topic Re: OSPF passive interfaces question in General Topics

OSPF passive interfaces question

Sec101 — Wed, 28 Jul 2021 00:24:37 GMT

What is best practice to advertise connected networks on a single VR where you have OSPF running and neighboring on an Internal Firewall interface to router, and want to advertise multiple segmented/firewalled networks directly attached the same firewall?

Is it best to mark the segmented networks as Passive ospf interfaces, and allow OSPF to advertise these networks to internal router

Are there any risks of rogue routers/devices that could be installed on a segmented section and send updates to the passive OSPF interface on the firewall? A passive OSPF interface won't accept incoming advertisements because an adjacency isn't established iirc. But there aren't any risks I'm missing on this are there?

Citing below link for background information:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXsCAK

Re: OSPF passive interfaces question

michelealbrigo — Wed, 28 Jul 2021 11:05:03 GMT

I'd mark as passive any interface that should not form OSPF adjacences, to avoid route hijacking (either by rogue or misconfigured devices). Not sure if that's a "unviersal enough" thing to be named a "best practice", though. Authenticating OSPF can also mitigate the same problem, esp. if some of your links transit on somebody else's network or if some of your devices need to offer Anycast services and are mixed with others which should not take part in OSPF (e.g. a DNS server member of an Anycast pool on the same subnet with regular servers).

Re: OSPF passive interfaces question

Sec101 — Wed, 28 Jul 2021 12:54:29 GMT

OSPF authentication is a good idea, but something we are not doing as of yet. There isn't any way for an opsf passive interface to accept any inputs or ingest routes from the passive link I'm thinking?

Re: OSPF passive interfaces question

OtakarKlier — Wed, 28 Jul 2021 15:06:44 GMT

Hello,

Another option is to utilize metrics. Allow the adjacencies to form and then apply metrics to the routes to that are less favorable.

Cheers!