if packet must leave WAN interface, isn't IPsec and is from an 192.168.90.0/25 or 192.168.96.0/25, then NAT it" so why would this interfere with OSPF when the only OSPF interfaces involved are loopback and gre tunnels (which run on top of ipsec)?
This routing filter did not seem to cause an issue with my other router using the same filter and similar configuration as posted. Also, in the other post I described running a sniff of the gre tunnel OSPF was running through and I could see the router sending MC hello packets, but could not see them on a sniff of the neighbour's corresponding interface. As if something is stopping the packets getting there.
Do you have any thoughts about the config of the gre and ipsec?
Are you sure there isn't any device between the neighbors that might filter out MC traffic?
Also, about the ptp-unnumbered option in the OSPF template, why it? The neighbor has an associated IP on the GRE tunnel, so regular ptp should do the job
How can it if the MC traffic is being sent over a gre tunnel, and gre is over ipsec?
I will look at that later. Since I made this post, my gre tunnels are not coming up at all now. Without those, OSPF wont work anyway.