OSPF Configuration Help

[utawakevou]

I have this setup with a hybrid of equipment's from Cisco and Ubiquiti Edge routers and Vyos. My Cisco Nexus configured with HSRP with all the SVI's on 192.168.1.243 as the active on HSRP and SVI's all on area 0.0.0.0 with SVI interfaces on 192.168.1.242 configured as  ip ospf cost 50 because the default ip ospf cost on  192.168.1.243 is 40. I also configure ip ospf priority 100 on all SVI's of 192.168.1.243 and ip ospf priority 90 on all SVI's for 192.168.1.242. All the routers loopback interfaces and ethernet on 192.168.0.0/24 are on area 0.0.0.0. This setup is for me to have redundancy in my core network. OSPF neighbors looks ok on all routers. 

Install in a new Edge router with 192.168.1.241 as the router ID and same OSPF configuration as 192.168.1.240 as I need to replace 192.168.1.240 however I cannot access this from any client connected to the subnets/vlan off the Cisco Nexus SVI's. I can access it from remote sites and even the routers in the same area. My WAN sites are connected via 192.168.1.240, 192.168.1.254 amd 10.11.1.50 and clients from that end can access this new router (192.168.1.241). I notice that OSPF works well as it manage to get routes from the respective neighbors on the same subnet and it get routes from the remote sites as well off my other WAN routers. Through troubleshooting I notice that if I configure the SVI on 192.168.1.243 with a higher cost I can access it but loose access to other routers in the same backbone area.

I believe there must be something I'm missing on my Nexus configuration. Am attaching herewith my setup and the configuration of the SVI's on my two Nexus. Hope someone will help me out here

Thanks

[utawakevou]

Attach herewith is the result of #show ip ospf border-routers for the 2 Nexus, the 2800 and a 1841 router at one of the remote site connected via the Cisco 2800

[Francesco Molino]

Can you explain how your router 2800 and 1841 for remote site are connected together?

On 2800, to join your 1841 is goung through an interface f0/1.3101 and this is the same interface on the other end. 

Can you do on all those 4 routers a show ip ospf neigh ? 

I would like to confirme something.Also run a  show ip route 192.168.2.0 on your 2800 and 1841.

Thanks

[utawakevou]

Remote site using the 1841 is connected via our providers fiber MEN. Attach herewith the setup diagram and the show ip route result of all the 4 routers

Thanks

[Francesco Molino]

Hi

Sorry for my late answer, those days are crazy, lot of work and not able to answer as quick as I would like.

This output confirms that you modified, I guess, the cost on some equipments and at your remote site and/or 2800 router, you're seeing only 1 route (the best path).

If you shutdown your primary nexus, you should see your route for that subnet coming from the 2nd Nexus. Can you do this test ?

Is it what you're trying to achieve? If you want to see the equal route coming from both nexus switches, then you need to align the same cost everywhere.

However, this doesn't explain why you're not able to reach that subnet if your 1st nexus goes down. Can you switch it off and send same outputs to see what's going on?

Also on 1st nexus, why are you using no ip ospf passive on vlan 3 only whereas on 2nd nexus it's applied on all interfaces. In terms of best practices and controlling your OSPF updates, you need to take care that OSPF updates are announced only through some interfaces and not everyone. Here, it doesn't seem that your issue is coming from here but it could be good to fix that.

Thanks

[utawakevou]

Yes, I did modify the cost on the SVI's of Nexus02 and on 2800 for one of the remote site as it has two paths

I also modify the priority costs of all the interface connected to the backbone area so I force my Nexus to be my DR's and BDR's

Yes, when I shut down the SVI on Nexus01 I can see the route coming from my Nexus02. Thats ok and thats what I want

However I notice that hosts connected on those VLAN's and using the actual SVI interface for routing purpose will not be able to go out or will be unreachable from remote site and even host in other SVI of the Nexus. For e.g I have a host connected via one of the SVI hosted by both Nexus and it uses the SVI IP address of the Nexus02 for routing (Dont know how that works). I have 192.168.2.180 and when I trace route to a remote site host it goes out via the Nexus02 SVI - 192.168.2.3. Example below

C:>tracert 192.168.10.11
Tracing route to 192.168.10.11
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.2.3
2 2 ms 2 ms 1 ms 192.168.0.6
3 2 ms 2 ms 3 ms 192.168.1.6
4 1 ms 1 ms 1 ms 192.168.10.11

Trace complete.

