> Source: [sk183854](https://support.checkpoint.com/results/sk/sk183854)

# sk183854 - Subnet Mask /24 External OSPF Route Not Advertised

| Property | Value |
|----------|-------|
| Solution ID | sk183854 |
| Date Created | 2025-09-04 |
| Last Modified | 2025-09-07 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * BGP peer updates cause a BGP route to toggle between reachable and unreachable within 5 seconds.

* OSPF neighbors attempt to flush a /24 external OSPF route from the OSPF database within the same 5-second window.

* The `/var/log/routed.log` file contains repeated messages with an OSPF kernel trace:

  `OSPF2 instance default OspfPrepareOwnLSA(XXXX): delay Re-originating ` seq #XxXXXXXXXX
* The Check Point environment receives external BGP routes and advertises them as external OSPF routes.

* A /24 external OSPF route is not advertised when a routemap OSPF policy is triggered.

## Cause

This issue occurs when `routed` attempts to flush a /24 external OSPF route from the OSPF database while the BGP peer updates the corresponding route from reachable to unreachable (and back) within 5 seconds.  

The /24 ASE LSA is not re-originated because it is overridden by a more specific /27 ASE LSA using the same subnet IP.  

Logical flow when the issue is present:  

1. Two LSAs exist for the same subnet IP but with different subnet masks (/24 and /27).
2. When routes become unreachable, OSPF attempts to flush the LSAs.
3. The LSAs are not deleted because acknowledgments are not received from all OSPF neighbors, leaving them at MaxAge.
4. When routes become reachable again, OSPF tries to re-originate them with Type-5 LSAs.
5. Because insufficient time has elapsed since the previous LSA updates, the re-origination is delayed and placed in a queue.
6. When the delayed LSAs are finally originated, only the /27 route LSA appears, using the LSID of the /24 route.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content