How to inject OSPF information from PA to other OSPF-Routers

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

How to inject OSPF information from PA to other OSPF-Routers

L4 Transporter

Hello,

we created a IPSec tunnel between Cisco and PA:

overview.jpg

Now we have a problem to make the network behind the Cisco Router reachable from the Corporate LAN and the other way (from Corporate LAN to the "Cisco LAN"). Both routers running OSPF. With OSPF we want to make this networks reachable through the PA. The PA already gets the OSPF informations from both Routers and is able to inject the "connected" network (setting image ospf9.jpg) to the OSPF network. But the OSPF routing information itself not.

We need your help. Did we missed a configuration? How does it work?

Please take a look at the attached files... Thanks a lot.

10 REPLIES 10

L5 Sessionator

Try using the actual subnets (eg : 192.168.1.0/24)  in the Destination field instead of the interfaces (ospf-9)

Did the change like you said:

ospf-new1.jpg

But it doesn't work. Still able to reach the tunnel subnet but not the network behind the router.

L5 Sessionator

Hi Hithead,

I have some recommendations for you:

1) First of all, if you want to learn the routes via OSPF, then we  enable OSPF on the interfaces of the devices. We have OSPF configured on tunnel.2 and on eth1/2.1.  From the screenshots on OSPF-1 and OSPF-2, we can see that the PANFW is learning the routes 10.xx.0.0/26 through the tunnel.2 interface and the 192, the 172 and the 10 networks on the eth1/2.1 interface. You can increase the metric of the static routes to prefer the link state routes over the static routes.

2) I see that the OSPF routes are being learnt, but just to be sure, have an "any any" permitting policy for OSPF application.

3) on ospf-4, I see that the tunnel.2 is seen as a BDR. Tunnel interfaces are always point to point. Change the interface link type to "point-to-point" and also change it on the tunnel interface of the cisco router.

4) You dont redistribute an OSPF route into OSPF, like we have on the screenshots of OSPF-7 and OSPF-8. All you need is to configure the interfaces with OSPF, which we have done. I see that the tunnel.2 is on area0 and eth1/2.1 is on area x. Likewise, we dont need redistribution of inter area routes. It is automatically done by OSPF

5) We dont have to resdistribute the connected routes into OSPF. The participating interfaces would advertise their network addresses,and also the networks reachable on them into OSPF by default.

6) When you mean you can reach the tunnel subnet, I see that you are attempting to reach networks on the remote lan. Can you verify if the routing is configured correctly on the remote end routers.

7) After having verified all these steps, if we still cannot get it to work, please open a case with us.

Thanks and best regards,

Karthik RP

Hi,

thanks for the check list. Now we got OSPF. But not completely:

ospf-works.jpg

You see, the cisco router and the "OSPF Router" at the same network as the PA gets the OSPF information. But the PA (or OSPF Router - vendor Cisco) do not forward the OSPF information to e.g. LAN B (we have several subnets).

Hi...The OSPF router that connect to LANB is responsible for route advertisement to other OSPF neighbors in LANB.  Please check the configuration of the OSPF router and review its neighbor's stats.  Thanks.,

Can you verify if the interface on the router on LAN-B is not configured as a passive interface for OSPF, oe doenst have any wierd access list that is blocking the advertisement of the network? We can see that the PANFW is learning the routes via OSPF from its neighbours OSPF router and Cisco router. If its just one network, ie the LAN B, that the firewall isnt getting routing information for, we have to check the settings on the firewall on LAN B

Hi,

i guess its a Cisco Router problem. Have to test it. Will update this thread, when we found the issue. Thanks for your help...!

L4 Transporter

Hello,

finally we got the right configuration to inject OPSF information in our LAN from the remote station. I'd like to share you the configuration we did:

works3ospf.JPG

works2ospf.jpg

works1ospf.jpg

L4 Transporter

With this configuration we get this system message from the PA:

 

domain: 1

actionflags: 0x0

type: SYSTEM

subtype: routing

config_ver: 0

vsys:

eventid: routed-OSPF-neighbor-down

object: ROSEN_LAN

fmt: 0

id: 0

module: general

severity: high

opaque: OSPF adjacency with neighbor has gone down. interface ethernet1/XX,
neighbor router ID 10.XXXXXX, neighbor IP address 10.XXXXXX.

How can we fix or disable this message?

We cannot disable these messages, as they are notifications about OSPF state changes. If you are seeing these messages frequently, then it appears that the adjacency on eth1/xx is flapping, and can introduce instability in the OSPF domain.

1)  Verify if the Link itself is not flapping

2) Verify if there is no MTU mismatch on the interfaces ( If there is a mismatch in the interface MTU, the OSPF states wouldnt go beyond Exstart )

3) Ensure that you have a policy to permit OSPF for the zone on which eth1/xx is configured on

BR,

Karthik

  • 4989 Views
  • 10 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!