Re: Removal of static route when link is unreachable

Kenneth Goh · ‎08-26-2023

own1 and own2 are configured with static routes 'ip route 192.29.8.1 255.255.255.0 192.168.11.254. which are redistributed into OSPF., where eon2, eon1, own1 and own2 are running OSPF in area 0.

I will need to be able to ping from FW1 sourcing from interface loopback0 and from 192.29.11.254/29 to FW2 172.23.6.35. I notice when the link from own2 to L2-sw (layer 2 switch) is down or when I shutdown own2 interface Gi2.I am still able to see the static route entry '192.29.8.0/27 [1/0] via 192.29.11.254' and ping from FW1 will fail.

I will need to be able to ping from FW1 192.29.11.254 & 192.29.8.1 to FW2 172.23.6.35

Kenneth Goh · ‎08-26-2023

Should be 'ip route 192.29.8.1 255.255.255.0 192.29.11.254'

M02@rt37 · ‎08-26-2023

Hello @Kenneth Goh,

Please provide 4 outputs of #show ip route on Fw1 & Fw2 when:

- all links are up,

- you shutdown own2 interface Gi2.

Thanks.

Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.

Kenneth Goh · ‎08-26-2023

FW1#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override

Gateway of last resort is 192.29.11.249 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 192.29.11.249
192.29.8.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.29.8.0/27 is directly connected, Loopback0
L 192.29.8.1/32 is directly connected, Loopback0
192.29.9.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.29.9.0/24 is directly connected, Loopback1
L 192.29.9.1/32 is directly connected, Loopback1
192.29.10.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.29.10.0/24 is directly connected, Loopback2
L 192.29.10.1/32 is directly connected, Loopback2
192.29.11.0/24 is variably subnetted, 4 subnets, 3 masks
C 192.29.11.0/25 is directly connected, Loopback3
L 192.29.11.1/32 is directly connected, Loopback3
C 192.29.11.248/29 is directly connected, GigabitEthernet0/0
L 192.29.11.254/32 is directly connected, GigabitEthernet0/0

FW2#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override

Gateway of last resort is 172.23.6.35 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 172.23.6.35
172.23.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 172.23.6.32/28 is directly connected, GigabitEthernet0/0
L 172.23.6.38/32 is directly connected, GigabitEthernet0/0

Kenneth Goh · ‎08-26-2023

I think you might not be able to see much from the routes of FW1 and FW2 since they only show default routes, Below are all the show run of eon1, eon2, own1 and own2.

own1
interface GigabitEthernet1
ip address 192.16.186.78 255.255.255.252
negotiation auto
no mop enabled
no mop sysid
!
interface GigabitEthernet2
ip address 192.29.11.250 255.255.255.248
standby 11 ip 192.29.11.249
standby 11 priority 110
standby 11 preempt
negotiation auto
no mop enabled
no mop sysid
!
interface GigabitEthernet3
ip address 192.16.186.66 255.255.255.252
negotiation auto
no mop enabled
no mop sysid
!
interface GigabitEthernet4
no ip address
shutdown
negotiation auto
no mop enabled
no mop sysid
!
router ospf 1
redistribute static
network 192.16.186.64 0.0.0.3 area 0
network 192.16.186.76 0.0.0.3 area 0
network 192.29.11.248 0.0.0.7 area 0
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
ip route 192.29.8.0 255.255.255.224 192.29.11.254
ip route 192.29.9.0 255.255.255.224 192.29.11.254
ip route 192.29.10.0 255.255.255.224 192.29.11.254
ip route 192.29.11.0 255.255.255.224 192.29.11.254

own2
interface GigabitEthernet1
ip address 192.16.186.70 255.255.255.252
ip access-group 101 in
negotiation auto
no mop enabled
no mop sysid
!
interface GigabitEthernet2
ip address 192.29.11.251 255.255.255.248
standby 11 ip 172.29.11.249
negotiation auto
no mop enabled
no mop sysid
!
interface GigabitEthernet3
ip address 192.16.186.74 255.255.255.252
ip access-group 101 in
negotiation auto
no mop enabled
no mop sysid
!
interface GigabitEthernet4
no ip address
shutdown
negotiation auto
no mop enabled
no mop sysid
!
router ospf 1
redistribute static
network 192.16.186.68 0.0.0.3 area 0
network 192.16.186.72 0.0.0.3 area 0
network 192.29.11.248 0.0.0.7 area 0
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
ip route 192.29.8.0 255.255.255.224 192.29.11.254
ip route 192.29.9.0 255.255.255.224 192.29.11.254
ip route 192.29.10.0 255.255.255.224 192.29.11.254
ip route 192.29.11.0 255.255.255.224 192.29.11.254

eon1
interface GigabitEthernet0/0
ip address 172.23.6.34 255.255.255.240
standby 6 ip 172.23.6.35
standby 6 priority 110
standby 6 preempt
duplex auto
speed auto
media-type rj45
no cdp enable
!
interface GigabitEthernet0/1
ip address 192.16.186.69 255.255.255.252
duplex auto
speed auto
media-type rj45
no cdp enable
!
interface GigabitEthernet0/2
ip address 192.16.186.65 255.255.255.252
duplex auto
speed auto
media-type rj45
no cdp enable
!
interface GigabitEthernet0/3
no ip address
shutdown
duplex auto
speed auto
media-type rj45
no cdp enable
!
router ospf 1
redistribute static subnets
network 0.0.0.0 255.255.255.255 area 0

eon2
interface GigabitEthernet0/0
ip address 172.23.6.33 255.255.255.240
standby 6 ip 172.23.6.35
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/1
ip address 192.16.186.77 255.255.255.252
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/2
ip address 192.16.186.73 255.255.255.252
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/3
no ip address
shutdown
duplex auto
speed auto
media-type rj45
!
router ospf 1
redistribute static subnets
network 0.0.0.0 255.255.255.255 area 0

Flavio Miranda · ‎08-26-2023

Hi @Kenneth Goh

There is something wrong with the config because you dont have /27 anywhere. Why do you see this

192.29.8.0/27

Another point, how is routing configured on firewall?

If the gateway is own1 and you remove the uplink, the ping will fail.

Kenneth Goh · ‎08-26-2023

Sorry the loopbacko on FW1 should be /27. Diagram /24 is wrong

FTL_FW#sh run int lo0
Building configuration...

Current configuration : 66 bytes
!
interface Loopback0
ip address 192.29.8.1 255.255.255.224

FW1#sh run | in ip route
ip route 0.0.0.0 0.0.0.0 192.29.11.249

own1 & own2 is running on HSRP with VIP of 192.29.11.249/29