How to inject OSPF information from PA to other OSPF-Routers

[Hithead]

Hello,

we created a IPSec tunnel between Cisco and PA:

Now we have a problem to make the network behind the Cisco Router reachable from the Corporate LAN and the other way (from Corporate LAN to the "Cisco LAN"). Both routers running OSPF. With OSPF we want to make this networks reachable through the PA. The PA already gets the OSPF informations from both Routers and is able to inject the "connected" network (setting image ospf9.jpg) to the OSPF network. But the OSPF routing information itself not.

We need your help. Did we missed a configuration? How does it work?

Please take a look at the attached files... Thanks a lot.

[Ameya-Kawimandan]

Try using the actual subnets (eg : 192.168.1.0/24)  in the Destination field instead of the interfaces (ospf-9)

[Hithead]

Did the change like you said:

But it doesn't work. Still able to reach the tunnel subnet but not the network behind the router.

[kprakash]

Hi Hithead,

I have some recommendations for you:

1) First of all, if you want to learn the routes via OSPF, then we  enable OSPF on the interfaces of the devices. We have OSPF configured on tunnel.2 and on eth1/2.1.  From the screenshots on OSPF-1 and OSPF-2, we can see that the PANFW is learning the routes 10.xx.0.0/26 through the tunnel.2 interface and the 192, the 172 and the 10 networks on the eth1/2.1 interface. You can increase the metric of the static routes to prefer the link state routes over the static routes.

2) I see that the OSPF routes are being learnt, but just to be sure, have an "any any" permitting policy for OSPF application.

3) on ospf-4, I see that the tunnel.2 is seen as a BDR. Tunnel interfaces are always point to point. Change the interface link type to "point-to-point" and also change it on the tunnel interface of the cisco router.

4) You dont redistribute an OSPF route into OSPF, like we have on the screenshots of OSPF-7 and OSPF-8. All you need is to configure the interfaces with OSPF, which we have done. I see that the tunnel.2 is on area0 and eth1/2.1 is on area x. Likewise, we dont need redistribution of inter area routes. It is automatically done by OSPF

5) We dont have to resdistribute the connected routes into OSPF. The participating interfaces would advertise their network addresses,and also the networks reachable on them into OSPF by default.

6) When you mean you can reach the tunnel subnet, I see that you are attempting to reach networks on the remote lan. Can you verify if the routing is configured correctly on the remote end routers.

7) After having verified all these steps, if we still cannot get it to work, please open a case with us.

Thanks and best regards,

Karthik RP

[Hithead]

Hi,

thanks for the check list. Now we got OSPF. But not completely:

You see, the cisco router and the "OSPF Router" at the same network as the PA gets the OSPF information. But the PA (or OSPF Router - vendor Cisco) do not forward the OSPF information to e.g. LAN B (we have several subnets).