4

Networking community,

I was hoping someone might be able to provide me with some assistance in configuring one of my routers. Diagram below:

enter image description here

Current configuration: The PfSense firewall is configured to hand out addresses to the two networks above. The servers and the cluster of routers (There is a static address between the Router R1 and the firewall). The cluster of routers are all running OSPF. All of the routers communicate flawlessly. All of the routers from R2 beyond are in Area 0, and on R1, port 0/1 is in area 0 as well.

Note: I initially had OSPFquagga installed on the firewall, but have since removed that, as I do not want OSPF running on the firewall.

Problem: I am having trouble configuring R1 to take a static route and dynamically propagate that route through the OSPF network. Which would permit the cluster of routers to reach the WAN. I have set up R1 as an ASBR.

I initially had the ip route set to 0.0.0.0 0.0.0.0 interface...next hop, but read that those types of default routes are not propagated by OSPF/IS-IS)
http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/16448-default.html

I have referenced:

here

Configurations are as follows:

R1

    interface GigabitEthernet0/0
 ip address 192.168.30.150 255.255.255.0
 ip virtual-reassembly in
 duplex auto
 speed auto
 no cdp enable
!
interface GigabitEthernet0/1
 ip address 192.168.100.1 255.255.255.0
 ip ospf 10 area 0
 duplex auto
 speed auto
!         
router ospf 10
 redistribute static subnets
 network 192.168.100.0 0.0.0.255 area 0
 default-information originate always
!
ip forward-protocol nd
!
ip http server
no ip http secure-server
!
ip route 192.168.100.0 255.255.255.0 GigabitEthernet0/0 192.168.30.1

I feel like I am close, but would appreciate any suggestions. If it would be of any use, I can upload PCAP's, OSPF neighbor lists, IP routers, etc...

Appreciation in advance.

----Update-----

Issue: R1 not propagating static route to other OSPF neighbors.

R1

 interface GigabitEthernet0/0
 ip address 192.168.30.150 255.255.255.0
 ip virtual-reassembly in
 duplex auto
 speed auto
 no cdp enable
!
interface GigabitEthernet0/1
 ip address 192.168.100.1 255.255.255.0
 duplex auto
 speed auto
!
router ospf 10
 network 192.168.100.0 0.0.0.255 area 0
 default-information originate
!
ip forward-protocol nd
!
ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 192.168.30.1

show ip route brief and show ip ospf database

Gateway of last resort is 192.168.30.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 192.168.30.1, GigabitEthernet0/0
      10.0.0.0/29 is subnetted, 5 subnets

ospf database

OSPF Router with ID (192.168.100.5) (Process ID 10)

                Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
10.1.15.1       10.1.15.1       1958        0x800001DF 0x005A29 2
10.10.10.10     10.10.10.10     400         0x800000BF 0x005E4D 2
172.10.10.2     172.10.10.2     1453        0x800000DD 0x007EDC 5
192.168.100.5   192.168.100.5   1329        0x800000B5 0x00E84F 1
192.168.200.5   192.168.200.5   1963        0x800001E7 0x00412C 4

                Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
10.1.11.6       10.10.10.10     2400        0x8000008F 0x00BEC4
10.1.12.1       10.10.10.10     1400        0x8000008B 0x001403
10.1.21.2       10.1.15.1       1958        0x800000CD 0x00E177
10.1.22.2       192.168.200.5   1963        0x800000CE 0x00B412
10.1.31.2       192.168.200.5   1963        0x800000CD 0x00898D
192.168.100.2   172.10.10.2     1639        0x80000001 0x00DB36
192.168.200.6   192.168.225.254 1480        0x800000CE 0x00323D

                Type-5 AS External Link States

Link ID         ADV Router      Age         Seq#       Checksum Tag
0.0.0.0         192.168.100.5   1324        0x80000005 0x00ECE5 10

R2 show ip ospf database

    OSPF Router with ID (172.10.10.2) (Process ID 10)

                Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
10.1.15.1       10.1.15.1       341         0x800001E0 0x00582A 2
10.10.10.10     10.10.10.10     775         0x800000BF 0x005E4D 2
172.10.10.2     172.10.10.2     239         0x800000DE 0x00C568 4
192.168.100.5   192.168.100.5   1706        0x800000B5 0x00E84F 1
192.168.200.5   192.168.200.5   328         0x800001E8 0x003F2D 4


                Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
10.1.11.6       10.10.10.10     2776        0x8000008F 0x00BEC4
10.1.12.1       10.10.10.10     1776        0x8000008B 0x001403
10.1.21.2       10.1.15.1       342         0x800000CE 0x00DF78
10.1.22.2       192.168.200.5   328         0x800000CF 0x00B213
10.1.31.2       192.168.200.5   328         0x800000CE 0x00878E
192.168.100.2   172.10.10.2     2015        0x80000001 0x00DB36

                Type-5 AS External Link States

Link ID         ADV Router      Age         Seq#       Checksum Tag
0.0.0.0         192.168.100.5   1703        0x80000005 0x00ECE5 10

Updated

R1: Configuration

interface Loopback0
 ip address 10.1.1.1 255.255.255.255
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 ip address 192.168.30.150 255.255.255.0
 ip virtual-reassembly in
 duplex auto
 speed auto
 no cdp enable
!
interface GigabitEthernet0/1
 ip address 192.168.99.5 255.255.255.248
 duplex auto
 speed auto
!
router ospf 10
 redistribute static subnets
 passive-interface GigabitEthernet0/0
 network 192.168.99.4 0.0.0.3 area 0
 default-information originate
!
ip forward-protocol nd
!
ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 192.168.30.1

