A checklist for when OSPF adjacency won't form

Typical symptom

A checklist for when OSPF adjacency won't form is rarely a single wrong setting — it usually appears when the deploy boundary, runtime state, cache, permissions, and network path drift together. Users arriving from search should first narrow the symptom, using this guide's search intent — A good fit when you first want to check OSPF adjacency down, neighbor not full, EXSTART stuck, route loss after failover, and a routing path checklist. — as the basis for the first signals to check.

Early on, rather than attempting a full rollback or a blind restart, check which node, Pod, job, user, or path the blast radius is tied to. If the scope is narrow, compare recent changes against the healthy state; if it is wide, start from the shared dependencies.

Signals to check first

The first thing to look at is not the last error line but the boundary where the same failure recurs. Grouping the problem around signals like OSPF stuck in EXSTART, neighbor down after failover, route present on one side only, adjacency full but traffic still fails narrows the root-cause candidates even when the logs are long.

• Confirm interface state, MTU expectation, and subnet or area alignment on both sides first.
• Check whether the issue is complete neighbor loss or partial route installation drift.
• Compare recent failover, redistribution, ACL, and route-policy changes before touching timers.
• Document whether the symptom is adjacency-state, path-selection, or return-path related.
• Validate whether the path is broken in both directions or only on one side before restarting the routing process.

Logs and CLI examples

The commands below don't hand you the answer directly; they are the first observation points for narrowing the cause. Comparing their output against a known-good point in time or a healthy resource with the same role cuts down time spent just retrying.

dig <service-name> +trace
curl -v --connect-timeout 5 https://<endpoint>

Common misdiagnoses

The most dangerous pattern in operational incidents is mistaking the symptom name for the cause. The same timeout, permission denied, or rollout failure can have its real cause in a different layer — cache, permission inheritance, Secret scope, stale client connections, or proxy headers.

• Restarting the routing process before checking interface and path assumptions.
• Treating every route loss as an adjacency failure even when the neighbor is full and the real issue is policy or redistribution.

Safe recovery order

Recovery starts at the smallest unit. First pin the current state with read-only checks, then verify changes on a limited-impact resource. Hard-to-reverse actions like a full service restart, clearing the entire cache, or relaxing security policy should be chosen only after the root-cause candidates are narrowed.

• Many OSPF incidents that show up in exam language map to more general route-path failures in operations.
• Teams often chase hello/dead timers when the real issue is MTU, area mismatch, route filtering, or return path drift after failover.
• An adjacency that is up does not guarantee the intended path is installed or symmetric.

Prevention

After an incident ends, record "why that state lingered" rather than just a one-line cause. Check whether there was a gap between automation and operational procedure — in the deploy pipeline, runtime reload, permission inheritance, certificate renewal, or network policy.

Viewing this alongside the DNS and Routing, Timeouts and Latency, Route or Adjacency Loss, CCNP Enterprise, CCNA hubs lets you re-diagnose the same symptom in other environments.

Related InfraTree problems

The problems below are public exercises for practicing this guide as real scenarios. Solving them after reading lets you practice splitting signals first and writing out the recovery direction as sentences.

• The port is open but a reverse path filter keeps the response from returning
• After a BGP route change, only certain ASNs take a detour path
• Firewall allow rule exists but interface match is wrong
• Latency spike follows asymmetric routing after failover