- R is Router, S is L3 Switch and F is Firewall.
- R1, S1 and F1 are active. Rest are passive.
- R1 to R2 link is just used for iBGP. R1 will get better BGP PA.
- R1 and R2 will redistribute prefixes into OSPF. R1’s OSPF route will be better,
- OSPF will be running in the shown area. F1 and F2 won’t participate in OSPF.
- F1’s DG is HSRP IP. S1 is the active HSRP router by default.
Now I'm trying to implement that OSPF part. First question: Is this considered a Broadcast OSPF topology or a point to point? How would you implement that?
***************
Now if you are ready for confusion, let’s consider the different failover scenarios and our requirements:
1. R1, S1 and F1 are primary so in normal situation traffic flow should be this:
We are good here. S1 will use R1 to send packets over MPLS to the remote subnet.
2. If primary WAN is down, then the traffic flow should be this:
S1 should remove its current OSPF route to the remote subnet and put the other one on its routing table. Thank you OSPF.
3. If GE1 link is down but R1 is alive, then S2 should become the gateway for F1 and traffic flow should be this:
S1 will again remove its current route and will try using its link to R2 like #2 above, but dear OSPF you are not enough here. R1 is still alive. I would say let’s run HSRP between S1 and S2. Then have S1 to keep track if its GE1 line protocol using Object Tracking. If GE1 is down then HSRP priority is decreased and S2 becomes the active router. Now although S1 has a route to the remote subnet, but it will send F1's traffic to S2 first. Why? Because F1 will use S2’s MAC as DG. S2 has two OSPF routes to the remote subnet and will use R1 because it’s better.
4. If R1 is down then S2 should become the gateway for F1 and traffic flow should be this:
Well, the traffic can be like number 2 above, but why I can’t use that? Because if I do, then I have to do the same for number 3 as well. Why? Because S1 can’t realize why the link is down (link is bad or R1 is down). So in either case I’ll route traffic to S2 so S2 can decide what to do.
****
I have a feeling that implementing this shouldn’t be THIS complicated. No you may ask:
Why don’t you run OSPF between S1 and S2 so there is a third route to the remote subnet as well ? (get rid of HSRP and object tracking too)
Well if I do, then in number 2 scenario, I want S1-S2 be a better OSPF route and in number 3 or 4 I want S1-S2 be a better link and I don’t know how to do that.
