topic Re: Redistributing Tunnel interface into OSPF no longer working in General Topics

Redistributing Tunnel interface into OSPF no longer working

Bocsa — Fri, 02 Mar 2018 14:44:53 GMT

Hi,

I have a strange scenario here. To summarize, I had previously configured GlobalProtect on a Palo firewall and configured the Palo to redistribute that network range on the tunnel interface into OSPF. This worked without any problem.

Now, the IP address range for GlobalProtect users needed to change so I had to go and change the IP pool for GlobalProtect. No other changes to GlobalProtect configuration were made. However, since changing the IP pool, the Palo is no longer redistributing the tunnel interface IP range into OSPF.

Any suggestions on how to fix this without fully re-configuring GProtect from scratch?

Re: Redistributing Tunnel interface into OSPF no longer working

OtakarKlier — Fri, 02 Mar 2018 16:10:17 GMT

Hello,

I would start with reviewing your OSPF redistribution policies to make sure there are no filters that could be causing this.

Also the OSPF area config to see if there are entries in the Range.

Regards,

Re: Redistributing Tunnel interface into OSPF no longer working

Mick_Ball — Fri, 02 Mar 2018 16:48:58 GMT

clutching at straws here but did you also change the L3 IPv4 network address on the PA interface to accomodate the new pool range.

EDIT.... cancel that, just noticed you were using redistribution...

Re: Redistributing Tunnel interface into OSPF no longer working

Bocsa — Mon, 05 Mar 2018 10:21:03 GMT

Had a look at the OSPF LSDB on other firewalls and realized that it was actually being redistributed. However, the other firewalls were preferring the same routing advert from a different firewall and so wasn't placing it in the routing table.

Thanks for your suggestions