R1: Show Ip ospf database

         Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
10.1.1.1        10.1.1.1        920         0x80000003 0x00A2CD 1
172.10.10.2     172.10.10.2     921         0x80000003 0x004FB4 1

                Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
192.168.99.6    172.10.10.2     921         0x80000001 0x009A41

                Type-5 AS External Link States

Link ID         ADV Router      Age         Seq#       Checksum Tag
0.0.0.0         10.1.1.1        1041        0x80000001 0x006E2E 10

R2: Show ip ospf database

OSPF Router with ID (172.10.10.2) (Process ID 10)

                Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
10.1.1.1        10.1.1.1        1046        0x80000003 0x00A2CD 1
172.10.10.2     172.10.10.2     1045        0x80000003 0x004FB4 1

                Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
192.168.99.6    172.10.10.2     1045        0x80000001 0x009A41

                Type-5 AS External Link States

Link ID         ADV Router      Age         Seq#       Checksum Tag
0.0.0.0         10.1.1.1        1166        0x80000001 0x006E2E 10
  • R1: eth0/0: 192.168.30.150/24
  • R1: eth0/1: 192.168.99.5/29 --> R2
  • R2: eth1/0/1: 192.168.99.6/29
  • R2: eth1/0/2: 10.1.11.6/29 --> R3: 10.1.11.5
  • R2: eth1/0/4: 10.1.21.1/29 --> R4: 10.1.21.2
  • R2: eth1/0/3: 10.1.31.1/29 --> R5: 10.1.31.2
  • Are you wanting to inject a default route (0.0.0.0 0.0.0.0) into OSPF? I'm not sure where you read that OSPF will not propagate that, but that is incorrect. Your default-information originate always is doing exactly that. – Ron Maupin Jul 5 '16 at 0:46
  • Don't you need to say redistribute static under OSPF config mode? – Ron Royston Jul 5 '16 at 22:00
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 7 '17 at 19:40
3

If I read correctly, you want all the routers to send traffic without a specific route through R1 to the firewall. This is where you would use a default route:

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 <firewall lan address>

With that static route in place, you can use:

default-information originate

Only use this command on R1, not the other routers. This command will inject the default route, 0.0.0.0 0.0.0.0, into OSPF as long as the default route exists in the routing table of R1.

The command you have, default-information originate always will unconditionally inject the default route into OSPF. This will get the traffic to R1, but unless R1 has a default route, or specific routes for all the routes on the Internet, this really won't do you much good. You can use this command, but you should also have a default route in R1 to tell R1 to send traffic for routes about which it does know to the firewall.

Edit:

Based on the discussion on Chat, your firewall has no way to know where to send traffic destined for any networks behind R1. This is because you have removed OSPF from it. You will either need to set up static routes on the firewall for all the LAN networks, or you will need to re-enable OSPF on the firewall.

  • Ron, thank you for your help. I have made the appropriate corrections to R1 in addition to updating the question and providing additional information. However, it does not seem that the default route is propagating appropriately. As the other routers still cannot ping out. Do you have any suggestions? Thank you again! – dynamicruss Jul 5 '16 at 17:13
  • @dynamicruss, what router has the address of 192.168.100.5? That router is advertising a default route. Only R1 should have, and advertise, a default route. – Ron Maupin Jul 5 '16 at 17:15
  • Ron, I have gone back and reset the R1 and R2. R1 now has the router ID (10.1.1.1.1). The Link ID is 0.0.0.0 under Type-5 external Link states which appears on both R1 and R2. However, R2 is still unable to ping the LAN interface of the firewall. – dynamicruss Jul 5 '16 at 21:18
  • Whichever router has that ID is redistributing the default route into OSPF. Your drawing has no address information, and you have provided minimal configuration information for the routers, so it is really impossible to tell you where to look. You need to track down which router is 10.1.1.1, and see why it is advertising the default route. – Ron Maupin Jul 5 '16 at 23:02
  • Apologies, I forgot to click the 'commit changes' which added the updates above. R1: eth 0/0: 192.168.30.150/24, 0/1: 192.168.99.5/29. R2: eth 1/0/1: 192.168.99.6/29, 1/0/2 - 1/0/4 currently disabled. – dynamicruss Jul 6 '16 at 0:16
1

Does the firewall have a route back to Router1 for the other subnets in the network?

When pinging the firewall interface are the failures time-outs or unreachables, if unreachables, what type of unreachables are they?

  • Skilvakt, I re-enabled the route from PFsense to R1's Eth0/1 address of: 192.168.99.0/29. This made it so R2 was able to ping out successfully. So, now R1 can, (It has the static IP route of 0.0.0.0 0.0.0.0 int ge0/0 192.168.30.1 and R2 can both ping the WAN. However, none of the other routers are able to ping the WAN address. If the firewall tries to ping any of the routers attached to R2 and when any of the other routers, R3-R5 ping, it just times out. – dynamicruss Jul 6 '16 at 0:50
  • Can I see R2s ip route table and config? – Skiltvakt Jul 6 '16 at 1:18
  • The routes and configurations are posted for R2. – dynamicruss Jul 6 '16 at 1:32
  • R2 doesn't need default-information originate. Can I see the ip route tables of the other 3 routers? – Skiltvakt Jul 6 '16 at 1:42
  • R3 (Juniper) and R4 are posted. – dynamicruss Jul 6 '16 at 2:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.