topic Safe values for OSPF timers on FWSM? in Network Security

Safe values for OSPF timers on FWSM?

max.caines_2 — Tue, 12 Mar 2019 04:48:49 GMT

I have a pair of FWSMs running active/passive. Firmware is 4.1. I want to reduce the failover time by tuning the OSPF hello and dead timers. I'm thinking of 1 second and 3 seconds, but given this is a disruptive change, I'd like an opinion on whether these values are OK for the FWSM

Thanks

Max Caines, University of Wolverhampton

Hi,I think it would be better

Vibhor Amrodia — Wed, 08 Oct 2014 01:53:18 GMT

Hi,

I think it would be better to not reduce the values too much as the Default values are 10 Sec and 40 Sec respectively.

It might cause unexpected Flaps on the OSPF.

Refer:-

http://www.cisco.com/c/en/us/td/docs/security/fwsm/fwsm41/command/reference/fwsm_command_ref/no.html#wp1646737

We have an enhancement for the NSF for the Dynamic protocols on the ASA device expected in the future:-

CSCsu90386

Thanks and Regards,

Vibhor Amrodia

Hi VibhorOK, point taken, but

max.caines_2 — Wed, 08 Oct 2014 08:02:52 GMT

Hi Vibhor

OK, point taken, but there are people running sub-second timers on OSPF without problems, and while NSF may be coming for the ASA, the FWSM doesn't support it and isn't ever going to. What I was hoping was that someone might actually have tried this, but it looks like no-one has. Fortunately we are going to replace the FWSMs with a pair of Palo Altos which do support NSF, so I may leave it

Thanks

Max

Hi Max,I think this might be

Vibhor Amrodia — Wed, 08 Oct 2014 08:09:55 GMT

Hi Max,

I think this might be dependent on the your network and the latency. It would be different for different cases but i have seen it working successfully with such low timers in some cases.

Thanks and Regards,

Vibhor Amrodia

HI VibhorOK, I think you've

max.caines_2 — Wed, 08 Oct 2014 08:17:04 GMT

HI Vibhor

OK, I think you've convinced me. I shall leave them alone. As there won't be any more updates for the FWSM, it's only hardware failure that would cause a reconvergence event, so I think we'll live with that

Regards

Max