某局点交换机日志频繁提示router-id冲突、业务中断的经验案例

组网说明：核心交换机与防火墙跑OSPF，与接入1、接入2之间跑RRPP环网，业务vlan3019,网关在核心交换机上。

核心交换机一直再提示router-id冲突，并且时间间隔很短：

*Jan 11 02:41:02:520 2013 Zhongxian-SF-New OSPF/7/DEBUG: OSPF 1 :OSPF received packet having conflicted Router ID :20.50.100.130. 

 *Jan 11 02:41:02:520 2013 Zhongxian-SF-New OSPF/7/DEBUG: OSPF 1 :OSPF received packet having conflicted Router ID :20.50.100.130. 

 *Jan 11 02:41:02:521 2013 Zhongxian-SF-New OSPF/7/DEBUG: OSPF 1 :OSPF received packet having conflicted Router ID :20.50.100.130. 

 *Jan 11 02:41:02:521 2013 Zhongxian-SF-New OSPF/7/DEBUG: OSPF 1 :OSPF received packet having conflicted Router ID :20.50.100.130. 

 *Jan 11 02:41:02:522 2013 Zhongxian-SF-New OSPF/7/DEBUG: OSPF 1 :OSPF received packet having conflicted Router ID :20.50.100.130.

 *Jan 11 02:41:02:522 2013 Zhongxian-SF-New OSPF/7/DEBUG: OSPF 1 :OSPF received packet having conflicted Router ID :20.50.100.130. 

1、router-id冲突分为区域内的router-id冲突和区域间的router-id冲突，现场ospf只有一个area10,所以肯定是区域内的router-id冲突。

2、而区域内的router-id冲突又分为直连的router-id冲突和非直连的router-id冲突，这里的非直连是指2台router-id冲突的设备都只与第三台设备建立ospf,通过第三台设备相互学习路由的环境。直连的router-id冲突故障现象很明显，ospf邻居无法建立。现场反馈ospf邻居中断，并且在核心上多次查看ospf错包统计信息，发现 Router ID confusion 字段计数一直再增长，只有直连router-id冲突才会导致ospf错包统计中的Router ID confusion存在计数且不断增加

dis ospf statistics error

         OSPF Process 1 with Router ID 20.50.100.130

                 OSPF Packet Error Statistics

 99551     : Router ID confusion         0         : Bad packet

 0         : Bad version                 0         : Bad checksum

 4277      : Bad area ID                 0         : Drop on unnumbered link

 3748      : Bad virtual link            0         : Bad authentication type

 0         : Bad authentication key      0         : Packet too small

 7         : Neighbor state low          0         : Transmit error

 0         : Interface down              0         : Unknown neighbor

 0         : HELLO: Netmask mismatch     0         : HELLO: Hello-time mismatch

 0         : HELLO: Dead-time mismatch   0         : HELLO: Ebit option mismatch

 0         : HELLO: Mbit option mismatch 0         : DD: MTU option mismatch

 0         : DD: Unknown LSA type        0         : DD: Ebit option mismatch

 1         : ACK: Bad ack                0         : ACK: Unknown LSA type

 0         : REQ: Empty request          0         : REQ: Bad request

 0         : UPD: LSA checksum bad       0         : UPD: Unknown LSA type

 0         : UPD: Less recent LSA

dis ospf statistics error

         OSPF Process 1 with Router ID 20.50.100.130

                 OSPF Packet Error Statistics

 100051    : Router ID confusion         0         : Bad packet

 0         : Bad version                 0         : Bad checksum

 4279      : Bad area ID                 0         : Drop on unnumbered link

 3750      : Bad virtual link            0         : Bad authentication type

 0         : Bad authentication key      0         : Packet too small

 7         : Neighbor state low          0         : Transmit error

 0         : Interface down              0         : Unknown neighbor

 0         : HELLO: Netmask mismatch     0         : HELLO: Hello-time mismatch

 0         : HELLO: Dead-time mismatch   0         : HELLO: Ebit option mismatch

 0         : HELLO: Mbit option mismatch 0         : DD: MTU option mismatch

 0         : DD: Unknown LSA type        0         : DD: Ebit option mismatch

 1         : ACK: Bad ack                0         : ACK: Unknown LSA type

 0         : REQ: Empty request          0         : REQ: Bad request

 0         : UPD: LSA checksum bad       0         : UPD: Unknown LSA type

 0         : UPD: Less recent LSA

由此判断现场存在直连的router-id冲突。

3、根据现场描述的情况，核心交换机只与防火墙建立ospf邻居，于是检查防火墙配置，防火墙router-id配置正常，不存在冲突情况。

4、那直连的router-id冲突是如何产生的？在核心交换机上debug查看ospf收发包情况

*Jan 11 02:41:01:453 2013 Zhongxian-SF-New OSPF/7/DEBUG: OSPF 1: Sending packets.                                                        

*Jan 11 02:41:01:453 2013 Zhongxian-SF-New OSPF/7/DEBUG: Source address: 10.92.17.193                                                   

*Jan 11 02:41:01:453 2013 Zhongxian-SF-New OSPF/7/DEBUG: Destination address: 224.0.0.5                                                  

*Jan 11 02:41:01:453 2013 Zhongxian-SF-New OSPF/7/DEBUG: Version 2, Type: 1, Length: 44.                                                

*Jan 11 02:41:01:453 2013 Zhongxian-SF-New OSPF/7/DEBUG: Router: 20.50.100.130, Area: 0.0.0.10, Checksum: 26371.                        

