ospf and default route 0.0.0.0

[paulkilcoyne]

Hi there,

I have a remote site LAN that is connected via a point to point connection back to our HQ office.

I have extended area 0 out to this remote site and the remote L3 switch has formed an ospf neighborship with our HQ L3 switch fine.

-------remote L3 switch <<<< ospf area 0 >>>> HQ L3 switch-------

In the remote site LAN we have a juniper firewall connected to the internet.

I have formed an ospf neighborship on area 0 between my remote site L3 switch and the juniper firewall.

internet----juniper firewall<<<< ospf area 0>>>>-------remote L3 switch <<<< ospf area 0 >>>> HQ L3 switch-------

In the remote site LAN I want to divert all traffic towards the firewall ( i.e. internet bound traffic ) except 10.0.0.0/8, so I was thinking of adding a static route on the juniper firewall as follows:

ip route 0.0.0.0/0 next-hop 68.76.75.1

This static route would then be redistributed into the ospf routing table of the remote L3 switch.

My fear is that this static route will be redistributed all the way across to our HQ L3 switch thus pointing all non 10.0.0.0 traffic back to my remote office firewall.

Here is the remote L3 switch ospf config:

router ospf 1

router-id 10.x.x.2

redistribute connected subnets

network 10.x.x.2 0.0.0.255 area 0

Are my fears justified? If so how can I avoid this?

Many thanks,

Paul

[Kishore Chennupati · Accepted solution]

Hi Paul,

OSPF does not support redistribution of statically defined default routes. Instead, OSPF requires the default-information originate router subcommand, which essentially tells OSPF to redistribute any default routes found in the routing table, either static routes or routes from another routing protocol

The default route will not be propagated to the HQ unless you add the command default-information originate under the ospf process on the remote L3 switch. So you are safe here

HTH

Kishore

[paulkilcoyne]

Kishore,

thanks so much for your speedy and concise explanation.

I can rest easy now :-)

Nice ospf "safety" feature cisco!!!

Regards,

Paul