OSPF Question

I know that with OSPF we only advertise locally attached networks on the network statement of the OSPF process. Is that right ? I have a situation recently where we made some changes by disabling one interface and move that network now to be behind a firewall. I use to have 3 network statements on my router as follows:
network 192.168.1.2 0.0.0.0 area 1
network 192.168.1.52 0.0.0.0 area 1
network 192.168.9.1 0.0.0.0 area 1
Now since I move 192.168.9.0/24 behind a firewall via 192.168.1.52 interface I have to implement static routes. Check out my drawing with the red dotted lines the interface that was disabled.
Is there a way we can still tell my cisco router to advertise 192.168.9.0/24 coming off 192.168.1.52 ?

BTW, here are my static routes that I have to add to make things work:
HQ router
ip route 192.168.9.0 255.255.255.0 192.168.1.2
ip route 192.168.43.0 255.255.255.0 192.168.1.2
remote site router (cisco 1841)
ip route 192.168.9.0 255.255.255.0 192.168.1.54
ip route 192.168.43.0 255.255.255.0 192.168.1.54

Similar Messages

Quick OSPF question

OK, I have two L3 switches running OSPF. One is in area 0 and area 120 (ABR) and the other is in area 120 but also redistributes connected and static subnets (making it an ASBR?). The ABR is configured with area 120 nssa no-summary and the other with area 120 nssa.
What I want to do is stop the ABR from advertising NSSA external type 2 routes to the ASBR as basically I want this switch to just have a default route (it doesn't need to know anything else as it only has one physical route out).
Is this possible? I'm getting myself mixed up thinking about it.

Hi,
Okay, I get the point. So, basically you want your ASBR to ignore the external routes redistributed by your ABR (which is also an ASBR but let's keep the distinction) while all other routers in the area should see them.
I believe that this is a use case for distribute lists on the ASBR - filter out the routes entering the routing table based on some additional criteria. Can you please check if the IOS on the ASBR supports the distribute-list route-map route-map-name in command in the OSPF process configuration? If it does then the solution should be relatively easy to implement. On the ABR, redistribute the routes into OSPF with a specific tag value, say, 123. The tag value can be specified in the redistribute command using the tag tag-value keyword. On the ASBR, use the following construct:
route-map FilterOSPF deny 10
match tag 123
match route-type nssa-external
route-map FilterOSPF permit 20
router ospf 1
distribute-list route-map FilterOSPF in
In OSPF, you cannot prevent LSA7 from being flooded throughout the NSSA area or from being processed at an arbitrary router. What you can do is only to prevent routes described by these LSA7 from entering the routing table, and this is what is accomplished by this.
Feel free to use the tag value and the name of the route-map as you see fit. Avoid the tag value 0 as that is the default tag value.
Best regards,
Peter

OSPF Area Addition - Design Question

Hello,
I have a design question regarding OSPF. I am looking to add a new ospf area (1). The area will live on two Core routers and two Distribution routers. Can you please look at the attached Pics and tell me which design is better.
I would like to be able to connect Core-01 to Dist-01 and Core-02 to Dist-02 with a connection between Dist-01 and Dist-02, but this will result in a discontiguous area, correct?
Thanks,
Lee

I would say that the more common design is to have just backbone area links between the core routers. But there is no real issue with having an area 1 link between them...
If I were you, I would not make the area a totally NSSA. Here are my reasons for that:
- you will get sub-optimal routing out of the area since you have two ABRs and each distribution router will pick the closest one of them to get out to the backbone even though it may be more optimal to use the other one
- in an NSSA case, one of the two ABRs will be designated as the NSSA translator, which means that if you are doing summarisation on the ABRs, all traffic destined for these summarised routes will be drawn to the area through that one ABR.
Paresh

