Passive Interface in OSPF process in VRF

[Saman Shamim]

Hi all,

On a L3 Switch if I create a SVI:

int vlan 10

ip 192.168.1.1

Then configure two switchports:

int range g1-2

mode trunk

allow vlan 10

and enable OSPF:

router ospf 1

network 192.168.1.0

Then OSPF multicast Hello messages will be send down those trunk links. Now If I want to filter a link I can do the following:

router ospf 1

passive interface g2

Am I under right impression? if yes, please continue reading.

Question:

I’m not able to do this when I start an OSPF process within a VRF. In other word:

int vlan 10

IP 192.168.1.1

ip vrf forwarding test

int range g1-2

mode trunk

allow vlan 10

router ospf 1 vrf test

network 192.168.1.0

passive interface g2

%Interface specified does not belong to this process

Why? Am I missing something? It would make sense if those trunk ports were L3, but they are not, so why does OSPF care? 

Regards

[Reza Sharifi · Accepted solution]

Hi,

Even though, they are trunk ports, but still are not part of vrf test.  That is why you can't added them to OSPF (vrf test).

int rane g1-2

ip vrf forwarding test

than try adding them to OSPF.

HTH

[Jon Marshall]

Saman

Then OSPF multicast Hello messages will be send down those trunk links. Now If I want to filter a link I can do the following:

router ospf 1

passive interface g2

Am I under right impression?

No because g2 is a L2 interface not a L3 interface. The OSPF network command tells OSPF which interfaces to run OSPF on. Your config tells it to run on the vlan 10 interface and then OSPF begins sending and receiving hellos. Obviously it only receives hellos if there are any other OSPF speaking routers on vlan 10.

So using passive interface on gi2 does nothing because OSPF is not running on gi2.

Jon

[Saman Shamim]

So the only way to operate OSPF between a L3 switch and another device is to use L3 ports

on L3 switch? (no switchport command and IP under the interface)

Then how would you virtualize routing protocols? I mean the main goal here is to create multiple VRFs on one device and extend it to another device using VLAN to VRF mapping (802.1Q trunking) and running separate OSPF processes in each VRF.

[Jon Marshall]

Saman

So the only way to operate OSPF between a L3 switch and another device is to use L3 ports

on L3 switch? (no switchport command and IP under the interface)

You can use SVIs, they don't have to be physical L3 ports. OSPF simply starts up on the SVI just as it would a physical L3 interface and neighborships/adjacencies are formed using the SVI.

Then how would you virtualize routing protocols? I mean the main goal here is to create multiple VRFs on one device and extend it to another device using VLAN to VRF mapping (802.1Q trunking) and running separate OSPF processes in each VRF

Just as you have done ie. you put each SVI into it's own VRF. If you allocate vlan 10 into a VRF then i assume any other L3 devices in vlan 10 reachable via either trunk link should be in the same VRF. It is a trunk link but that doesn't mean all vlans on the trunk link are in the same VRF because you have only allocated vlan 10 into the test VRF.

So if you also had a vlan 11 SVI on the L3 switch and vlan 11 was allowed on the trunk link any routes received from another vlan 11 L3 device would be in the global routing table because you haven't assigned vlan 11 to any VRF.

If however you want the vlan 10 L3 devices reachable by one trunk link to be in the test VRF but the vlan 10 L3 devices reachable via the other trunk link not to be in the test VRF then that won't work. You would need to move the non VRF L3 devices off vlan 10.

In terms of a physical L3 interface you definitely don't want that because the interface can only be in one VRF. That is why on a L3 switch it is better to use a L2 trunk link (or links) and assign the SVIs into the VRFs.

Hope that makes sense.

Jon

[Saman Shamim]

Jon, everything you are saying makes sense. I think the confusion is coming from my original question. Let me put it this way:

I create 2 SVI interface at both sides (vlan 10 and 20). I put each VLAN interface in their own VRFs (Red and Blue respectively) at both sides. Next, I run a trunk link in between and allow both VLANs in trunk. Finally I run one OSPF process per VRF and everything should be ok. I have the separation I needed. No question there. Are we good here?

Here is the question:

Let’s say one of those two devices, has another trunk interface connected to another segment of the network. As a requirement, the same VLANs are allowed in that trunk and we have other devices in those VLANs. There is no need of OSPF in this segment. All I need is to make sure no OSPF multicast packets are being sent that way. Ho do I achieve that? If I go under OSPF configuration in each VRF, I'm not able to make this other trunk interface passive.

[Jon Marshall · Accepted solution]

Saman

I have the separation I needed. No question there. Are we good here?

So far so good

There is no need of OSPF in this segment. All I need is to make sure no OSPF multicast packets are being sent that way. Ho do I achieve that? If I go under OSPF configuration in each VRF, I'm not able to make this other trunk interface passive

Is it for all vlans reachable via that trunk port or just vlan 10 ? 

If it for all vlans then you may be able to use a port acl in the physical interface but the direction you can apply it in is switch dependant and some switches only support the inbound direction. This would not stop the L3 switch trying to send hellos but it would stop them being sent out of the trunk link You may also want to stop them coming in in which case you would need an inbound acl as well.

If the switch only supports the port acl in the inbound direction then it may be enough for you to just block them coming in ie. your switch can still send them out but it won't be able to form any neighborships because it never gets any hellos comiing back.

If it just for vlan 10 then i don't think even that is an option to be honest.

Can i ask why you want to do this ie. what you are trying to achieve as understanding exactly what it is you want may help us come up with a solution for you.

Anyway it's late here so i will pick this up tomorrow unless someone else joins in and provides a solution.

Jon

[Saman Shamim]

Jon,

Thanks for your response.

jon.marshall wrote:
Can i ask why you want to do this ie. what you are trying to achieve as understanding exactly what it is you want may help us come up with a solution for you. 

Basically those L3 switches are at the edge of the network having OSPF connectivity with provider's MPLS routers. Inside of our network, we have Virtual L3 Firewalls at VMware level. I was trying to put outside interface of those firewalls in the same subnet as the edge switches and MPLS routers, but not running OSPF below the switches. I admit that is an uncommon design. Logically it's like having a multi-access broadcast OSPF network and then trying to exclude one device from participating in OSPF! 

However, I decided to split subnets at the edge. That is, one subnet between edge switches and MPLS routers with OSPF enabled, another subnet facing inside of the network with no OSPF and just static default routing. That looks a lot better to me!