OSPF neighbours and DR/BDR: adjacency states, network types and troubleshooting

From hello to Full

Every OSPF interface sends hellos, every 10 seconds by default on Ethernet and point-to-point links. A hello lists the neighbours the sender has already heard. When a router sees its own router ID in a neighbour's hello, they are in two-way communication. From there they exchange database summaries, request anything missing, and reach the Full state, meaning their databases are synchronised.

What must match

DR and BDR on shared segments

On a broadcast network such as an Ethernet VLAN with five routers, full adjacencies between every pair would mean ten adjacencies and lots of duplicate flooding. Instead the routers elect a designated router (DR) and a backup designated router (BDR). Every other router (a DROTHER) forms a full adjacency only with the DR and BDR, and sends updates to 224.0.0.6, the address the DR and BDR listen on. DROTHERs stay in 2-Way with each other, and that is normal.

1. The highest interface priority wins (default 1; 0 means never become DR or BDR).
2. If priorities tie, the highest router ID wins.
3. The election is not pre-emptive: a better router that boots later does not take over until the DR fails or OSPF is reset.

interface GigabitEthernet0/0
 ip ospf priority 255        ! make this router the DR
interface GigabitEthernet0/1
 ip ospf network point-to-point   ! two routers only: no DR election, faster adjacency

On a link with only two routers, set the network type to point-to-point. It skips the election and the wait timer, so adjacencies form faster.

Authentication

Authenticating OSPF stops rogue or misconfigured devices from forming adjacencies and injecting routes. Plain-text and MD5 authentication are old; on current software use a key chain with HMAC-SHA.

key chain OSPF-KEYS
 key 1
  key-string <your-shared-key>
  cryptographic-algorithm hmac-sha-256
interface GigabitEthernet0/1
 ip ospf authentication key-chain OSPF-KEYS

Troubleshooting step by step

1. show ip ospf neighbor: is the neighbour listed, and in what state?
2. Not listed at all: check the interface is up, in OSPF (show ip ospf interface brief), not passive, and that the two ends can ping each other.
3. Listed but stuck: compare area, timers, authentication and area type with show ip ospf interface on both sides. Stuck in ExStart or Exchange: compare MTU.
4. Full but routes missing: check network types, the network statements, filtering and summarisation.
5. Use debug ip ospf adj briefly in a lab or maintenance window; it prints the exact reason an adjacency fails.

Real-world example: after a WAN provider changed a circuit, the OSPF neighbour over it sat in EXSTART for an hour. The new provider handoff had a smaller MTU, and the router on that side had been set to match. Database description packets from the other end were too large and were ignored. Matching the MTU on both interfaces brought the adjacency to Full in seconds.

Keep a short record of each adjacency in your network documentation: the two routers, interfaces, area, network type and whether authentication is used. It makes the checks above much faster.