cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2796
Views
8
Helpful
26
Replies

Routing and HSRP

jayamistry
Level 1
Level 1

We are currently using Nortel Contivity VPN devices between London and International Offices.

Unfortunately the Service Provider has let us countless times and we are now putting in a leased line between one of the branch offices and London.

The attached diagram show the setup we will have. There is no dynamic routing protocol runing in the international branch offices.

The london Office has OSPF running on the LAN between its London sites.

The VPN devices are running a meshed configuration using RIP and a secure tunnels between each of the offices.

All the internet traffic from International offices comes into London.

Obviously implementing the leased line would mean that any traffic destined for other international offices would have to go via london.

Questions :-

1. We are running OSPF on the London LAN what issues will we have if we run ospf on the cisco router in the branch office or is it best to make is point to point link and redistribute statis into OSPF once in london.

2. The question is which link do we make primary , the leased or the Nortel VPN connection. Not sure how to measure the traffic going from the branch to other internal offices.

3. Can HSRP be implemented. Not sure if the Nortel's do HSRP.

3. Does any one have a sample configuration for the 2600 in this scenario ?

26 Replies 26

Ah, then the fact is your already have your two London Nortel VPN boxes run OSPF with Cisco suggests you should be able to do the same at Paris. Depending on how you cost the various redistributions, you can chose what will be the primary path to/from Paris for all other sites. I would expect you would want London to use the new link and all other sites continue to use the VPN connections. You will also have an alternate path between London and all your other sites if in the unlikely situation both London Nortel VPN boxes fail.

Victor, raises the concern about usage of a OSPF virtual link being a "very poor design" and "highly discouraged by Cisco". I'm unaware of this, since for example, such is not mentioned in:

http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a00801ec9ee.shtml

http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094aaa.shtml#virtuallinks

To clarify, I'm not recommending you use virtual links, just that it's an option. What I was suggesting was Paris, more or less, be treated as you do Site A and Site B, i.e. that it be incorporated into your OSPF domain, and that there is redistribution between the Paris VPN Nortel box and OSPF.

Joseph:

"Victor, raises the concern about usage of a OSPF virtual link being a "very poor design" and "highly discouraged by Cisco". I'm unaware of this, since for example, such is not mentioned in: "

Hate to sound pompous, but this is fundamental. It is mentioned in the gospel of routing: Doyle's Routing TCP/IP, an industry standard. Its all over other documentation, too.

And to clarify, it is not the use of virtual links that is discouraged, as you write, it is the PERMANENT use of them as a design methodology that is discouraged.

HTH

Victor

With apologies to Jaya, and others, as Victor and I go a bit off topic.

For those without a copy of Doyle's "Routing TCP/IP Volume I" book (highly recommended), my first edition copy has on page 466:

(OSPF)

"Virtual links add a layer of complexity and troubleshooting difficulty to any internetwork. It is best to avoid the need for them by ensuring areas, particular backbone areas, are designed with redundant links to prevent partitioning. When two or more internetworks are merged, sufficient planning should take place beforehand so that no area is left without a direct link to the backbone.

If a virtual link is configured, it should be used only as a temporary fix to an unavoidable topology problem. A virtual link is a flag marking a part of the internetwork that needs to be reengineered. Permanent virtual links are virtually always a sign of a poorly designed internetwork."

I suspect, the foregoing, is what Victor has in mind with his reference Doyle.

I too mainly agree with Doyle's opinion, but I don't believe even what Doyle writes precludes usage of virtual links in all cases. I also draw an important distinction between planning and initial designing, and between making something work within existing constraints, which I believe a careful reading of the above also supports.

Where I might differ with Doyle, and likely Victor, is on the question of whether a virtual link could be used permanently. Doyle mentions "temporary fix", but one should consider the actual risk of the "temporary fix" vs. the cost of implementing a better "permanent" solution. For instance, if we really wanted to insure Paris was its own OSPF area, we could connect the 2600 directly to the area 0 backbone, avoiding the need for a virtual link, unknown how difficult or costly this would be within the existing physical topology. We also need to consider the size of this area, which considering there currently isn't local Paris routing, would infer small.

Another better question might be, do we even want a 2600 to be an ABR, and Paris its own OSPF area, regardless of direct connection or virtual link? This, to me, is even more crucial. I would lean toward just including Paris as a member of the OSPF area it's attached to, but I since don't know all the other considerations with the current OSPF design and the redistribution model, I couldn't recommend either approach. I've only suggested possible "how to's".

Victor, as to your concern about sounding pompous, perhaps only in the degree of something being "fundamental". Much of network engineering, and its applied art, is based more on "it depends" than on "always" or "never".

