Protocol Atlas

L3 · igp · reviewed

OSPFv3

OSPF for IPv6

The same neighbor machine and SPF as OSPFv2, with addressing stripped out of the LSA so Instance IDs can map separate address families onto the same control plane.

Presenter modeEmbed this figure

Differences from OSPF for IPv4RFC 5340 · PROPOSED STANDARD · July 2008Use of Link-Local AddressesRFC 5340 · PROPOSED STANDARD · July 2008LSA Format ChangesRFC 5340 · PROPOSED STANDARD · July 2008Link-LSAsRFC 5340 · PROPOSED STANDARD · July 2008OSPF for IPv6RFC 2740 · PROPOSED STANDARD · December 1999IntroductionRFC 5838 · PROPOSED STANDARD · April 2010Instance ID Values for New AFsRFC 5838 · PROPOSED STANDARD · April 2010

Why it exists

OSPFv2’s LSAs are full of IPv4. Link State ID, forwarding address, the stub-link prefix in a Router-LSA — none of that survives a change of address family. OSPF for IPv6 had to stop treating an address as a node identifier. Removal of Addressing SemanticsRFC 5340 · PROPOSED STANDARD · July 2008

RFC 2740 tried first. RFC 5340 replaced it, and RFC 5838 later put IPv4 back on the same protocol as an address family. The protocol is no longer “OSPF for IPv6” so much as “OSPF whose topology LSAs do not care.”

Hellos on the link, not the subnet

Two routers form an OSPFv3 adjacency using link-local source addresses. The Router ID is still a 32-bit identifier and need not appear as an IPv6 address anywhere.

How it works

The neighbor FSM, DR election, flooding, and SPF are the OSPFv2 machine. Hellos still elect a DR; ExStart still hangs on MTU. What changed is where addresses live and how a packet is authenticated. Differences from OSPF for IPv4RFC 5340 · PROPOSED STANDARD · July 2008

Hellos are sent from the link-local address to FF02::5 / FF02::6. Neighbors are keyed by Router ID. A missing global address is not a missing adjacency. Use of Link-Local AddressesRFC 5340 · PROPOSED STANDARD · July 2008

OSPFv3 drops AuType from the header. Authentication is IPsec (or, later, an authentication trailer), not a 64-bit field in the OSPF header. An AuType mismatch is an OSPFv2 failure mode that this protocol does not have. Authentication ChangesRFC 5340 · PROPOSED STANDARD · July 2008

Instance ID in the header lets several OSPFv3 processes share a link without seeing each other’s Hellos. A mismatch is not “OSPF is down”; it is two ships in the night. Explicit Support for Multiple Instances per LinkRFC 5340 · PROPOSED STANDARD · July 2008

LSA type numbers are not the v2 numbers. v3 Type 9 is Intra-Area-Prefix, not opaque-link. Reading a v3 database with v2 eyes is how people report “missing Type-5” when they are looking at an Inter-Area-Prefix-LSA. Intra-Area-Prefix-LSAsRFC 5340 · PROPOSED STANDARD · July 2008

Try it

Run SPF

Change a link cost and step through the candidate list. A router joins the tree when it is the cheapest candidate, and nothing added later can make it cheaper.

Interface cost
Iteration 1 of 6
10101030101010R1cost 0R2candidate 10R3unreachedR4candidate 10R5unreachedR6unreached

R1 is the root, so it starts on the tree at cost 0.

  • R2 enters the candidate list at 10, through R1.
  • R4 enters the candidate list at 10, through R1.
Candidate list after this iteration
RouterCostThrough
R210R1
R410R1
Resulting routing table at R1
DestinationCostNext hop
R210R2
R320R2
R410R4
R520R4
R630R2

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

R1 (1.1.1.1) announcing itself in area 0. Priority 1, timers 10/40, and it lists itself as DR because it has already won the Wait Timer. The neighbor list that would follow is omitted from this layout.

IPv4
Protocol 89. Destination 224.0.0.5 (AllSPFRouters) on a broadcast segment. RFC 2328
OSPF packet header
Version, type, length, Router ID, Area ID, checksum and authentication. RFC 2328
Hello body
Network mask, HelloInterval, options, priority, RouterDeadInterval, DR and BDR. RFC 2328

Configure it

OSPFv3 on an IPv6 link, Router ID explicit, Hellos from link-local.

