OSPF design questions

[jon.seung@applecaremedical.com]

Please see attached pdf file for network topology detail.

In example, we have 2 sites, corporate and branch office.

• Both locations have identical network equipment but router A.1 (Corporate) has more bandwidth that B.1 (Branch Office).
• IT staff don't have access to the upstream/downstream routers (x.1 and x.4) but all routing support are there. 
• Both firewalls (.x2) has a default route to the upstream router and it advertise locally connected subnets and default route to the core L3 switch via OSPF.
• Both firewalls (.x2) has path monitoring algorithm which will remove default route from FIB when path to the upstream router is not available
• Core L3 switch (x.3) advertise all locally connected subnets to the firewalls (.x2) and downstream router (x4) via OSPF

What they'd like to accomplish;

• When path between B.1 and B.2 fails, all outbound internet traffic from branch office should be routed to corporate site.
• Outbound internet traffic from corporate office should NOT be routed to branch office site in any case.
• Outbound internet traffic from branch office should NOT be routed to the corporate office if local path to the internet is available.

Configuration Example

B.2

#router ospf 1

#router-id 10.2.1.2

#network 10.2.0.0 0.0.255.255 area 20

#redistribute static
#ip route 0.0.0.0 0.0.0.0 to B.1

B.3

#router ospf 1

#router-id 10.2.1.3

#network 10.2.0.0 0.0.255.255 area 20

#network 10.2.1.0 0.0.255.255 area 20

A.2

#router ospf 1

#router-id 10.1.1.2

#network 10.1.0.0 0.0.255.255 area 10

#redistribute static
#ip route 0.0.0.0 0.0.0.0 to A.1

A.3

#router ospf 1

#router-id 10.1.1.3

#network 10.1.0.0 0.0.255.255 area 10

#network 10.1.1.0 0.0.255.255 area 10

Can you please suggest configuration changes to meet three requirements above?

Thank you

[Julio E. Moisa]

Hi

are you able to manage B.4? It is just an idea, but have you considered conditional advertising on B.4

• When path between B.1 and B.2 fails, all outbound internet traffic from branch office should be routed to corporate site. do you want to route the internet traffic through the MPLS?

• Outbound internet traffic from corporate office should NOT be routed to branch office site in any case. It is not clear. 

• Outbound internet traffic from branch office should NOT be routed to the corporate office if local path to the internet is available. If the link between B.1 and B.2 is restablished, B.4 should stop to advertise a default route through the MPLS, is that correct?

Other way could be using IP SLA icmp-echo + track + EEM scripts. 

[jon.seung@applecaremedical.com]

Julio,

Thanks for your response. Please see my answers to your questions.

Are you able to manage B.4 (No, it's managed by ISP)? It is just an idea, but have you considered conditional advertising on B.4

• When path between B.1 and B.2 fails, all outbound internet traffic from branch office should be routed to corporate site. do you want to route the internet traffic through the MPLS? Correct. ISP is not so flexible in terms of accommodating advance changes in their 'managed' router. How does 'conditional advertising' work? Are you talking about PBR?
  

• Outbound internet traffic from corporate office should NOT be routed to branch office site in any case. It is not clear. Default route to B.1 from B.2 is being advertised to B.3 via OSPF. If path to A.1 fails (or any other case), it is possible that A.3 re-route corporate outbound internet traffic to branch office via default route being advertised from the branch office site (originated from B.2). They want branch office default route to be advertised to B.3 from B.2 only but not beyond B.3.    
  

• Outbound internet traffic from branch office should NOT be routed to the corporate office if local path to the internet is available. If the link between B.1 and B.2 is restablished, B.4 should stop to advertise a default route through the MPLS, is that correct? That's correct.
  

Other way could be using IP SLA icmp-echo + track + EEM scripts. Can you please elaborate?

[Julio E. Moisa]

Hi

OSPF Conditional works as following:

access-list 10 host 1.1.1.1

route-map CONDITION permit 5

match ip address 10

router ospf 100

default-information originate always route-map CONDITION

This router will advertise a default route to its neighbors when the IP 1.1.1.1/32 has an entry into the local routing table. If it does not exist the router will not advertise a default route to its neighbors. The 'always' word is used to advertise a default route with or without a static default route. 

:-)

[Julio E. Moisa]

Now for example, if you want to create a backup path through the MPLS once the primary Path (B1 - B2) is down, you could apply this configuration on B.3

* Take in consideration a default static route is preferred over a default route advertised by any routing protocol unless you change the AD over the static route hehe *

Step 1) Create an IP SLA, it will be making ping to the IP on B.1 facing to B.2 with a frecuency of 5 seconds. 

ip sla 1
icmp-echo <B.1 interface IP facing to B.2>
frequency 5

Step 2) Enable the IP SLA

ip sla schedule 1 life forever start-time now

Step3) Track the status of SLA, it will generate a notification after 2 seconds once the ICMP is lost (IP SLA ping)

track 1 rtr 1
delay down 2

Step 4) Create the EEM Scripts, you can create 2 scripts like I did, the first: FAILOVER will create a default route through the MPLS once the message "%TRACKING-5-STATE: 1 rtr 1 state Up->Down" is received on the router. I suggest configure the logging parameters. 

The second Script will reestablish the connectivity through B.2 - B.1 once it is up again. 

event manager applet FAILOVER
event syslog occurs 1 pattern "%TRACKING-5-STATE: 1 rtr 1 state Up->Down"
action 1.0 cli command "enable"
action 2.0 cli command "conf t"
action 3.0 cli command "ip route 0.0.0.0 0.0.0.0 <Next hop IP through MPLS> name BACKUP"
action 4.0 cli command "write"

event manager applet REESTABLISH
event syslog occurs 1 pattern "%TRACKING-5-STATE: 1 rtr 1 state Down->Up"
action 1.0 cli command "enable"
action 2.0 cli command "conf t"
action 3.0 cli command "no ip route 0.0.0.0 0.0.0.0 <Next hop IP through MPLS> name BACKUP"
action 4.0 cli command "write"

Note: the alerts/notifications and/or configuration commands could vary per device model but the concept is the same. 

Remember the ping will be originated on B.3 so you must enable access for icmp on the firewall B.2. You could create an interface loopback to be the source, so your IP SLA should be:

ip sla 1
icmp-echo <B.1 interface IP facing to B.2> source loopback X
frequency 5

Hope it is useful

:-)