OSPF passive interfaces question

cancel
Showing results for 
Search instead for 
Did you mean: 

OSPF passive interfaces question

L4 Transporter

What is best practice to advertise connected networks on a single VR where you have OSPF running and neighboring on an Internal Firewall  interface to router, and want to advertise multiple segmented/firewalled networks directly attached the same firewall?

Is it best to mark the segmented networks as Passive ospf interfaces, and allow OSPF to advertise these networks to internal router

 

Are there any risks of rogue routers/devices  that could be installed on a segmented section and send updates to the passive OSPF interface on the firewall?  A passive OSPF interface won't accept incoming advertisements because an adjacency isn't established iirc.  But there aren't any risks I'm missing on this are there?

 

Citing below link for background information:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXsCAK

3 REPLIES 3

L3 Networker

I'd mark as passive any interface that should not form OSPF adjacences, to avoid route hijacking (either by rogue or misconfigured devices). Not sure if that's a "unviersal enough" thing to be named a "best practice", though. Authenticating OSPF can also mitigate the same problem, esp. if some of your links transit on somebody else's network or if some of your devices need to offer Anycast services and are mixed with others which should not take part in OSPF (e.g. a DNS server member of an Anycast pool on the same subnet with regular servers).

OSPF authentication is a good idea, but something we are not doing as of yet.   There isn't any way for an opsf passive interface to accept any inputs or ingest routes from the passive link I'm thinking?

Cyber Elite
Cyber Elite

Hello,

Another option is to utilize metrics. Allow the adjacencies to form and then apply metrics to the routes to that are less favorable.

Cheers!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!