Cisco IOS-XE 17.12 · Catalyst 9500, ISR 4451draft

  1. router ospfv3 1
 router-id 1.1.1.1

    Router ID is still 32 bits. It does not have to be an IPv6 address, and it should be set so two cloned boxes do not share one.

    RFC 5340 §2.11

  2. interface GigabitEthernet0/0
 ipv6 enable
 ospfv3 1 ipv6 area 0

    `ipv6 enable` creates the link-local that Hellos are sourced from. The OSPFv3 statement places the link in area 0 for the IPv6 unicast address family (instance ID 0 by default).

    Common mistake: Configuring a global without `ipv6 enable` and wondering why Hellos do not go out. The source is link-local, not the global.

    RFC 5340 §2.5

Verify

show ospfv3 neighbor
Neighbor Full, sourced from fe80::…

Caveats

  • Older IOS used `ipv6 router ospf`. Current IOS-XE uses `router ospfv3` with per-AF interface statements.

When it breaks

Symptom first, because that is what you have when it happens.

  1. OSPFv3 configured on both sides, Hellos leaving, no neighbor. IPv6 is otherwise fine.

    Narrow it down

    1. Compare Instance ID in the OSPFv3 header.
    2. On IOS-XE, check `ospfv3 <process> area` versus a VRF or address-family instance that silently changed the ID.
    3. Confirm you did not mix IPv6 unicast (0) with IPv4 unicast (64) expecting one adjacency.

    Cause

    Instance IDs differ, so each side ignores the other’s Hello as belonging to another process on the same link.

    Fix

    Match Instance ID. Default is 0 for IPv6 unicast; RFC 5838 IPv4 unicast uses 64 unless configured otherwise.

    Explicit Support for Multiple Instances per LinkRFC 5340 · PROPOSED STANDARD · July 2008

  2. Interface is up with a global address, OSPFv3 does not send Hellos.

    Narrow it down

    1. show ipv6 interface and confirm a link-local exists.
    2. Check whether IPv6 is enabled on the interface at all — a global without IPv6 enabled is a drawing, not a stack.

    Cause

    OSPFv3 sources Hellos from the link-local. No link-local means no Hello.

    Fix

    Enable IPv6 on the interface so it generates fe80::/10. Do not source OSPFv3 from a global.

    Use of Link-Local AddressesRFC 5340 · PROPOSED STANDARD · July 2008

  3. An engineer reports missing Type-5 in the v3 LSDB, or “no Router-LSA prefixes.”

    Narrow it down

    1. List LSA types with their v3 names, not v2 numbers.
    2. Look for Intra-Area-Prefix-LSAs and Inter-Area-Prefix-LSAs, not Type-3/5.

    Cause

    v3 renumbered LSAs when addressing was removed. The prefixes are there; the numbers moved.

    Fix

    Read RFC 5340 section 4.4.3. The atlas LSA-mapping walkthrough is the cheat sheet.

    LSA Format ChangesRFC 5340 · PROPOSED STANDARD · July 2008

  4. IPv4 address-family OSPFv3 is configured, IPv4 addresses are present, but no OSPFv3 Hellos leave the interface.

    Narrow it down

    1. Confirm IPv6 is enabled on the interface and a link-local exists.
    2. Capture: OSPFv3 control packets are IPv6, even when the AF is IPv4 unicast.

    Cause

    OSPFv3 always runs over IPv6. An IPv4 AF still requires IPv6 on the link for control packets, even if the link is in no IPv6 AF.

    Fix

    Enable IPv6 on the interface. Then form the Instance ID 64 adjacency for IPv4 unicast.

    Protocol DetailsRFC 5838 · PROPOSED STANDARD · April 2010

  5. IPv4 prefixes appear in the OSPFv3 LSDB for Instance ID 0, or the IPv4 RIB never installs what the v3 database shows.

    Narrow it down

    1. Check which Instance ID owns the adjacency and the LSDB you are reading.
    2. Confirm Intra-Area-Prefix-LSAs carrying IPv4 prefixes sit in the IPv4 unicast instance (default ID 64), not the IPv6 unicast instance.

    Cause

    RFC 5838 reuses OSPFv3 prefix LSA formats across AFs, but prefixes that do not conform to an instance’s AF must not be used in that instance’s route computation.

    Fix

    Put IPv4 prefixes in the IPv4 unicast instance. Do not expect Instance ID 0 to forward IPv4.

