> Source: [sk128752](https://support.checkpoint.com/results/sk/sk128752)

# sk128752 - OSPF does not install ECMP routes for Type-5 external LSAs

| Property | Value |
|----------|-------|
| Solution ID | sk128752 |
| Date Created | 2018-06-07 |
| Last Modified | 2018-06-12 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- OSPF does not install ECMP routes for Type-5 external LSAs

## Cause

For a destination network, if the forward address in a type-5 LSA is non-zero and is the same for multiple LSAs, the firewall will not consider it as a valid ECMP route.   
If the forward address is zero and next-hop (Advertising router) is different, then the firewall considers it a as a ECMP route.

```
For example:
```

```
FW1> show ospf database external-lsa detailed 
```

```
OSPF Router with ID  172.26.223.3  Instance  default 
Type-5 AS External Link States 
Link State Type:     AS External Link 
Link State ID:         1.1.1.1 
LS Age:                  618 
Options:                  ASE 
Advertising Router:  10.0.0.1 
LS Seq Num:           0x80000001 
CheckSum:             0x5e64 
Length:                  36 
Network Mask:        255.255.255.255 
Metric Type:           2 
TOS:                      0 
Metric:                   1 
Forward Address: 0.0.0.0 <-------Must be zero for route to be installed as ECMP. 
External Route Tag: 0x00000000 
Link State Type:      AS External Link 
Link State ID:         1.1.1.1        
LS Age:                  1714 
Options:                 ASE 
Advertising Router:  172.26.223.176 
LS Seq Num:          0x80000007 
CheckSum:            0x8ce3 
Length:                 36 
Network Mask:       255.255.255.255 
Metric Type:          2 
TOS:                     0 
Metric:                  1 
Forward Address: 0.0.0.0  <------ Must be zero for route to be installed as ECMP route 
External Route Tag: 0x00000000 
```

```
FW1> show route ospf 
```

```
Codes: C - Connected, S - Static, R - RIP, B - BGP (D - Default),        
O - OSPF IntraArea (IA - InterArea, E - External, N - NSSA)        
A - Aggregate, K - Kernel Remnant, H - Hidden, P - Suppressed,        
U - Unreachable, i - Inactive
```

```
O E       1.1.1.1/32          via 172.26.223.176, eth0, cost 1:1, age 609, tag 0x00000000  
							  via 172.26.223.190, eth0 
							 
[Expert@FW1:0]# ip route
```

```
1.1.1.1  proto routed  
		 nexthop via 172.26.223.176  dev eth0 weight 1 
		 nexthop via 172.26.223.190  dev eth0 weight 1 
```

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content