06-26-2013 01:24 AM
Hello,
we created a IPSec tunnel between Cisco and PA:
Now we have a problem to make the network behind the Cisco Router reachable from the Corporate LAN and the other way (from Corporate LAN to the "Cisco LAN"). Both routers running OSPF. With OSPF we want to make this networks reachable through the PA. The PA already gets the OSPF informations from both Routers and is able to inject the "connected" network (setting image ospf9.jpg) to the OSPF network. But the OSPF routing information itself not.
We need your help. Did we missed a configuration? How does it work?
Please take a look at the attached files... Thanks a lot.
06-26-2013 03:55 AM
Try using the actual subnets (eg : 192.168.1.0/24) in the Destination field instead of the interfaces (ospf-9)
06-26-2013 04:13 AM
Did the change like you said:
But it doesn't work. Still able to reach the tunnel subnet but not the network behind the router.
06-26-2013 06:34 AM
Hi Hithead,
I have some recommendations for you:
1) First of all, if you want to learn the routes via OSPF, then we enable OSPF on the interfaces of the devices. We have OSPF configured on tunnel.2 and on eth1/2.1. From the screenshots on OSPF-1 and OSPF-2, we can see that the PANFW is learning the routes 10.xx.0.0/26 through the tunnel.2 interface and the 192, the 172 and the 10 networks on the eth1/2.1 interface. You can increase the metric of the static routes to prefer the link state routes over the static routes.
2) I see that the OSPF routes are being learnt, but just to be sure, have an "any any" permitting policy for OSPF application.
3) on ospf-4, I see that the tunnel.2 is seen as a BDR. Tunnel interfaces are always point to point. Change the interface link type to "point-to-point" and also change it on the tunnel interface of the cisco router.
4) You dont redistribute an OSPF route into OSPF, like we have on the screenshots of OSPF-7 and OSPF-8. All you need is to configure the interfaces with OSPF, which we have done. I see that the tunnel.2 is on area0 and eth1/2.1 is on area x. Likewise, we dont need redistribution of inter area routes. It is automatically done by OSPF
5) We dont have to resdistribute the connected routes into OSPF. The participating interfaces would advertise their network addresses,and also the networks reachable on them into OSPF by default.
6) When you mean you can reach the tunnel subnet, I see that you are attempting to reach networks on the remote lan. Can you verify if the routing is configured correctly on the remote end routers.
7) After having verified all these steps, if we still cannot get it to work, please open a case with us.
Thanks and best regards,
Karthik RP
06-27-2013 04:15 AM
Hi,
thanks for the check list. Now we got OSPF. But not completely:
You see, the cisco router and the "OSPF Router" at the same network as the PA gets the OSPF information. But the PA (or OSPF Router - vendor Cisco) do not forward the OSPF information to e.g. LAN B (we have several subnets).
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!