*Jan 11 02:41:01:453 2013 Zhongxian-SF-New OSPF/7/DEBUG: Authentication type: 00, Key(ASCII): 0 0 0 0 0 0 0 0.                          

*Jan 11 02:41:01:454 2013 Zhongxian-SF-New OSPF/7/DEBUG: Network mask: 255.255.255.192, Hello interval: 10, Option: _E_.                

*Jan 11 02:41:01:454 2013 Zhongxian-SF-New OSPF/7/DEBUG: Router priority: 1, Dead Interval: 40, DR: 10.92.17.193, BDR: 0.0.0.0.         

*Jan 11 02:41:01:525 2013 Zhongxian-SF-New OSPF/7/DEBUG:

  OSPF 1 :OSPF received packet having conflicted Router ID :20.50.100.130.  

*Jan 11 02:41:02:453 2013 Zhongxian-SF-New OSPF/7/DEBUG: OSPF 1: Sending packets.                                                        

*Jan 11 02:41:02:453 2013 Zhongxian-SF-New OSPF/7/DEBUG: Source address: 80.150.171.41                                                  

*Jan 11 02:41:02:453 2013 Zhongxian-SF-New OSPF/7/DEBUG: Destination address: 224.0.0.5                                                 

*Jan 11 02:41:02:453 2013 Zhongxian-SF-New OSPF/7/DEBUG: Version 2, Type: 1, Length: 44.                                                

*Jan 11 02:41:02:453 2013 Zhongxian-SF-New OSPF/7/DEBUG: Router: 20.50.100.130, Area: 0.0.0.10, Checksum: 34596.                        

*Jan 11 02:41:02:453 2013 Zhongxian-SF-New OSPF/7/DEBUG: Authentication type: 00, Key(ASCII): 0 0 0 0 0 0 0 0.                          

*Jan 11 02:41:02:454 2013 Zhongxian-SF-New OSPF/7/DEBUG: Network mask: 255.255.255.252, Hello interval: 10, Option: _E_.                

*Jan 11 02:41:02:454 2013 Zhongxian-SF-New OSPF/7/DEBUG: Router priority: 1, Dead Interval: 40, DR: 80.150.171.41, BDR: 0.0.0.0.        

*Jan 11 02:41:02:518 2013 Zhongxian-SF-New OSPF/7/DEBUG:

  OSPF 1 :OSPF received packet having conflicted Router ID :20.50.100.130.   

*Jan 11 02:41:02:519 2013 Zhongxian-SF-New OSPF/7/DEBUG:

发现ospf组播hello报文会以2个源地址发出去，一个是核心上与防火墙互联的地址，还一个是业务vlan3019的网关地址。由于未配置静默端口，hello报文发往vlan3019是正常现象。结合刚刚检查防火墙侧配置没问题，因此怀疑VLAN3019的二层环网是否存在环路，导致发往vlan3019的组播hello报文在vlan内广播又重新回到核心交换机上，从而产生router-id冲突。

5、为了验证刚刚的猜想，尝试将vlan3019配置为ospf静默端口，禁止收发ospf报文，发现router-id冲突消失了，并且ospf邻居关系恢复正常。

6、因此初步判断二层存在环路导致router-id冲突，检查RRPP环网的接口状态，发现主节点的副端口处于阻塞状态，RRPP状态正常，并且现场将RRPP副端口shutdown的情况下，核心还是存在router-id冲突。只有当核心交换机的主副端口都shutdown，router-id冲突才会消失。继续往下排查，发现接入1有两个接口存在大量MAC地址漂移，并且计数在持续增长，经现场排查发现为私接家用路由器导致。

排查环路后问题解决

总结：

1、在处理router-id冲突的问题时，首先要判断属于哪种冲突，具体如何判断可以参考案例：https://zhiliao.h3c.com/Theme/details/5831

另外一定要摸清现场的组网，才能对症下药。

2、除了配置错误，存在环路也可能导致router-id冲突。

3、建议将OSPF边缘节点配置为静默端口，这样可以增强OSPF的组网适应能力，减少系统资源的消耗。

4、在项目部署过程中，建议OSPF Router ID在配置OSPF进程前，规划好每台路由器的Router ID，比如专门划出一个网段作为ospf router-id使用，并通过使用ospf 1 router-id X.X.X.X 命令为每一个OSPF进程手工指定好Router ID。