PASSEDvendor / cisco_ospf_neighbor_down

OSPF Adjacency Loss Between Core Routers

An OSPF adjacency between two core routers drops due to a unidirectional fiber failure. Routes are withdrawn, causing a major routing blackhole for half the campus network.

Pattern

CISCO_EVENT

Severity

CRITICAL

Confidence

85%

Remediation

Remote Hands

Test Results

Metric	Expected	Actual
Pattern Recognition	CISCO_EVENT	CISCO_EVENT
Severity Assessment	CRITICAL	CRITICAL
Incident Correlation	Yes	31 linked
Cascade Escalation	Yes	Yes
Remediation	—	Remote Hands — Corax contacts on-site support via call, email, or API

Scenario Conditions

Dual core routers (Cisco Catalyst 9500) running OSPF Area 0. Single fiber pair between them (no redundancy). 50 downstream subnets. 2000+ users.

Injected Error Messages (4)

%OSPF-5-ADJCHG: OSPF neighbor 10.0.0.2 on TenGigE0/0 from FULL to DOWN — Cisco OSPF adjacency lost, dead timer expired, routing table reconverging

Cisco %LINK-3-UPDOWN: Interface TenGigabitEthernet0/0 changed state to down — OSPF neighbor down, %LINEPROTO-5-UPDOWN protocol on interface changed to down

Server farm subnet unreachable — OSPF route withdrawn after Cisco core router adjacency loss, traffic blackholed via default route

Wireless controller lost connectivity — Cisco OSPF convergence in progress, wireless management VLAN route via Core-RTR1 withdrawn

Neural Engine Root Cause Analysis

The Core-RTR1 Cisco 9500 router has lost OSPF adjacency with neighbor 10.0.0.2 due to a dead timer expiration, causing the routing table to reconverge. This indicates either a network connectivity issue between the routers, configuration mismatch (hello/dead timers), or hardware failure on the TenGigE0/0 interface. The presence of 12 correlated incidents suggests this is likely a cascade effect from the core router failure, impacting downstream network segments and services that depend on this critical routing infrastructure.

Remediation Plan

1. Immediately check physical connectivity of TenGigE0/0 interface and cable integrity between Core-RTR1 and neighbor 10.0.0.2. 2. Verify OSPF configuration consistency (hello/dead timers, area assignments) between both routers. 3. Check interface status and error counters on both devices. 4. If interface is down, attempt to bounce the interface or replace cables. 5. Verify neighbor router 10.0.0.2 operational status and OSPF process health. 6. Monitor routing table convergence and test connectivity to critical network segments. 7. If issue persists, engage network engineering team for potential hardware replacement or advanced troubleshooting.

Tested: 2026-03-30Monitors: 4 | Incidents: 4Test ID: cmncjd8vf00fbobqedmaj9343