Question about OSPF to BGP redistribution

I have some static routes on a router where OSPF and BGP are also running. I have redistributed the static routes into OSPF (showing in OSPF database). I also want to have the static routes into the BGP routing table. Understand this can be done by using a prefix list permiting all the static routes, however I was thinking a simpler way just redistributing whatever is in the OSPF routing tabel into BGP (permit 0.0.0.0/0 le 32).
My question is if OSPF really redistributes those routes. Those routes are shown as "static" in "sh ip route" even though they are also in OSPF database. I have heard that OSPF only redistributes the routes showing as "OSPF routes", not what's in its database.
Thanks for any help.
Gary

Hi Gary,
The thing to understand here is that the use of redistribution does not change anything in the routing table of the router on which you are configuring it.
As you have observed, static routes do not become OSPF routes when you redistribute them into OSPF. This can be generalised to the following: when you redistribute protoclol1 into protocol2, the router will scan the routing table for routes installed by protocol1 and will then do one of the following, depending on the protocol it is being redistributed into:
- if it is a Link state protocol like OSPF, it will originate LSAs appropriate to the route being redistributed. These LSAs will be subsequently flooded to other routers which will install them as routes in their routing table. The only change on the redistributing router is the installation of additional LSAs; the routing table does not change
- if it is a distance vector protocol like IGRP, the router will take the protocol1 routes and advertise them via IGRP update packets every time an update packet is sent. Once again, there is no change on the routing table of the redistributing router.
Note the other important point: when redistributing is carried out, the only routes that are redistributed are those that are in the routing table and installed there by the source protocol, which could be quite different to the contents of link-state databases.
Hope that helps.
Pls remember to rate posts.
Paresh.

OSPF configuration question

I am studying for my CCNA exam and I'm not sure if this is the right forum but here's my question:
What is the difference between these 2 configurations:
1. router ospf 1
network 192.168.0.1 0.0.0.0 area 0
network 192.168.1.1 0.0.0.0 area 0
2. router ospf 1
network 192.168.0.1 0.0.0.255 area 0
network 192.168.1.1 0.0.0.255 area 0
I know we're applying the wildcard mask after the network but I just need some examples of when you would use one or the other.

Both options will work if 192.168.0.1 & 192.168.1.1 are IP addresses of interfaces on the router. The inverse mask is there to limit (or expand) the interfaces OSPF runs on and what gets advertised. For example if you had the following:
interface 1 192.168.0.1/26
interface 2 192.168.0.65/26
interface 3 192.168.0.129/26
interface 4 192.168.0.193/26
Then you could control individually ospf on each interface with the commands:
router ospf 1
network 192.168.0.1 0.0.0.0 area 0
network 192.168.0.66 0.0.0.0 area 0
network 192.168.0.129 0.0.0.0 area 0
network 192.168.0.193 0.0.0.0 area 0
(You could also make the interfaces be in different areas by changing the 'area')
If you didn't need the flexibility and just wanted all the interfaces to be in area 0 then configuring the following will accomplish this as the inverse mask covers all the interface addresses:
router ospf 1
network 192.168.0.0 0.0.0.255 area 0
I generally try to add interface addresses individually (with 0.0.0.0 inverse masks). On Distribution switches though where you are terminating a lot of access vlans/subnets it is good practise to make these subnets contiguous and use a wildcard in the inverse mask. That way the configuration is kept simpler (smaller).
Whatever the inverse mask of the network command is there is no difference in how OSPF advertises the networks though; i.e. if an interface has a /30 mask the network LSA will be /30 (unless of course you are summarising with network range commands).
HTH
Andy

Question about network statement in OSPF and BGP

The network statements in OSPF and BGP can be used to advertise networks. But I'm not clear under what circumstances would make more sense to use network statements to advertise a network than by using other methods to have the network learned by other routers.
Here is an example: assume I'm running BGP on router A. I want to advertise network 10.1.1.0/24 to other BGP peers. I have a OSPF route for this network. I can do 2 things: one is to use "network 10.1.1.0 mask 255.255.255.0", the other is to do "redistribute OSPF ... route-map OSPF-INTO-BGP", and create a prefix list to permit 10.1.1.0/24.
Both would work to have this network learned by other BGP peers. But which is better for what purpose?
Thanks a lot
Gary

