topic Re: Changing priority between eBGP and OSPF learned routes in General Topics

Changing priority between eBGP and OSPF learned routes

khsieh — Mon, 11 Mar 2019 23:21:36 GMT

I have an interesting problem that I haven't found a satisfying solution for.

I have various remote sites connected via private circuit with OSPF, and then IPSec VPN with eBGP learned routes. The administrative distance of eBGP is 20, and the administrative distance of OSPF is 30. I believe these are the defaults.

Right now, if there are two paths to a site, my firewall will always chose the eBGP route. I have sites where I want the eBGP route to be the backup to the OSPF. I haven't been able to get that to work. Is there anything I can do in OSPF or BGP to make a route learned by that protocol more or less desirable than a path learned by the other protocol?

I have been able to get this to "sort of" work by using static routing with path monitoring to "force" the OSPF path to be taken when it is available. This works, but takes significantly more configuration than what I would like, and is essentially replacing OSPF with static routing in that case.

Anyone have any better ideas?

I am thinking of building my IPSec tunnel to a different VR, and then the route can be shared between the new VR and the default VR via OSPF. I can then have a higher OSPF cost between the VR.

Thoughts?

Re: Changing priority between eBGP and OSPF learned routes

OtakarKlier — Tue, 12 Mar 2019 17:53:04 GMT

Hello,

You should be able to make that route less likeable. In PAN BGP i think its called the MED value. But that is sent prior to the PAN, in Cisco you can prepend the route.

BGP > Conditional Adv > Advertise Filters

Hope that helps.

Re: Changing priority between eBGP and OSPF learned routes

rmfalconer — Wed, 13 Mar 2019 16:19:19 GMT

Is there any way you can make the OSPF routes more specific than the BGP routes? Do some summarization with BGP when you export the prefixes to a peer? If the routes are the same, then administrative distance is used to determine which to use and will take the lower value.

You can change the administrative distance of the routing protocols but that would affect the entire virtual router.

Re: Changing priority between eBGP and OSPF learned routes

khsieh — Mon, 18 Mar 2019 19:20:45 GMT

I believe MED only influences the difference between two different BGP paths for the same route.

Re: Changing priority between eBGP and OSPF learned routes

khsieh — Thu, 28 Mar 2019 21:30:49 GMT

I am looking at having the router with the OSPF path to also advertise the routes back to PAN via BGP. I can then filter on the PAN which of those BGP routes I want to accept, and to give them a lower metric (higher priority).

Re: Changing priority between eBGP and OSPF learned routes

khsieh — Thu, 28 Mar 2019 22:15:58 GMT

Learning the two routes via BGP is working just as you would expect it to. I can control the chosen route via my BGP import rules.

Re: Changing priority between eBGP and OSPF learned routes

nextgenhappines — Thu, 04 Apr 2019 21:21:04 GMT

You could change the Administrative Distances on the firewall virtual routerr.

Network -> Virtual Router -> Router Setting -> Administrative distances.

Re: Changing priority between eBGP and OSPF learned routes

khsieh — Thu, 04 Apr 2019 22:25:28 GMT

@nextgenhappines wrote:
You could change the Administrative Distances on the firewall virtual routerr.

Network -> Virtual Router -> Router Setting -> Administrative distances.

Yeah, but that would be a global change, instead of allowing me to be more selective, and I would end up with other routes not being what I want, so that isn't really a solution.

Re: Changing priority between eBGP and OSPF learned routes

nextgenhappines — Thu, 04 Apr 2019 23:18:31 GMT

How about just run on one routing protocol?

Re: Changing priority between eBGP and OSPF learned routes

khsieh — Thu, 04 Apr 2019 23:21:59 GMT

Yeah, I may have to just run eBGP between my firewall and switch. Actually, setting up eBGP is the first step in my fix.

Re: Changing priority between eBGP and OSPF learned routes

khsieh — Wed, 26 Mar 2025 00:14:11 GMT

Just circling back to this topic. I do have this solved for my network by taking OSPF learned routes on my core switch, and advertising them back to my Palo Alto firewall. I use BGP import rules on the Palo Alto to determine the weight I want from routes learned via my switch vs routes learned via the IPSec tunnel. I give the routes learned via switch more weight, and then they become the preferred route.