From the remote site when I traceroute to the host its ok

C:\>tracert 192.168.2.180

Tracing route to 192.168.2.180
over a maximum of 30 hops:

1 1 ms 1 ms 1 ms 192.168.10.253
2 1 ms 1 ms 1 ms 192.168.1.5
3 1 ms 1 ms 1 ms 192.168.0.20
4 1 ms 1 ms 1 ms 192.168.2.180

Trace complete.

When I shutdown the SVI (192.168.2.3) 192.168.2.180 is using for its actual gateway it doesnt work at all even though from my host it change the actual gateway to the SVI on Nexus01 (192.168.2.4)

C:>tracert 192.168.10.11

Tracing route to 192.168.10.11
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.2.4
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.

C:\>tracert 192.168.2.180

Tracing route to 192.168.2.180
over a maximum of 30 hops:

1 1 ms 1 ms 1 ms 192.168.10.253
2 10 ms 12 ms 13 ms 192.168.1.5
3 11 ms 10 ms 10 ms 192.168.0.20
4 * * * Request timed out.
5 * * * Request timed out.

My whole purpose if for the Nexus to handle redundancy. If one drops the other standby becomes active and vice versa

[Francesco Molino]

Can you give me the output of your show ip route on all hops when the SVI 192.168.2.3 is in shutdown mode? It will help to answer the question why the traffic isn't reaching your remote site when this SVI is down.

Who is 192.168.0.6 ?

Thanks

[utawakevou]

Nexus01
--------
IP Route Table for VRF "default"
'*' denotes best ucast next-hop
'**' denotes best mcast next-hop
'[x/y]' denotes [preference/metric]
'%<string>' in via output denotes VRF <string>

192.168.2.0/24, ubest/mbest: 1/0, attached
*via 192.168.2.4, Vlan3, [0/0], 1d22h, direct

Nexus02
-------
IP Route Table for VRF "default"
'*' denotes best ucast next-hop
'**' denotes best mcast next-hop
'[x/y]' denotes [preference/metric]
'%<string>' in via output denotes VRF <string>

192.168.2.0/24, ubest/mbest: 1/0
*via 192.168.0.20, Vlan2, [110/90], 00:06:17, ospf-100, intra

Cisco 2800
----------
Routing entry for 192.168.2.0/24
Known via "ospf 1", distance 110, metric 41, type intra area
Last update from 192.168.0.20 on FastEthernet0/0, 1d22h ago
Routing Descriptor Blocks:
* 192.168.0.20, from 192.168.1.242, 1d22h ago, via FastEthernet0/0
Route metric is 41, traffic share count is 1

Cisco 1840 @ Remote Site
------------------------
Routing entry for 192.168.2.0/24
Known via "ospf 1", distance 110, metric 42, type inter area
Last update from 192.168.1.5 on FastEthernet0/1.3101, 02:00:29 ago
Routing Descriptor Blocks:
* 192.168.1.5, from 192.168.1.254, 02:00:29 ago, via FastEthernet0/1.3101
Route metric is 42, traffic share count is 1

192.168.0.6 is my Cisco 2800. If you refer to my diagram (ospf.pdf) on my initial post you'll be able to understand how things are connected. I have 5 of my remote sites connected via that 2800

[Francesco Molino]

I referred to you diagram and don't see anything talking about 192.168.0.6 that's why i asked. 

Could you give the output of show ip route for both nexus when your svi is shutdown? Not only for 192.168.2.0/24. 