Hi Gary,
There is one little difference between the use of the two approaches - the route injected into BGP by using a network statement will carry an Origin attribute of IGP, whereas the route injected using redistribution will have an Origin attribute of Incomplete. Now, that is not a huge issue since you can always change that whatever value you desire both with the use of the network statement and redistribution. The important thing, however, is that in the BGP best path selection process, the Origin attribute comparison is fairly high up and will prefer a route with the attribute of IGP.
Apart from that, there is absolutely no difference between using the network statement and using redistribution with a route-map that matches exactly on the same route that you would have specified with the network statement.
I guess one advantage of using the redistribute approach is that it does not clutter up the BGP config. If you wish to add more routes, you simply add them to the prefix list so that you don't really touch the BGP config portion at all..
Hope that helps - pls do remember to rate posts that help.
Paresh

Pix OSPF load balancing question

I have a pix 515e with two default routes, learned via OSPF from two routers on the "outside" interface.
Currently router#2 is being preferred way much more than router#1. There are many thousands of destinations for the traffic. These two routers are further doing NAT to nat rfc1918 ip's to the internet (the pix is NOT doing nat)
Can someone please let me know how the PIX does load balancing? is it by IP address destination? is it something else?
thanks,
Joe

Per TAC:
"the PIX will do per-destination Load Balancing instead of per packet
load balancing. The algorithm will look at the source and destination
addresses. It does not do 1:1 load balancing. Given enough different
source and destination addresses, the packets will more or less reach a
50/50 spit between the two next-hops. However, in real world testing
with the same source and destination addresses, it may not reach an even
load balancing."

Multi-areas in OSPF routing questions

Hi Guys,
I currently have 2 x L3 switches, one is for area 0 and the other one is for area 5 and they're connected to each other. Since there are only 2 VLANs on each switch, I'd like to replace both of them with a better switch but unsure about the areas routing on the same L3 switch. Please let me know what your thoughts are.
Switch A is connected to switch B thru interface g1/0/1 with ip address: 10.10.10.1/26
I'm currently using ospf and here is the configure of switch A:
router ospf 1
network 172.20.1.1 0.0.0.0 area 0
network 172.21.1.1 0.0.0.0 area 0
network 10.10.10.1 0.0.0.0 area 5
And this is OSPF routing configure of switch B:
router ospf 1
network 192.168.1.1 0.0.0.0 area 5
network 10.10.10.2 0.0.0.0 area 5
I'd assume the new switch C is the replacement of switch A & B. And here is my routing configuration of switch C:
router ospf 1
network 172.20.1.1 0.0.0.0 area 0
network 172.21.1.1 0.0.0.0 area 0
network 10.10.10.1 0.0.0.0 area 0
network 192.168.1.1 0.0.0.0 area 5
network 10.10.10.2 0.0.0.0 area 5
Is this going to work and/or best cisco practices? if not please advise. Thanks.

Hi,
Since you are replacing 2 switches with 1, now you don't need the transit subnet (10.10.10.1/26) between the 2 switches any more. What will the new switch connect to? Is the new switch going to peer with any other device? If it is a stand alone switch, why do you even need 2 OSPF areas or even need OSPF all together?
HTH

DMVPN Design Question - EIGRP or OSPF

Hi,
We are in the process of designing a DMVPN network, which will be used as a backup (over the Internet) to our MPLS WAN Network. Currently we are using EIGRP at central and remote site.
If I select EIGRP as also the routing protocol for the DMVPN, then EIGRP will consider the MPLS WAN Routes as External (Since they are being redistributed through BGP from MPLS Core into our internal Core) and then DMVPN Routes will be preferred over MPLS WAN Routes. Is this understanding correct ?
How can i correct this problem ? Using the 'distance eigrp ...' command ?
Is there any advantage using OSPF as the routing protocol in DMVPN ? This won't solve the above problem but are there any inherent advantages of OSPF over EIGRP in DMVPN Design ?
We have around 18 Sites that will be connected with no Spoke-Spoke functionality required.
Thanks,
Naman

