We have configured OSPF between FTD firewall and ACI. Also, We are able to form neighborship with FTD. Now the issue is that when We form neighborship we see two best path in Routing table so now it should be load-balancing. Can we do some changes on ACI so that only one best path is selected keeping SVI and VPC topology.
Accepted Solutions
Hi @OmkarPol52290 ,
Also, the Firewall is in Act/Std
I wish I'd know that earlier! That changes my advice completely!
To begin, you really don't want to run a dynamic routing protocol on a VPC that is configured with an Active/Standby neigbour. So remove the OSPF configuration.
Instead:
- On the ACI side,
- configure a secondary IP address on each leaf. In fact, you'll notice that when working your way through the L3Out wizard, the option to add a Secondary IP automatically shows up when adding an SVI. Make sure you use the same secondary IP on each Leaf
- Once the L3Out wizard is complete, you'll need to re-visit the Node Profiles that were created and add appropriate static routes for EACH node
- configure a secondary IP address on each leaf. In fact, you'll notice that when working your way through the L3Out wizard, the option to add a Secondary IP automatically shows up when adding an SVI. Make sure you use the same secondary IP on each Leaf
- One the firewall side, you'll add static route(s) to point to the SECONDARY IP address you configured on the ACI side
You'll find a better explanation on the Unofficial ACI Guide blog
Now, if you really, really, really want to use OSPF [I don't like this design because one adjacency (on the standby link) probably won't ever form until the primary goes down, and there would be the full adjacency exchange as OSPF re-establishes itself], stick with the point-to-point links, and the two L3Outs. You PROBABLY could use ONE L3Out with two node profiles, or even one node profile with two nodes, but I'd have to research that before I'd give a definite answer - and since I haven't researched it this whole paragraph may be utterly wrong!
Hi @OmkarPol52290 ,
I think I see your problem - you are thinking of ACI as "a router"
But it isn't.
EACH LEAF is a router
So, what you REALLY have in the above scenario is something that looks (as far as OSPF is concerned) more like this:
A multi-access OSPF network with three routers, all on the same subnet. This is made possible because when you create a L3Out in ACI and use a VPC as the attachment, ACI creates an internal hidden Bridge Domain that allows the two leaves to see each other and form an OSPF adjacency - with DR and BDR elections. When the external device sends OSPF Hellos, the Hellos are seen by both leaves and each leaf forms an adjacency.
The problem is, since you've configured this as a VPC, each of the interfaces of the VPC are configured exactly the same - you can'd change the OSPF cost on either interface.
Now, from your explanation
ECMP will happen which can lead to suboptimal forwarding according to a few of our colleagues
I'm guessing that there are severs on one or other of the leaves that you'd like to
- ALWAYS forward traffic directly from the leaf to which they are attached, and your colleagues are worried that that the traffic will sometimes be sent to the other leaf before being forwarded to the FTD-FW
- have the reverse traffic (from the firewall) always be sent to the same leaf
As for #1 above - don't worry, That will always happen unless the particular leaf looses it's physical connection.
As for #2, ensuring that the return traffic favours one particular leaf, I honestly think you should not care. ACI was designed to be flexible and dynamic, so trying to do push traffic one way or another is not a good idea generally.
However, the customer is always right, so let's assume you really really really want to implement this BAD idea.
- Then the simplest way would be to configure the FTD-FW with static host routes with IP SLAs for the servers you want to always go to a particular Leaf, rather than trying to manipulate ACI to work in a way that it was not designed to do.
- The other (ACI centric) way would be to forget the VPC and configure two point-to-point links.
Like this
Now you configure two L3Outs, one for Leaf101 and one for Leaf102. If you want the external router to prefer say Leaf102, then increase the cost of the interface in Leaf101.
I hope this helps.
Don't forget to mark answers as correct if it solves your problem. This helps others find the correct answer if they search for the same problem.
Hi @OmkarPol52290 ,
Also, the Firewall is in Act/Std
I wish I'd know that earlier! That changes my advice completely!
To begin, you really don't want to run a dynamic routing protocol on a VPC that is configured with an Active/Standby neigbour. So remove the OSPF configuration.
Instead:
- On the ACI side,
- configure a secondary IP address on each leaf. In fact, you'll notice that when working your way through the L3Out wizard, the option to add a Secondary IP automatically shows up when adding an SVI. Make sure you use the same secondary IP on each Leaf
- Once the L3Out wizard is complete, you'll need to re-visit the Node Profiles that were created and add appropriate static routes for EACH node
- configure a secondary IP address on each leaf. In fact, you'll notice that when working your way through the L3Out wizard, the option to add a Secondary IP automatically shows up when adding an SVI. Make sure you use the same secondary IP on each Leaf
- One the firewall side, you'll add static route(s) to point to the SECONDARY IP address you configured on the ACI side
You'll find a better explanation on the Unofficial ACI Guide blog
Now, if you really, really, really want to use OSPF [I don't like this design because one adjacency (on the standby link) probably won't ever form until the primary goes down, and there would be the full adjacency exchange as OSPF re-establishes itself], stick with the point-to-point links, and the two L3Outs. You PROBABLY could use ONE L3Out with two node profiles, or even one node profile with two nodes, but I'd have to research that before I'd give a definite answer - and since I haven't researched it this whole paragraph may be utterly wrong!