We might also differ where you take Doyle as "gospel of routing" (perhaps Cisco too), I'm more of a "trust but verify" person. I often find, even when the information was accurate at the time when it was published, with progression of technology, it may no longer pertain or have been superseded. Even when accurate, you need to fully understand its application; often demarcations can be nebulous. Examples of the latter: How many hosts should a subnet contain? How many routers should be in an OSPF area? So, if you say, this book or vendor or industry says NEVER have more than 254 hosts in a subnet or 30 routers in OSPF area, that might indeed sound pompous even if correct for the instance at hand. Personally, I haven't found any book, any vendor or even the whole industry omniscient.

Joseph:

I respect and appreciate your due diligence. It's what separates the average from the exceptional.

But we did not go off topic at all. We both made recommendations to someone and we disagreed a bit on some of what each of us was saying, so we debated it. Thats what this is all about: having a healthy discussion and debate for the sake of striving toward excellence.

And you, my friend, are excellent. :-)

So there is no need to apologize to anyone, as Jaya, Im sure, has benefied even more by "listening" to us express our remarks.

Victor

Victor, thank you. Totally agree about "striving toward excellence" and the benefit of debate while doing so.

I recall, many years ago, something in an IEEE pub (I think) about the difference between a "good" solution and an "elegant" solution. A "good" solution was any that worked correctly to solve the problem at hand. An "elegant" solution was one that, besides also correctly solving the problem, was when others see it they go "ah" or "wow".

I strive for "elegant", but I'm lucky if I even get to "good". ;)

Oh, and I forgot to mention I'm not omniscient either. "More heads is better than one", is something which makes these forums so valuable, not to mention how knowledgeable some of the posters are. Reading their replies is very educational.

Victor/Joseph, Yes, very good debate thank you both very much for your input.

Mohamed Sobair
Level 7
Level 7

Hi Jay,

you cant use HSRP, as HSRP is Cisco properitary (Gateway redundancy protocol).

Instead you could implement VRRP, make the Nortel as primary and the lease as Backup. or vice versa based on your link's capacity.

(I've assumed that because you have 2 links in the rip domain connected to London Office).

As for redistribution, In this situation make sure you make single point of redistribution to avoid routing loops. redistribute RIP into OSPF in SITE-A , dont do the same for SITE-B. at the same site-A , do the same by redistributing ospf into rip.

Hope this helps,

HTH

Mohamed

Jay,

Could you pls clarify more, how currently you setup your network?

I mean (Site-A) and (Site-b) in Which OSPF areas, and are you utilizing both wan links on the rip domain?

Also, what is the current config between site-b 2600 & branch office 2600 router?

Pls clarify more your current setup and config?

HTH

Mohamed

Hi Mohamed,

The previous posts will answer some of your questions also I have provided an ospf diagram provided.

The primary VPN device is located in Site B and backup at Site A. The traffic comming into the London sites are load balanced based on reachability.

The VPN device at each site in London connects to a services switch 3750 which has RIP and OSPF routing configured. Where RIP routes advertised from the VPN are distributed into OSPF.

The cisco 2600 routers are still to be configured when the leased line goes in.

Mohamed Sobair
Level 7
Level 7

Hi Jay,

Ok, I have attached your Diagram with some modification.

I have done this keeping in consederation that Rip is used and both Wan links are utilized for load balancing and redundancy.

bellow are the steps I made:

----------------------------

1- I made the lease line site-b 2600 router the ABR.

2- I made Sit-A Nortel and Site-B Nortel as ASBR routers, since they both should allow

redistribution for full reachability.(Ensures reachability and redundancy incase of any failure at the RIP Wan Link).

3- when redistributed RIp into OSPF on ASBR-1 , I will set a tag and deny it when I redistribute back OSPF from ASBR-2 to the RIP. (To avoid routing loop).

4- I will repeat step 3 for the same manner on ASBR-2.

5- For Suboptimal routing, I will ensure both ASBR-1 and 2, are prefering the RIP

direct routes to Nortel by modifying RIP AD value to lower than OSPF.

6- For redundancy and incase of the Lease Failure on 2600 site-b router, I will create

a tunnel between ASBR-1 to the ABR , and ASBR-2 to the ABR,since I cant create

a virtual link over Stub area, those tunnels will ensure and maintains connectivity

to Area 0 between ASBR-1,2 to the ABR.

I would like to hear from you & Joseph your comments.

HTH

Mohamed

Did you also see Jaya's 2/21 OSPF.vsd attachment?

Hi Mohamed,

Have you seen the other OSPF diagram ?

We are not looking to make a make such a drastic configuration change in London or Paris and we are not ready to introduce OSPF in Paris as yet possibly at a later date.

At the moment we want a simple redundancy solution to enable users in Paris continue working without major distruptions.

Ideally we want to keep things simple as possible with minimal downtime.

HTH