OSPF routing cost based on prefix

[SJ K]

Hi all

In this diagram below - all links are 1G and there are no referenced bandwidth manipulation

I wanted all traffic to/fro from 192.168.1.x to go via wan1 and hence i have set a higher ospf cost on wan2 and ge1/0/10.

wan2 will be the backup if wan1 is down

I also wanted all traffic to/fro 192.168.113.x to go via wan2 but since wan2 has a higher cost earlier, traffic will go using wan1

How do i influence cost based on prefix rather then interface ?

e.g.

traffic to/fro 1.x advertise with higher cost on wan2 <-> ge1/0/10 link

trafic to/fro 113.x advertise with a difference cost on wan2 <-> ge1/0/10 link

Thank you

[balaji.bandi]

You need to control both the side right, even if you send out using prefix, other OSPF equal-cost coming in it should be using ECMP

what FW is this ?

[SJ K]

Hi

It is a Fortigate firewall

Thank you

[Giuseppe Larosa]

Hello @SJ K ,

you need to use PBR policy Based routing to make some traffic to use a non best path.

OSPF is not able to provide what you need as it is not possible to make "per prefix" costs. OSPF looks at the topology for its link state nature.

Hope to help

Giuseppe

[paul driver]

Hello

you could max out wan2rtr ospf metric so all traffic routes through wan1rtr then append pbr so to policy route via wan2rtr for specific prefixes however this doesn’t this doesn’t guarantee return path would traverse back the same way.

wan 2

router ospf x

max-metric router-lsa

access-list 100 permit 192.168.113.0 0.0.0.255

any

track 10 interface <wan2 egress interface> reachability 

route-map pbr

match ip address 100

set ip next-hop <wan2 nexthop> verify-availability 1 track 10

int x/x

description lan facing 192.168.113

ip policy route-map pbr 

[Giuseppe Larosa]

Hello @paul driver ,

nice point PBR should be done on both directions with different setup in one case the selected prefixes are the destination addresses and on the other cases they are the source addresses.

I would not use the max-metric because we should also cover the case of WAN1 failure.

Hope to help

Giuseppe

[paul driver]

Hello

@Giuseppe Larosa If wan 1rtr was dropped/lost then even though wan2 rtr would have a very high metric traffic would redirect via this path?

[Giuseppe Larosa]

Hello @paul driver ,

when using max-metric the Router LSA will use 65535 the max value for 16 bit intra area route for each link listed within.

The objective of max-metric is to avoid the router to be a transit for user traffic and to act as a shadow router that learns the OSPF DB.

Now, when WAN1 fails I'm not sure that WAN2 can be used.  It depends from implementation or  I may be wrong of course.

For the purposes of the original poster is enough to rise the cost on WAN2 on both ends and then to use PBR on both devices to move selected traffic flows over the non best path.

Hope to help

Giuseppe

[paul driver]

Hello @Giuseppe Larosa  

Glad to see you conclusion, my suggestion was an alternative for ospf redirection, However Interface costing is another applicable solution to this issue, maybe more so.

[SJ K]

hi all

Thanks for your insights and feedback

Do you guys feel the same - that doing IGP with stateful firewall is really cumbersome - as in there is always a concern on how the firewall handles asymmetric traffic e.g. in an ECMP scenario ?

How do you guys circumvent that ? Do route exchanges only with routers ?

Thank you

[MHM Cisco World]

there is infront of FW edge router which connect to ISP, this router will do the routing and forwarding and from the view of FW the traffic come from only one point which is edge router, this is how FW solve the asymmetric.

[SJ K]

Do you mean there is router place in front of the firewall ?

connection --> wan/edge router --> wan switch --> firewall ?

Issue is that router doesn't work in HA pair, so if the router goes down, so is link ...