某局点割接升级后所有ospf邻居异常

设备：5560X-EI

版本：1119P02 6528

组网：不涉及

现场5560X-EI设备进行升级变更，原版本为1119P02，目标版本为6528，升级完成后发现设备所有ospf邻居无法建立，原因都为deadinterval计时器超时：

@151850%Nov 18 20:11:21:865 2021 BJ-AGG_4 OSPF/5/OSPF_NBR_CHG: OSPF 155 Neighbor 155.2.242.114(Vlan-interface1193) changed from EXSTART to DOWN. 

%@151851%Nov 18 20:11:25:940 2021 BJ-AGG_4 OSPF/6/OSPF_LAST_NBR_DOWN: OSPF 155 Last neighbor down event: Router ID: 155.2.31.254 Local address: 155.2.241.45 Remote address: 155.2.241.46 Reason: DeadInterval timer expired.

 %@151852%Nov 18 20:11:25:942 2021 BJ-AGG_4 OSPF/5/OSPF_NBR_CHG_REASON: OSPF 155 Area 0.0.0.155 Router 155.2.255.134(Vlan1112) CPU usage: 48%, VPN name: B, IfMTU: 1500, Neighbor address: 155.2.241.46, NbrID:155.2.31.254 changed from ExStart to DOWN because the dead timer expired at 2021-11-18 20:11:25:940.

对比分析设备升级前后诊断信息，发现设备IPCL0+IPCL2通道的acl资源利用率为100%：

  ===============display qos-acl resource=============== 

 Interfaces: GE1/0/1 to GE1/0/48, XGE1/0/49 to XGE1/0/52 (slot 1) 

 Type Total Reserved Configured Remaining Usage ---

 TTI ACL 3072 0 1 3071 0% 

 IPCL0+IPCL2 ACL 1024 36 988 0 100% 

 IPCL Counter 2048 34 0 2014 1% 

 EPCL+IPCL1 ACL 512 2 0 510 0% 

 EPCL Counter 1024 0 0 1024 0% 

 IPCL Meter 4888 4 0 4884 0% 

 EPCL Meter 4096 0 0 4096 0%

对比升级前后底层acl下发情况发现升级后底层少了两条IPv4 Middle High的ACL，而这其中包括了ospf的协议acl：

===============debug qacl show slot 1 chip 0 verbose 0=============== 

 Acl-Type RX IPv4 Middle High, Stage IPCL 2, Global, Installed, Active                                                               

 Prio Mjr/Sub 0x30b/0x11, RuleFormat INGRESS_EXT_NOT_IPV6, Vtcame/Idx 4/22,                                                           

Rule Match --------                                                                                                                          

Global range                                                                                                                         

Dest IP: 224.0.0.5, 255.255.255.255                                                                                                

IP protocol: ospf                                                                                                           

Actions --------                                                                                                                             

Account mode  packets,  green and non-green                                                                                          

Copy_to_cpu : Yes                                                                                                                   

Change CPU pkt COS 4                                                                                                                 

Red Deny                                                                                                                           

 Red_Copy_to_cpu : No                                                                                                                 

Yel Deny                                                                                                                            Yel_Copy_to_cpu : No                                                      MatchedName:11, IPV4_MC_OSPF_5                                                                                                       

Accounting: Hi 0, Lo 1127585 

缺少ospf协议acl，导致ospf协议报文无法正常上送cpu进行处理，因此所有的ospf邻居无法建立。后排查发现现场包过滤下发过多占用较多acl资源，减小包过滤下发资源后故障消失。

该问题最终还是由于acl资源不足使得设备重启后协议acl无法正常下发导致的，删除了些不必要的包过滤配置后再进行升级，ospf邻居可以正常建立。