OSPF routing on PIX

[gsebk]

Hi all,

I'm not too familiar with the new OSPF routing function on ver. 6.3. I should solve that a few PIXs can advertise their inside subnets for the other PIXs. The firewalls are connected with their outside interface to the internet (PPPoE, ADSL). So the firewalls' outside interfaces have real public internet addresses, there are no routers that terminate the internet connections (since the connection is RJ45).

My question is: how could I manage to use OSPF among the firewalls on the internet? There is no "neighbor" command on the PIX. How could I manage that the PIXs build neighbor relationship only with each other?

[ehirsel]

The following link should be useful for you:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/config/bafwcfg.htm#1112559

This is the link to the pix 6.3.3 document that deals with establishing connectivity to and from the pix. There is some detailed examples of ospf configuration and some of the restrictions of running ospf on the pix, namely if you are using public and private addresses you will need to run two ospf processes so that you don't advertise your private addresses to public networks and vice versa.

To answer your last question, you will need to configure ospf authentication using md5 keys to protect your pixen from getting updates from invalid sources; all your pixen will need to use the same key. This is better than using neighbor as it provides protection against ip address spoofing.

To help answer your other question in detail, if the doc that I mentioned earler is not enough, can you provide a sample topology? In particular will all of the firewalls connect to the internet, or only some?

I hope this helps, Ed Hirsel

[gsebk]

Tahnks a lot for your answer.

All the PIX devices are connected to the internet directly.

The main problems are not the authentication and the spoofing but how will find the pix devices each other on the internet. That's why the neighbor function would be good. The other solution could be the GRE tunnelling and through the tunnels the OSPF could build neighbor relationships only with our desired PIX devices. Anyway the PIX doesn't support this feature.

So as I see, the OSPF function wasn't find out for standalone PIX configurations on the internet.

Regards,

Gabor

[scoclayton]

Correct. The OSPF implementation in the PIX only supports multicast updates. As we know, most ISP's are going to block OSPF updates across their networks. PIX OSPF was designed for large enterprise customers that needed to add routing capabilities to PIX's in their network. Sorry if this is a problem.

Scott

[gsebk]

Scott, anyway it would be nice to have the possibility to push the OSPF traffic into a VPN tunnel. The enterprise customers that have multiple premises would appriciate this function.

Thanx for infos.

Regards,

Gabor