    Advertising Prefixes in AFs Other Than IPv6RFC 5838 · PROPOSED STANDARD · April 2010

Design notes

Running OSPFv2 for IPv4 and OSPFv3 for IPv6 is two IGPs, two LSDBs, two SPFs. RFC 5838 address families put both on OSPFv3 — still two instances (Instance ID 0 and 64 by default), but one protocol family and one set of LSA formats. The win is operational consistency; the cost is learning that “both on OSPFv3” is not “one adjacency.” Protocol DetailsRFC 5838 · PROPOSED STANDARD · April 2010

Link-LSAs are not flooded off the link. They exist so a DR can build the Network-LSA and so neighbors can learn each other’s link-locals and prefixes on this segment. Under RFC 5838 the IPv4 AF also stuffs the IPv4 next-hop into that same field. Link-LSAsRFC 5340 · PROPOSED STANDARD · July 2008

Misconceptions

“OSPFv3 needs a global IPv6 address on the interface to form an adjacency.”
Hellos use link-local. A global is required to forward, not to be adjacent. This is why an unnumbered-style IPv6 underlay works. Use of Link-Local AddressesRFC 5340 · PROPOSED STANDARD · July 2008
“OSPFv3 Type 1 still carries the prefixes, like OSPFv2.”
v3 Router-LSAs are topology only. Prefixes are Intra-Area-Prefix-LSAs. That split is the reason SPF does not rerun for an address change. Removal of Addressing SemanticsRFC 5340 · PROPOSED STANDARD · July 2008
“RFC 5838 puts IPv4 and IPv6 on a single OSPFv3 adjacency.”
It maps each AF to an Instance ID. Base IPv6 unicast is 0; base IPv4 unicast is 64. That is two instances — two adjacencies, two LSDBs, two SPFs — on the same link. Instance ID Values for New AFsRFC 5838 · PROPOSED STANDARD · April 2010

More walkthroughs

Prefixes leave the Router-LSAcomparison

OSPFv3 Router-LSAs describe topology only. Addresses live in Intra-Area-Prefix-LSAs and Link-LSAs, so one SPF tree can carry more than one address family.

R1R2LSDBv2 Router-LSA = graph + prefixesone link, two jobs
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
R1router—
R2router—
LSDBlabel—
R1 — R2linkup · one link, two jobs
1 / 3

In OSPFv2 a Router-LSA mixes topology and addressing: each link entry carries the neighbour and, for a stub, the prefix. Changing an address changes the topology LSA and reruns SPF even when the graph did not change.

What changed

  • v2 Router-LSA = graph + prefixes
  • Emphasis on R1

IPv4 over OSPFv3 is another Instance IDfailure

RFC 5838 maps each address family to an Instance ID. IPv6 unicast defaults to 0; IPv4 unicast defaults to 64. Same link, two instances — two adjacencies, two LSDBs, two SPFs. Control packets still ride IPv6 link-local.

R1R2AF instancesRanges, not one shared IDIPv6 unicast: Instance ID 0IPv4 unicast: Instance ID 64one link · two Instance IDs
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
R1router—
R2router—
AF instanceslabelIPv6 unicast: Instance ID 0 · IPv4 unicast: Instance ID 64
R1 — R2linkup · one link · two Instance IDs
1 / 4
t = 0 s

RFC 5838 carves the Instance ID space by address family. 0–31 is IPv6 unicast (0 is the base). 64–95 is IPv4 unicast (64 is the base). A Hello with Instance ID 0 is invisible to a process listening for 64.

What changed

  • AF instances: IPv6 unicast → Instance ID 0
  • AF instances: IPv4 unicast → Instance ID 64
  • Ranges, not one shared ID

Terms

Link-LSA
OSPFv3 LSA flooded only on one link, advertising this router’s IPv6 addresses and options on that link. It never leaves the segment.
Instance ID
An octet in the OSPFv3 header that lets several processes share a link. Hellos with a different Instance ID are ignored, not rejected as malformed.

Check yourself

  • What source address does an OSPFv3 Hello use?
  • Where do IPv6 prefixes live in OSPFv3?
  • OSPFv3’s packet header has no AuType. How is a packet authenticated?
  • Two OSPFv3 speakers on one link ignore each other’s Hellos. Area, timers and RID look fine. What next?
  • A Link-LSA is flooded…
  • Under RFC 5838, what is the default Instance ID for the base IPv4 unicast AF?
  • Two OSPFv3 AF Instance IDs on one link share…
  • An interface carries only the IPv4 unicast OSPFv3 AF. Must IPv6 be enabled?