Queries on OSPF Route Summarization

[Purushotham]

Customer have configured OSPF peering with firewall and switches.

Have multiple OSPF peering with different ZONEs via each sub interfaces. Currently we are receiving around 4k routes at DCE-ES for each peering. Since ES switch hardware not supporting that much routing entries, we need to do summarization for those routes.

Need to know how to do route-summarization in OSPF on Palo-Alto firewall as our downstream cisco switch is having host-limitation with maximum entries in routing table which caused high CPU in switch.

• Advertising – Palo Alto
• Exhaustion- Cisco Switch (routing table full)
• BFD- None

Queries:

• How can we summarize the advertise-routes in OSPF in PA FW ?
• If we create a new area (area-1), does it impact to the existing production area-0 function ?
• If we add OSPF interfaces in above new area(area-1) and summarize the routes in that area under range, does it impact to the existing area-0 routing ?
• If we advertise default-route in that area-1 under range towards that assigned new interface only, does it advertise to other interfaces as well and is there any impact from it ?
• If we create new area in addition to the area-0, is there any impact to the CPU, memory or other resources of the device 

[seb_rupik · Accepted solution]

Hi there,

I'll answer your questions in order:

• To summarise routes you must configure the PA as an ABR, to do this you must configure at least two areas (one area 0 and another area of your choosing). The PA must have OSPF enabled on at least one interface in each area.
• The only impact having another area configured on area 0 is the possible introduction of different LSA types, depending on the additional area type you have configured.
• Using summarisation and the range feature will only impact routing entries for that area. It will have no impact on Area 0.
• Not sure I quite understand this question, but the LSAs will only be sent via the interfaces enabled within the new area.
• I'd imagine there will be some additional resource consumption, but nothing that would impact performance.

cheers,

Seb.

[TomYoung]

Hi @seb_rupik ,

Thank you for your excellent response!  I wasn't sure where to begin with this question, and you nailed the answers with one minor exception.

With regard to your 3rd bullet, summarization will impact (decrease) the routing entries in area 0.  That is it's purpose.  Type 1, 2, and 7 LSAs are flooded within an area so that every area router has an identical LSDB.  Type 3,4, and 5 LSAs are flooded to area 0.

You can click on the dropdown in the upper right to edit your response if you like so that others don't have to read multiple response for this discussion.

Thanks,

Tom

[seb_rupik · Accepted solution]

@TomYoung , from reading the original post it would appear that @Purushotham wants to reduce the size of the routing table on the downsteam Cisco switch, therefore it is a range command on area 0 which will summarise the routes into area 1 that is required.

Having read it a second time, you are right, it is asking about the impact of summarisation towards area 0.

@Purushotham thinking a bit more about this it may make sense to set area 1 as a Totally Stub area, reducing the routing table to a singe default IA LSA in the area 1 LSDB.

cheers,

Seb.