topic OSPF through Vwire in General Topics

OSPF through Vwire

Nathan.McCart — Tue, 10 Nov 2015 01:01:48 GMT

I attempted to install a PA5060 between a Cisco ASA and Cisco Nexus switch in vwire mode. the ASA has an OSPF neighbor with the nexus 7k to distribute the defualt route learned via BGP from the ISP.

Once the 5060 was installed, the OSPF neigbor came up but the routes were not exchanged. in the logs I see the traffic as allowed and the application as OSPF.

Is there any other configuration needed? I see in the following article that multicast traffic is allowed by defualt in vwire.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Block-Multicast-Traffic-in-a-VWire-Virtual-Wire-Setup/ta-p/55877

The PA-5060 is running 7.0.3

All other traffic was working. I could ping across the vwire but the routes were not there.

thanks,

Nathan

Re: OSPF through Vwire

rmonvon — Tue, 10 Nov 2015 19:43:29 GMT

Hi there...Did you include security rule(s) to allow OSPF traffic in both directions across the vwire?

Re: OSPF through Vwire

Nathan.McCart — Tue, 10 Nov 2015 20:39:26 GMT

yes I have security policies allowing all traffic both ways.

Re: OSPF through Vwire

rmonvon — Tue, 10 Nov 2015 20:44:03 GMT

You can turn on packet capture on the PA device and filter on the OSPF multicast to see what's happening to the packets. Set the pcap to capture at all 4 stages: TX, RX, DROP and FIREWALL. That should provide information to help pinpoint the issue. Thanks.