Redistribution of static routes into OSPF

[2sbartholdi]

Hi all

It seems that static routes may still live on even if the designated interface went down.

I added a description file for this problem.

[Kevin Dorrell]

It's an interesting scenario, but not so strange. The documentation says that the static route is valid as long as the interface to which it points is up, but this applies to static routes that point to an interface. But your static route points to 10.10.1.30, and R1 has an alternate route to 10.10.1.30 ... through R2.

I am no expert on redistribution, but the problem stems from the fact that you have two redistribution pints, R1 and R2. But I don't think there is much you can do about that with this architecture.

I think you could set a distribute list on R1 so that it cannot receive type 5's advertisments from R2 for 10.10.1.0/24. That would ensure that if R1 loses contact with the LAN, the static route stays down 'cos it will no longer be able to find 10.10.1.0/24 through R2.

I would be interested to hear what solutions other more experienced people come up with.

Kevin Dorrell

Luxembourg

[ccobtn]

Hi,

What you have is ospf routing loop, because static route has fail for r1, 10.20.0.0/26 will be adv via ospf back to r1. however if the int is up r1 will select static route because static has lower metric than ospf.i would suggested that to filter in both r1 and r2 for receiving 10.20.0.0/16 from R3.

Here is an example,

R1&R2

router ospf XX

log-adjacency-changes

network x.x.x.x x.x.x.x area 0

distribute-list prefix ospf-filt in

!

ip classless

ip http server

!

!

!

ip prefix-list ospf-filt seq 4 deny 10.20.0/16

ip prefix-list ospf-filt seq 5 permit 0.0.0.0/0 le 32

Regards

[Kevin Dorrell]

Just to elaborate on what I just wrote, try this on R1:

access-list 10 deny 10.10.1 0 0.0.0.255

access-list 10 permit any

router ospf nnn

 distribute-list 10 in F1/0

Just for completeness, you should do the same on R2.

Note that this will not strip the alternate route from the OSPF topology table because of the LS nature of OSPF. But it will strip it from the routing table, which will make sure that your static route stays dead.

Hope it helps. Let us know.

Kevin Dorrell

Luxembourg

[2sbartholdi]

Tried restricting with prefix list already, but without mentioning the interface, therefore I tried this option too, but the only result I get is that I don't see any more external routes in OSPF.

I tried several other things (route map based on external / internal type; route map based on addresses or based on originator). I probably need to do more testing with different SW.

However, in my understanding a static route has a local meaning. So to say that if the router can't find a local next hop, the route is discarded.

I wonder if I missed a parameters somewhere that tells the router only to use static routes if there is a local next hop.

Stephan

[ccobtn]

Hi,

Can you post your config here, so that we can see router's config.

Regards

[Richard Burts]

The attempts to fix this with distribute list are more complex that you need (though I think if applied correctly should address the problem). There is a much more simple solution available. If you change the static route slightly so that it enumerates both the outbound interface and the next hop your problem will be solved. The static route should look like this:

ip route 10.20.0.0. 255.255.0.0 FE 0/0 10.10.1.30

Effectively what this does is to say reach the 10.20.0.0 prefix going to the next hop only through the FA0/0 interface. Cisco introduced this functionality to fix exactly the problem that you are describing.

HTH

Rick

[Kevin Dorrell · Accepted solution]

Stephen,

I don't know why the distribute-list did not work. Did you include the permit any at the end of the access list? Without it, you would not get any external routes, as you observerd.

I've just been re-reading the documentation about ip route, both 12.2 and 12.4, 'cos I wasn't aware of the useful form of the command that Rick suggested. Here is an exerpt:

Specifying a numerical next hop that is on a directly connected interface will prevent the router from using Proxy ARP. However, if the interface with the next hop goes down and the numerical next hop can be reached through a recursive route, you may specify both the next hop and interface (for example "ip route 0.0.0.0 0.0.0.0 Ethernet1/2 10.1.2.3") with a static route to prevent routes from passing through an unintended interface.

That describes your problem exactly, I think. It came from:

http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_command_reference_chapter09186a00800ca75a.html#wp1018065

So, it is the interface specification that forces the static route to use only a local next hop.

Kevin Dorrell

Luxembourg

[2sbartholdi]

Hi Guys

That is exactly what I needed. It seems I need to read documentation a little more thorougly...

I tested it and it works just fine.

Thank you for your help!

Stephan