You really cannot use EIGRP effectively over the WAN. I was managing a 500 node DMVPN with a a redundant 6509 core. The results were unbelievable. The 1811's hanging off of the cores through the DMVPN's were crazy. Every time a change occurred, if one router lost its VPN connection, the EIGRP protocol would broadcast the changes to all of the cloud, meaning to all 499 EIGRP participants would have to be notified of the change. This was HUGE. OSPF has better NBMBA environments that you would use. Personally, you wouldn't have a choice. Using EIGRP with DMVPN's that are over 50 nodes are practically impossible. I did work around the issue and stabilized the network but knowing what I know now, definately OSPF.

OSPF Point to Point network question

I just have a quesiton about the linkstate database. I have a point-to-point link between a couple routers(makes sense) and when I look at the database for the lsa type 1, it shows the router has 2 links in the area and one is a stub. I don't under stand how thats possible.
            OSPF Router with ID (4.4.4.4) (Process ID 1)
                Router Link States (Area 1)
LS age: 1136
Options: (No TOS-capability, DC)
LS Type: Router Links
Link State ID: 4.4.4.4
Advertising Router: 4.4.4.4
LS Seq Number: 80000007
Checksum: 0xC738
Length: 60
Number of Links: 3
    Link connected to: another Router (point-to-point)
     (Link ID) Neighboring Router ID: 1.1.1.1
     (Link Data) Router Interface address: 192.168.41.2
      Number of TOS metrics: 0
       TOS 0 Metrics: 10
    Link connected to: a Stub Network
     (Link ID) Network/subnet number: 192.168.41.0
     (Link Data) Network Mask: 255.255.255.0
      Number of TOS metrics: 0
       TOS 0 Metrics: 10
Can anyone explain to me what I'm seeing here? Thanks

Full config
hostname R4
boot-start-marker
boot-end-marker
no aaa new-model
memory-size iomem 5
no ip icmp rate-limit unreachable
ip cef
no ip domain lookup
multilink bundle-name authenticated
archive
log config
hidekeys
ip tcp synwait-time 5
interface FastEthernet0/0
ip address 192.168.104.1 255.255.255.0
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 dallas
ip ospf 1 area 1
duplex auto
speed auto
interface FastEthernet0/1
ip address 192.168.41.2 255.255.255.0
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 dallas
ip ospf 1 area 1
duplex auto
speed auto
router ospf 1
router-id 4.4.4.4
log-adjacency-changes
ip forward-protocol nd
no ip http server
no ip http secure-server
control-plane
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
end
R4#

Question a bout Ospf & eigrp

Guys,
I would like to have more over view to the following:-
1- what is the exact functionality of (DR/BDR) on ospf tobology.
2- what is the point of using (auto-summary) command on eigrp, and when we should use it?
3- also I am alittle bit confused about using Ospf ABR type 3 LSA filtering with different areas, when should be applied?Is any difference between configuring normal OSPF comparing To ABR, what should I consider when configuring Type 3 ABR?
Thanks

Hi,
1. One of the major reasons for the DR/BDR concept is to reduce unnecessary flooding. If there wasn't such a concept, each router on a LAN would have to have an adjacency with every other router on a LAN. For example, on a LAN with 10 routers, that would mean 45 adjacencies !! Using a DR/BDR, that same LAN now has only 17 adjacencies. Now, OSPF floods LSAs over adjacencies so the more of those you have, the greater the flooding traffic. And most of this would have been unnecessary since the routers would have already seen the LSAs from some other neighbor.
2. This feature was more of a using in the days of classful routing, where you would not have wanted more specific routes of a classful network from leaking out of that network. These days, it is disabled by default and it should be kept that way !
3. One application of this is when using stub (not totally) areas with multiple ABRs. In such a case, you could filter out some type-3 LSAs from being generated by one of the ABRs. The other ABR would still advertise them and so all traffic for these networks would exit out of this ABR. The ABR on which you did the filtering would still advertise the type-3 default so if the other ABR dies, all traffic will now exit out of this ABR.
Pls do remember to rate the post..
Paresh

