Switchport Configuration

[fatalXerror]

Hi Guys,

I have a firewall configured in bridge mode (transparent) and it is in between of my two switches and these two switches needs to form OSPF neighbor.

The two interface of my firewall is configured as trunk and I tag the VLAN per interface like eth1.100 <-> eth2.100 and eth1.200 <-> eth2.200. 

What should be the configuration of the ports of my two switches connecting to the eth1 and eth2 of my firewall? 

Thank you very much.

[Reza Sharifi]

Hi,

Assuming you are using vlan 100 and 200, you need a trunk port on each of the switches connected to the firewall. You also need to create an SVI for the vlan you are going to use to peer OSPF with the other switch. In reality, you only need one vlan for peering and not 2. So, vlan 100 with an SVI on each switch and OSPF config on each switch should do the peering.

HTH

[fatalXerror]

Hi @Reza Sharifi ,

We tried that kind of configuration but for some reason the OSPF is not forming and I cannot even reach the P2P IP of the switch. But, when we tried to configure the switchport as an access port for example VLAN 100, the OSPF formed.

You are correct, one OSPF should be fine already however, as per my network engineer who designed it, the reason why it is like that is because it uses VRF as well in which all inter-VRF routing will be done on the core switch above my firewall.

Do you have an idea why it works when we configured the switchport to an access port?

Thanks

[Reza Sharifi]

Can you post switch config and point out the interfaces you are using to connect to the firewall and also the SVIs?

Even with VRF, you still need one global transit vlan between the 2 switches for OSPF peering. If you are also using a VRF to peer the switches together than that is different vlan or sub-interface. I am still not clear, why you are trying to peer globally as well as within a VRF, if my understanding is correct.

HTH

[Quentin Gabrel]

Hi,

Could you give us more details ?

What's the model of your switch ? OSPF is a routing protocol which have to "bind" to L3 interface of your equipment.

I'm not sure to understand why you have two vlan.

I think you should use interface vlan on your switch to run OSPF. 
The configuration of your physical interface must be switchport mode trunk with an allow vlan 100, 200