How to inject OSPF information from PA to other OSPF-Routers

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

How to inject OSPF information from PA to other OSPF-Routers

L4 Transporter

Hello,

we created a IPSec tunnel between Cisco and PA:

overview.jpg

Now we have a problem to make the network behind the Cisco Router reachable from the Corporate LAN and the other way (from Corporate LAN to the "Cisco LAN"). Both routers running OSPF. With OSPF we want to make this networks reachable through the PA. The PA already gets the OSPF informations from both Routers and is able to inject the "connected" network (setting image ospf9.jpg) to the OSPF network. But the OSPF routing information itself not.

We need your help. Did we missed a configuration? How does it work?

Please take a look at the attached files... Thanks a lot.

10 REPLIES 10

L5 Sessionator

Try using the actual subnets (eg : 192.168.1.0/24)  in the Destination field instead of the interfaces (ospf-9)

Did the change like you said:

ospf-new1.jpg

But it doesn't work. Still able to reach the tunnel subnet but not the network behind the router.

L5 Sessionator

Hi Hithead,

I have some recommendations for you:

1) First of all, if you want to learn the routes via OSPF, then we  enable OSPF on the interfaces of the devices. We have OSPF configured on tunnel.2 and on eth1/2.1.  From the screenshots on OSPF-1 and OSPF-2, we can see that the PANFW is learning the routes 10.xx.0.0/26 through the tunnel.2 interface and the 192, the 172 and the 10 networks on the eth1/2.1 interface. You can increase the metric of the static routes to prefer the link state routes over the static routes.

2) I see that the OSPF routes are being learnt, but just to be sure, have an "any any" permitting policy for OSPF application.

3) on ospf-4, I see that the tunnel.2 is seen as a BDR. Tunnel interfaces are always point to point. Change the interface link type to "point-to-point" and also change it on the tunnel interface of the cisco router.

4) You dont redistribute an OSPF route into OSPF, like we have on the screenshots of OSPF-7 and OSPF-8. All you need is to configure the interfaces with OSPF, which we have done. I see that the tunnel.2 is on area0 and eth1/2.1 is on area x. Likewise, we dont need redistribution of inter area routes. It is automatically done by OSPF

5) We dont have to resdistribute the connected routes into OSPF. The participating interfaces would advertise their network addresses,and also the networks reachable on them into OSPF by default.

6) When you mean you can reach the tunnel subnet, I see that you are attempting to reach networks on the remote lan. Can you verify if the routing is configured correctly on the remote end routers.

7) After having verified all these steps, if we still cannot get it to work, please open a case with us.

Thanks and best regards,

Karthik RP

Hi,

thanks for the check list. Now we got OSPF. But not completely:

ospf-works.jpg

You see, the cisco router and the "OSPF Router" at the same network as the PA gets the OSPF information. But the PA (or OSPF Router - vendor Cisco) do not forward the OSPF information to e.g. LAN B (we have several subnets).

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!