OSPF 'ip ospf mtu-ignore' Question

Hey Guys,
If I have a router with 3 sub interfaces off of a GigabitEthernet interface which is directly connected to a switch via a trunk, would I need to set 'ip ospf mtu-ignore'?
I'm assuming that if I'm running subinterfaces using dot1q, that the mtu in the DBD packets will be 1504 and which it hits either a router port on a L3 switch or a SVI it would be 1500?

Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
John the router's subinterface and the switch's trunk should "hide" the VLAN tags. I.e. there shouldn't be any need for mtu-ignore (as least I never recall a need for it on such configurations).

Adding VLAN to Po-Group and OSPF routing what is the correct way?

Hi Community,
I recently had an issue that brought down the links between a couple of switches...luckily this was done after hours and I did not save the config so was able to revert back.
The basic scope of my project is:
We are running out of IP's on the 192.168.1.0/24 sunbnet so wanted to create a seperate VLAN/Subnet for physical workstations.
He is what I orginally did;
1) On our core switch; (Switch1)
     Create the VLAN,
     VLAN interface,
     DHCP pool,
     excluded address'
2) On second switch (Switch 2)
     Add VLAN name, no interface
3) I then updated the PO-group on Switch1 with new VLAN (this brought down the link before I was able to finish my config)
    Therefore I was not able to complete the following:
          add vlan to spanning-tree or updated OSPF routing
Here is what I assume to be the correct order?
1) On Core Switch (Switch 1)
     Create VLAN
     VLAN interface
     DHCP pool
     excluded address'
     add vlan to spanning-tree
     add vlan (passive interface) and sunbet to OSPF routing
2) On Switch 2
     Add vlan name/interfaces with no ip
3) Update PO groups after the above has been configured
     Add new VLAN to Po-Group on Switch 2
     Add new VLAN to Po-Group on Switch 1
4) Last steps
     Updated specific access ports with new VLAN and test
     upon completion of testing, update all other access ports connected ot workstations with new VLAN
Questions:
Did my links go down because I added new VLAN to Po-group BEFORE updating spanning-tree and OSPF routing?
Can anyone verify the order as outlined in the section "Here is what I assume to be the correct order"

So the order in which to apply TASKS is correct?
also just to clarify the following TASK based on your comments.
Step 4- Add new VLANs to OSPF as passive interface
On Switch 1 (core)
We have this line of code
router ospf 100
router-id 192.168.1.10
log-adjacency-changes
passive-interface Vlan10
passive-interface Vlan30
passive-interface Vlan50
passive-interface Vlan500
network 192.168.0.2 0.0.0.0 area 0
network 192.168.1.10 0.0.0.0 area 0
network 192.168.30.254 0.0.0.0 area 0
network 192.168.33.254 0.0.0.0 area 0
network 192.168.51.254 0.0.0.0 area 0
network 192.168.99.5 0.0.0.0 area 0
network 192.168.200.254 0.0.0.0 area 0
TASK: OSPF - Add new VLANs(40 & 41) to OSPF as Passive Interface
******* Begin Here *********
config t
router ospf 100
passive-interface vlan40
passive-interface vlan41
!WE SHOULD ADD THIS LINE OF CODE
network 192.168.40.254 0.0.0.0 area 0
network 192.168.41.254 0.0.0.0 area 0
******* End Here *********
RESULT:
router ospf 100
router-id 192.168.1.10
log-adjacency-changes
passive-interface Vlan10
passive-interface Vlan30
passive-interface Vlan40
passive-interface Vlan41
passive-interface Vlan50
passive-interface Vlan500
network 192.168.0.2 0.0.0.0 area 0
network 192.168.1.10 0.0.0.0 area 0
network 192.168.30.254 0.0.0.0 area 0
network 192.168.33.254 0.0.0.0 area 0
network 192.168.40.254 0.0.0.0 area 0
network 192.168.41.254 0.0.0.0 area 0
network 192.168.51.254 0.0.0.0 area 0
network 192.168.99.5 0.0.0.0 area 0
network 192.168.200.254 0.0.0.0 area 0
Better??
Again thanks...your feedback have been a tremendous help!

