IP ROUTING

[fmugambi]

Hello guys, below is my topology,

I have added internet fw  and introduced ISP on site B.

Before site B resources/ servers would go via mpls to site a to access internet.

I introduced the above to make each site use its own isp respectively.

I ran to challenges, site b resources were not able to get to their isp/internet, until i introduced " ip route 0.0.0.0/0 sitebinternetfw interface. --> which works but causes some issues.

is there a way, to manipulate just internet traffic for site b resources without introducing static entries? and not affecting site a and b from communicating with each other?

[Giuseppe Larosa]

Hello @fmugambi ,

if you run OSPF between site A and site B over MPLS ensure that each site prefix(es) are advertised over it for example 192.168.50.0/24  site B and 192.168.40.0/24 Site A.

Most specific routes are used first.

In addition you may need to avoid to inject a default route in OSPF from Site A to Site B that is probably in place for the previous setup to make Site B able to use Site A Internet handoff.

Hope to help

Giuseppe

[fmugambi]

so bgp at 1941s, has route maps out, for downstream serverfirm subnet.and redistribution of ospfs' respective of the site.

Site A has some static routing, but on site A core sw ospf redistributes static routes.

so issues begin here, for example when you check for a route on site b, the route is not known, until you introduce a static route on 1941 of site b..-> since the bgp redistributes static as well, then the route now is known by site b 1941, which advertises it downstream , and servers in site b can reach the subnet now on site A and vice versa.

on site A, there a re quite number of ipsec tunnels, which have static entires on site A core sw. so you find these entries are not known in site b, so traffic from site b flows via mpls to core in site a then this core knows these guys needs to be routed via vpn.--. connectivity is ok.

question, where is this behaviour on the 1941s?

now when i want to introduce isp specific access to each site, the easiet way i went about it was, introducing the 0.0.0.0/0 to ciscoasa fw on site b.--> site b resources now get their internet access via their site b isp. my problem comes, when vpn clients are not able to reach site b resources, since now rem, since the vpn client routes are not known on the site b side, they fall under default category and forwarded to site b asa fw which does not know the route back to vpn clients.

a workaround would have all vpn static routed on site a core , on site a 1941 mpls edge router as well with core sw sita a as destination..-which would then be distributed by bgp across the sites, making 1941 mpls edge router on site a knowing about these routes, distributing them downstream to site b resources..,then these vpn clients routes would no longer fall under "default-route" and vpn clients would manage to access the site b resources.., problem is re-introduction of lots of static routing, which i wish to avoid/reduce.

Any insights here?

1. how to sort vpn learnt static routes be advertised to site b without introducing static routes at 1941 site mpls edge router?

2. is it possible as the setup is, make site b resources uses site b isp, without introducing default route at site be core sw?

Thanks.

[MHM Cisco World]

Staitc route will work but issue' which issue? 

I will check this in lab and update you but I need to know both sites have defualt route or one side have defualt route? Are both site must use internet via one site or both site and ypu need failover ?

MHM

[fmugambi]

am sharing the full issues in a few, with a well full diagram.

[fmugambi]

so bgp at 1941s, has route maps out, for downstream serverfirm subnet.and redistribution of ospfs' respective of the site.

Site A has some static routing, but on site A core sw ospf redistributes static routes.

so issues begin here, for example when you check for a route on site b, the route is not known, until you introduce a static route on 1941 of site b..-> since the bgp redistributes static as well, then the route now is known by site b 1941, which advertises it downstream , and servers in site b can reach the subnet now on site A and vice versa.

on site A, there a re quite number of ipsec tunnels, which have static entires on site A core sw. so you find these entries are not known in site b, so traffic from site b flows via mpls to core in site a then this core knows these guys needs to be routed via vpn.--. connectivity is ok.

question, where is this behaviour on the 1941s?

now when i want to introduce isp specific access to each site, the easiet way i went about it was, introducing the 0.0.0.0/0 to ciscoasa fw on site b.--> site b resources now get their internet access via their site b isp. my problem comes, when vpn clients are not able to reach site b resources, since now rem, since the vpn client routes are not known on the site b side, they fall under default category and forwarded to site b asa fw which does not know the route back to vpn clients.

a workaround would have all vpn static routed on site a core , on site a 1941 mpls edge router as well with core sw sita a as destination..-which would then be distributed by bgp across the sites, making 1941 mpls edge router on site a knowing about these routes, distributing them downstream to site b resources..,then these vpn clients routes would no longer fall under "default-route" and vpn clients would manage to access the site b resources.., problem is re-introduction of lots of static routing, which i wish to avoid/reduce.

Any insights here?

1. how to sort vpn learnt static routes be advertised to site b without introducing static routes at 1941 site mpls edge router?

2. is it possible as the setup is, make site b resources uses site b isp, without introducing default route at site be core sw?

Thanks.

[MHM Cisco World]

one command add it in both site under OSPF 

capability vrf-lite

MHM

[fmugambi]

high-level what does this do?

Also note am not doing any vrf on my network.

[MHM Cisco World]

With and without vrf'

Since you use mpls bgp between two site you need this command.

The ospf in one site not redistrubte prefix learn via bgp of other site that make issue.

So run command and check 

MHM

[fmugambi]

question, am i running it everywhere where there is ospf, or just on the 1941 mpls edge router and core switches ?

[MHM Cisco World]

Only in 1941 where you redistribute bgp into oapf 

[fmugambi]

what do you think about this?

If you are not able to advertise a route to your BGP neighbor that you have learned from downstream (e.g., via OSPF), it's likely a next-hop reachability issue. You need to ensure that the next hop for the routes being advertised is reachable by your BGP neighbor. To address this, you should set the next hop in the outbound direction (routes-out) so that the neighbor can properly route traffic to the downstream networks.

Setting the Next Hop in the Outbound Direction

When redistributing OSPF routes into BGP and advertising them to your BGP neighbor, you should modify the next hop attribute to ensure it is reachable by the neighbor. This is typically done using a route map applied to the outbound BGP updates.

[fmugambi]

question, does it mean , after introducing the static routes, the mpls edge routers know the route cause now bgp local db can reach the next hop? is there a limitation on ospf redistribution, such that bgp on mpls edge does not know downstream network?

what happens if one sets up next hop configuration?

your thoughts?

i got those recommendation once i asked for approval to introdice " capability vrf-lite"

since am working on prod net.

[MHM Cisco World]

OSPF20-BGP-OSPF30
can you share the 
show ip ospf database external <<- in both 1941 to make sure that this issue for vrf-alite or the reachability issue 
also
show ip bgp 

MHM

[fmugambi]

what should i look out for? there is alot of output