2

In a Level 3 network with multiple, isolated (i.e. firewalled) VLANs, how does OSPF interact with the VLANs?

Specifically:

  1. Is it standard to use multiple OSPF instances, i.e. one per VLAN?
  2. If the VLANs have the same topology, can a single OSPF instance be used?
Improve this question
2
  • 1
    What do you mean by "independent?" If there are L3 interfaces (SVI) on the VLANs, they are treated like any other router interface for OSPF.
    – Ron Trunk
    Commented Feb 17, 2015 at 21:07
  • @Ron, I mean there is to be no traffic passing from one VLAN to another. They are "firewalled" from each other in the strongest sense.
    – Chris Merck
    Commented Feb 18, 2015 at 1:34

1 Answer 1

Reset to default
1
  1. Is it standard to use multiple OSPF instances, i.e. one per (isolated) VLAN?

This is a standard approach, only so far as you're using MPLS VPN and/or vrf-lite to isolate your vlan routing information; read more about OSPF in the context of MPLS VPN and VRF-lite here.

One of the main reasons for using multiple OSPF instances is for controlling LSA flooding (that assumes you couldn't otherwise control LSA distribution)Note 1.

  1. If the VLANs have the same topology, can a single OSPF instance be used?

In cases where you don't have to isolate vlans for security purposes, a single OSPF instance can and should be used. Most of the time, you should avoid multiple OSPF instances. Some exceptions:

  • When your vlans are assigned to different customers use MPLS VPN (which uses BGP as the underlying control-plane)
  • When you are trying to filter LSAs (as noted above)

Note 1As an aside, I personally dislike the whole concept of filtering OSPF LSAs; address summarization is perfectly normal... blocking an LSA that should otherwise be flooded makes things more complicated to troubleshoot. OSPF loves to flood LSAs; in many cases people who are (ab)using OSPF for route/LSA control should be offload the work to a protocol which was designed for controlling routes (such as iBGP).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.