...
OSPF crashes when trying to add a route that changes its type from either discard-internal or discard-external to a different route type (other than NONE). ONLY OSPFv2 in 6.2.6a is affected by this bug.
This issue is related to the presence of discard routes that OSPF adds into the RIB. When the discard route changes its type from discard internal(also discard-external) to some other type (other than NONE), which may be the case if the area range or summary address overlap with one of the component routes, OSPF can crash. Both internal and external discard routes are affected by this bug. ONLY OSPFv2 in 6.2.6a is affected.
The following steps may be taken to minimize the exposure to this bug. 1. Configuring an area range/summary address that is less specific than all component routes. 2. Suppressing discard route may help in avoiding this crash; Recovery: OSPF automatically recovers from this crash by doing a stateful recovery.
Some additional questions answered. 1) Summary address is typically less specific than the component routes. Is the issue seen only when the summary address is the same as a component route? The problem would be seen if the route-type changed from (a) discard-internal to some other type (e.g., inter or intra), or (b) from some other type (e.g., inter or intra) to discard-internal . Now, let us take the example of route-type changing from discard-internal to intra. This would be the case if there is a component in that area range that has the same prefix/masklen. If you have a area range that is strictly less specific than each one of the component routes, then, the route-type can only change from discard-internal to NONE, or NONE to discard-internal, and this will NOT cause the crash. We can draw similar conclusions for discard-external routes also. 2) Would there be a crash if route changes *to* discard-*? Yes. This would also result in a next-hop being deleted for the summarized route (e.g., intra) and another one added (discard-*) subsequently. 3) Can the router run into constant crashes? In which theoretical scenario? In the stable network, we would only see this once. Once the route-type changes from (or changes to) a discard-*, then, we will not see further crashes. On the flip side though, each time the route-type changes from (or changes to) a discard-* , we will see the crash. Example: Let us say that the router is an ABR that summarizes everything under 123.123.123.0/24 coming in area 1. router ospf 1 area 1 range 123.123.123.0/24 This will cause the following route to be installed in the RIB. 123.123.123.0/24, ubest/mbest: 1/0 *via Null0, [220/0], 00:00:02, ospf-1, discard Due to this bug, OSPF will crash when trying to install an intra-area route that overlaps with the configured area range, such as the one below: 123.123.123.0/24, ubest/mbest: 1/0 *via 192.168.10.3, Eth2/7, [110/80], 00:00:02, ospf-1, intra A similar problem will be seen with summary-address/external routes also. See the Unit test attachment for some more examples.