What is best practice to advertise connected networks on a single VR where you have OSPF running and neighboring on an Internal Firewall interface to router, and want to advertise multiple segmented/firewalled networks directly attached the same firewall?
Is it best to mark the segmented networks as Passive ospf interfaces, and allow OSPF to advertise these networks to internal router
Are there any risks of rogue routers/devices that could be installed on a segmented section and send updates to the passive OSPF interface on the firewall? A passive OSPF interface won't accept incoming advertisements because an adjacency isn't established iirc. But there aren't any risks I'm missing on this are there?
Citing below link for background information:
I'd mark as passive any interface that should not form OSPF adjacences, to avoid route hijacking (either by rogue or misconfigured devices). Not sure if that's a "unviersal enough" thing to be named a "best practice", though. Authenticating OSPF can also mitigate the same problem, esp. if some of your links transit on somebody else's network or if some of your devices need to offer Anycast services and are mixed with others which should not take part in OSPF (e.g. a DNS server member of an Anycast pool on the same subnet with regular servers).
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!