Hi all, need advice on OSPF and private vlans

Hi all.
I have a project to complete and need some help on the possible solution I can use.
Basically we have ospf area 0 and the users in question are in ospf area 7 and is a stub.
I need to route the traffic from these users out through area 0 through 3 core devices, onto an external firewall interface to be placed onto the vpn that sits on it. The firewall is not included in the ospf domain.
My thinking was that the firewall has a default route back into the ospf domain so dont need to worry about traffic coming in, however my job is to segregate these users and take them out of our core network and place them onto an external network via this vpn.
Not sure how to achieve this apart from static routing redistributed but surely this does not seperate their traffic only points the route to ospf?!
I was thinking I might have to use private vlans or policy routing but when I try policy routing the policy gets ignored due to normal forwarding.
Any help and advice would be greatly appreciated.
Cheers
Steve

Steve
Thanks, that helps.
GRE is defintely out because apart from the 6500 GRE tunneling is not supported on the Cisco switches.
It's good that area 7 is only for these users and not mixed up with other users.
So if i understand correcty the 4500 interface connecting to the 6500 is in area 0 and the interface connecting to the 3550 is in area.
Or is the 3550 connected to both areas and the 4500 totally in area 0 ?
Can you confirm the above ?
In terms of keeping them separate there are 2 possible choices. You can either -
1) use VRF-LIte, although i'm not sure whether the HP switch would support this. With VRF-Lite you are in effect creating virtual devices on the same physical device. This means each virtual device has it's own routing and forwarding table so it is quite secure because you would only populate the routing table with the routes needed so there would be no way for users to jump to thes rest of your networks.
The downside is that is can become quite complex to configure. If the 4500 is only used to connect are 7 to area 0 then that would not be a problem but the connection from the 6500 to the HP could and i don't even know whether the HP supports VRF-Lite functionality let alone how to configure it on that switch.
But it would, at least from the 4500 to 6500 to HP provide complete separation in terms of routing and forwarding. Once it got to the HP it wouldn't but that might not be an issue.
2) Use PBR (possibly together with acls). This is easier to configure ie. you configure PBR on the 4500 and the 6500 to get the traffic to the HP switch. But you do not get the actual separation you get with VRF-Lite ie. the traffic simply overrides the existing routing tables.
The other thing to bear in mind with PBR is that you also have to configure the return traffic as well so each device would need multiple PBR configs.
Again i don't know whether the HP supports PBR but it may not be an issue depending on what the routing is on the HP.
You could also use a combination of the above ie VRF-Lite between the Cisco switches and then PBR for the last hop to the HP device.
I should say i don't have a huge amount of experience with VRF-Lite but that should not necessarily stop you using it if it is what you need. There are lots of other people on here so i'm sure there will be other people who can help if i can't.
It still depends on how much separation is required. VRF-Lite is definitely seen as a way to separate traffic running across a shared infrastructure, PBR is not really seen in the same way. So it may well be worth going back to find out exactly what "segregating" user traffic means.
I don't want to confuse the issue but it's still not entirely clear what the actual requirement is.
Jon

Cisco outdoor AP 1300 - OSPF multicast traffic

Hi everybody,
I have a basic question but i really do not know the answer.
So,
I want to know if i can talk OSPF through a wireless connection formed by 2 cisco aironet 1300?
I mean i am not sure if the access point is going to pass the OSPF's multicast traffic.
best regards

Duplicate post.
I'm posting my response to your other post.

OSPF Question

Similar Messages

Maybe you are looking for