topic Re: PIX & OSPF recommendation in Network Security

PIX & OSPF recommendation

welcomeccie — Fri, 21 Feb 2020 09:46:37 GMT

I have the following topology

R1 --Lan--PIX--Lan---R2,R3,R4

I need to configure OSPF .should i pass the ospf through the PIX or configuring the ospf on the pix too? whot does cisco recommend?

Re: PIX & OSPF recommendation

Jon Marshall — Thu, 08 Nov 2007 13:58:24 GMT

Kind of depends on what mode the firewall is in. If the firewall is running in transparent mode then pass the OSPF traffic through. If it is running in routed mode it needs to participate in OSPF routing.

HTH

Jon

Re: PIX & OSPF recommendation

welcomeccie — Sun, 11 Nov 2007 09:28:18 GMT

The FW is routed mode but is there any problem if i passed the traffic through it may be i need to use PBR on the inside routers

Re: PIX & OSPF recommendation

Jon Marshall — Sun, 11 Nov 2007 10:07:06 GMT

That is the problem. OSPF expects to form ajacencies with neighbours on the same network but you have another hop between your 2 ospf routers because the firewall is in routed mode. That is why you can run OSPF on the FWSM itself in routed mode to get around this problem.

The only way the 2 ospf routers on either side of your FWSM will see each as neighbours is if the FWSM is in transparent mode ie. the same subnet on either side of the FWSM.

Jon

Re: PIX & OSPF recommendation

Jon Marshall — Sun, 11 Nov 2007 15:50:53 GMT

Apologies, i keep referring to the FWSM (Firewall Services Module) but the same applies to the standalone pix.

Jon

Re: PIX & OSPF recommendation

cmcbride — Thu, 15 Nov 2007 07:39:29 GMT

Wouldn't it be possible to configure a GRE tunnel between the 2 routers through the FWSM/PIX/ASA (allowing the correct ports to go through of course) for OSPF traffic? Seems like that would enable the routers to see each other as neighbors.