logbuff报错

场一台9505E交换机登陆后有异常ospfMaxAgeLsa不断刷屏，如下：

#Jul 13 22:11:33:284 2016 HQ-HQ-NB-7F-SWL3-CO-H9505E-2 OSPF/5/MAXAGE_LSA: OSPF TrapID1.3.6.1.2.1.14.16.2.13: Aged a LSA Area Id 0.0.0.0 LsdbType 5 LsdbLsid 10.189.200.68 LsdbRouterId 10.206.1.16 Router 10.206.1.8 .

#Jul 13 22:11:33:527 2016 HQ-HQ-NB-7F-SWL3-CO-H9505E-2 OSPF/5/MAXAGE_LSA: OSPF TrapID1.3.6.1.2.1.14.16.2.13: Aged a LSA Area Id 0.0.0.0 LsdbType 5 LsdbLsid 10.189.200.64 LsdbRouterId 10.206.1.16 Router 10.206.1.8 .

#Jul 13 22:11:33:783 2016 HQ-HQ-NB-7F-SWL3-CO-H9505E-2 OSPF/5/MAXAGE_LSA: OSPF TrapID1.3.6.1.2.1.14.16.2.13: Aged a LSA Area Id 0.0.0.0 LsdbType 5

组网图：（9505E-2不断弹出异常log，9505E-1正常）

#Jul 13 22:11:33:284 2016 HQ-HQ-NB-7F-SWL3-CO-H9505E-2 OSPF/5/MAXAGE_LSA: OSPF TrapID1.3.6.1.2.1.14.16.2.13: Aged a LSA Area Id 0.0.0.0 LsdbType 5 LsdbLsid 10.189.200.68 LsdbRouterId 10.206.1.16 Router 10.206.1.8 .

#Jul 13 22:11:33:527 2016 HQ-HQ-NB-7F-SWL3-CO-H9505E-2 OSPF/5/MAXAGE_LSA: OSPF TrapID1.3.6.1.2.1.14.16.2.13: Aged a LSA Area Id 0.0.0.0 LsdbType 5 LsdbLsid 10.189.200.64 LsdbRouterId 10.206.1.16 Router 10.206.1.8 .

#Jul 13 22:11:33:783 2016 HQ-HQ-NB-7F-SWL3-CO-H9505E-2 OSPF/5/MAXAGE_LSA: OSPF TrapID1.3.6.1.2.1.14.16.2.13: Aged a LSA Area Id 0.0.0.0 LsdbType 5

1.已经排除IP地址冲突情况，display ospf error错误信息也无增加。不停打印这个日志的原因是由于LSA要老化时，本设备将发送LSU信息给之前发送该LSA给本设备的对端，需要对端回应ACK报文后才老化掉，如果没有收到对端的ACK报文，本地就要不停的重传该LSU报文。并且反馈刷屏的这些ospf的LSA产生者：10.206.1.15和10.206.1.16这两台设备网络中已经不在了。从这台设备上ping这两个地址也是无法通的。

#Jul 21 19:41:23:064 2016 HQ-HQ-NB-7F-SWL3-CO-H9505E-2 OSPF/5/MAXAGE_LSA: OSPF TrapID1.3.6.1.2.1.14.16.2.13: Aged a LSA Area Id 0.0.0.0 LsdbType 5 LsdbLsid 10.189.63.12 LsdbRouterId 10.206.1.15 Router 10.206.1.8 .

#Jul 21 19:41:21:054 2016 HQ-HQ-NB-7F-SWL3-CO-H9505E-2 OSPF/5/MAXAGE_LSA: OSPF TrapID1.3.6.1.2.1.14.16.2.13: Aged a LSA Area Id 0.0.0.0 LsdbType 5 LsdbLsid 10.189.168.156 LsdbRouterId 10.206.1.16 Router 10.206.1.8 .

2.查看OSPF 报文重传情况，发现发送给邻居10.220.25.240的LSU报文不停的在重传。

< H9505E-2>dis ospf retrans-queue

……

The Router's Neighbor is Router ID 10.206.1.7      Address 10.200.0.247

  Interface 10.200.0.248     Area 0.0.0.0

Retransmit list:

Type       LinkState ID      AdvRouter         Sequence   Age

  The Router's Neighbor is Router ID 10.206.1.7      Address 10.220.25.240

  Interface 10.220.25.241    Area 0.0.0.0

  Retransmit list:

       Type       LinkState ID      AdvRouter         Sequence   Age

       External   11.74.192.0       10.206.1.16       80000f3b   3600

       External   10.189.75.28      10.206.1.15       8000269a   3600

       External   10.189.146.128    10.206.1.16       80002bfb   3600

       External   10.189.81.16      10.206.1.15       800002af   3600

       External   10.189.152.116    10.206.1.16       800025e9   3600

       External   10.189.200.12     10.206.1.16       80001603   3600

       External   10.189.69.44      10.206.1.15       800002af   3600

       External   10.189.75.32      10.206.1.15       800002af   3600

       External   10.189.146.132    10.206.1.16       80002bfb   3600

       External   10.189.81.20      10.206.1.15       800002af   3600

       External   10.189.152.120    10.206.1.16       8000241a   3600

       ……

3.查看与10.220.25.240互连的接口是int vlan 225。本地配置了包过滤shouxianzichan，最后一条规则是deny ip。而这里的LSU和LSA是单播报文发送，源地址使用10.220.25.241，目的地址是10.220.25.242，对端10.206.1.7这个接口的互连地址也是int vlan 225，也配置了相同的包过滤规则，LSU被这条规则给过滤掉了，因此不会回复LSA报文，导致本端LSU不停的发送，因此trap里面不停打印ospfMaxAgeLsa。10.206.1.7这台设备也是相同的情况，没有看到有打印的原因是这台设备关闭了Info-center开关。

#

interface Vlan-interface225

ip address 10.1.1.1 255.255.255.0

packet-filter name shouxianzichan inbound

#

< H9505E-2>dis acl name  shouxianzichan

Advanced ACL  3004, named shouxianzichan, 13 rules,

ACL's step is 5

rule 0 permit icmp

rule 10 permit ip destination 10.190.116.231 0

rule 11 permit ip destination 10.190.207.0 0.0.0.255

rule 20 permit ip destination 10.190.116.232 0

rule 30 permit ip destination 10.190.116.233 0

rule 40 permit ip destination 10.190.116.234 0

rule 50 permit ip destination 10.190.116.235 0

rule 60 permit ip destination 10.190.116.236 0

rule 70 permit ip destination 10.190.116.237 0

rule 80 permit ip destination 10.190.116.238 0

rule 81 permit ip destination 10.220.22.236 0

rule 82 permit ip destination 10.190.208.0 0.0.0.255

rule 90 deny ip

acl name shouxianzichan里面允许ospf报文通过。或者允许这两个互连的接口地址通过。推荐使用允许ospf报文通过，在rule 90 deny ip之前增加rule 85允许ospf协议报文通过:

rule 85 permit ospf