OSPF load sharing design

[ciscoscott2012]

We have our network setup as displayed in the attached. We have 2 HQ offices and 1 branch office. The branch office needs to connect to resources located at both HQs but taking the most effecient path.              

We have ethernet circuits connecting from each HQ to 2 x Cisco 3560 switches in the branch. HSRP has been configured on the 3560 switches with SW1 as active and SW2 as standby. OSFP has been configured in a single area 0 and the path cost on the link between HQs has been increase to allow 3560 SW1 to route to HQ1 directly and HQ2 via 3560 SW2.The 3560s are connected with a trunk with a L3 SVI for OSPF.

This seems to work ok but I have noticed that the branch could become transit if the HQ1 to HQ2 link breaks. How can this be avoided? I realise that if we configure the branch subnets and SW1 to SW2 link in a stub area (area1) then all traffic will route from SW1 to HQ1 and will never share over SW2. I'm assuming that this is because OSPF chooses inter-area routes over intra-area.

How can I can configure the network to load share while ensuring it doesnt become transit?

[Reza Sharifi]

Here is an example of how you can filter OSPF routes.

http://www.netcraftsmen.net/resources/blogs/filtering-ospf-areas-in-ospf.html/

HTH

[ciscoscott2012]

Thanks. So will i need to keep all switches in area 0 and then configure the HQ switches to filter routes from the branch switches to avoid the HQ routes from entering the routing table when the HQ to HQ link drops?

[ciscoscott2012]

Has anyone got any thoughts on this?

[Giuseppe Larosa]

Hello Ciscoscott2012,

one possible solution is feasible if all the routes of interest are internal routes.

If this is true the following can be done:

SW1 and SW2 in branch office are placed in a stub area X.

HQ1 and HQ2 are configured as ABR nodes between area 0 and area X.

HQ1 and HQ2 inject a default route as O IA route 0.0.0.0/0.

In addition to the default route each ABR sends out only a subset of specific routes of interest.

In this way HQ1 is used for specific routes advertised by HQ1, and HQ2 is used for specific routes  advertised by HQ2 into area X.

Example:

HQ1 injects routes within 10.100.0.0/16 and HQ2 injects routes within 10.120.0.0/16

HQ1:

ip prefix-list LEAK-HQ1 permit 10.100.0.0/16 le 32

router ospf 1

area X stub

area X default-cost 10

area X filter-list LEAK-HQ1  in

HQ2:

ip prefix-list LEAK-HQ2 permit 10.120.0.0/16 le 32

router ospf 1

area X stub

area X default-cost 10

area X filter-list LEAK-HQ2  in

see

http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_ospf/command/ospf-a1.html#GUID-A4EF0934-BA01-4FD7-9456-9348DF445E10

With this feature enabled in the "in" direction,  all type 3 LSAs originated by the ABR to this area, >>based on information  from all other areas<<, are filtered by the prefix list. Type 3 LSAs that  were originated as a result of the area range  command in another area are treated like any other type 3 LSA that was  originated individually. Any prefix that does not match an entry in the  prefix list is implicitly denied.

In this way you can get load balancing per destination IP prefix in HQ

If one SWi - HQi fails all destinations are reachable via the default route injected by HQj

If the link HQ1 - HQ2 fails routing via branch office is not feasible as not part of area 0 anymore.

Edit:

modified area filter list direction after reviewing OSPF command reference

Hope to help

Giuseppe