Also please give show ip ospf neighbor output of nexus when svi is down. 

[utawakevou]

Attach herewith is the output from both nexus. By the way I just put in .6 on the interface that is attached to 192.168.0.0/24 (backbone area - 0) on the diagram and that's the Cisco 2800. I never include in the remote sites in the diagram

[Francesco Molino]

On your nexus 1, while svi is down on nexus 2, can you ping your 2800 router (192.168.0.6)? Also try a ping from nexus 1 to your remote site by sourcing the icmp from vlan 2 and vlan 3.

Is it normal that nexus 1 has no outside posting with your 2800 router?

Are we allowed to do a live troubleshooting? If yes, contact me by PM and we will schedule this session. 

Thanks

[utawakevou]

From Nexus01 I can pong 192.168.0.6 and from source address of SVI 2 and 3 as well

nexus01# ping 192.168.0.6
PING 192.168.0.6 (192.168.0.6): 56 data bytes
64 bytes from 192.168.0.6: icmp_seq=0 ttl=254 time=1.56 ms
64 bytes from 192.168.0.6: icmp_seq=1 ttl=254 time=1.251 ms
64 bytes from 192.168.0.6: icmp_seq=2 ttl=254 time=1.569 ms
64 bytes from 192.168.0.6: icmp_seq=3 ttl=254 time=1.472 ms
64 bytes from 192.168.0.6: icmp_seq=4 ttl=254 time=1.508 ms

--- 192.168.0.6 ping statistics ---
5 packets transmitted, 5 packets received, 0.00% packet loss
round-trip min/avg/max = 1.251/1.472/1.569 ms

nexus01# ping 192.168.10.11 source 192.168.2.4
PING 192.168.10.11 (192.168.10.11) from 192.168.2.4: 56 data bytes
64 bytes from 192.168.10.11: icmp_seq=0 ttl=125 time=2.276 ms
64 bytes from 192.168.10.11: icmp_seq=1 ttl=125 time=1.629 ms
64 bytes from 192.168.10.11: icmp_seq=2 ttl=125 time=1.738 ms
64 bytes from 192.168.10.11: icmp_seq=3 ttl=125 time=1.566 ms
64 bytes from 192.168.10.11: icmp_seq=4 ttl=125 time=1.495 ms

--- 192.168.10.11 ping statistics ---
5 packets transmitted, 5 packets received, 0.00% packet loss
round-trip min/avg/max = 1.495/1.74/2.276 ms

nexus01# ping 192.168.10.11 source 192.168.0.20
PING 192.168.10.11 (192.168.10.11) from 192.168.0.20: 56 data bytes
64 bytes from 192.168.10.11: icmp_seq=0 ttl=125 time=1.714 ms
64 bytes from 192.168.10.11: icmp_seq=1 ttl=125 time=1.494 ms
64 bytes from 192.168.10.11: icmp_seq=2 ttl=125 time=1.545 ms
64 bytes from 192.168.10.11: icmp_seq=3 ttl=125 time=1.469 ms
64 bytes from 192.168.10.11: icmp_seq=4 ttl=125 time=1.531 ms

--- 192.168.10.11 ping statistics ---
5 packets transmitted, 5 packets received, 0.00% packet loss
round-trip min/avg/max = 1.469/1.55/1.714 ms

What do you mean by "Is it normal that nexus 1 has no outside posting with your 2800 router?"

Anyway I can send you an SfB meeting invitation if you can give me your email address and we can go through online. If you have other alternative then let me know

Thanks

[Francesco Molino]

Sorry my phone auto correct as changed my words. 

I was saying is it normal that nexus 1 has no ospf peering with your 2800 router. 

We can do a online meeting on Sunday if that's OK for you? Otherwise tomorrow after 6.00pm EDT. Which timezone are you? 

Thanks

[utawakevou]

Sure. That-ll be around after 10:00 am our time. I'm on   GMT/UTC + 12h. Will send an invitation to you soon

Regards