Trouble inserting static route into OSPF ASBR

Question

Networking community,

I was hoping someone might be able to provide me with some assistance in configuring one of my routers. Diagram below:

Current configuration: The PfSense firewall is configured to hand out addresses to the two networks above. The servers and the cluster of routers (There is a static address between the Router R1 and the firewall). The cluster of routers are all running OSPF. All of the routers communicate flawlessly. All of the routers from R2 beyond are in Area 0, and on R1, port 0/1 is in area 0 as well.

Note: I initially had OSPFquagga installed on the firewall, but have since removed that, as I do not want OSPF running on the firewall.

Problem: I am having trouble configuring R1 to take a static route and dynamically propagate that route through the OSPF network. Which would permit the cluster of routers to reach the WAN. I have set up R1 as an ASBR.

I initially had the ip route set to 0.0.0.0 0.0.0.0 interface...next hop, but read that those types of default routes are not propagated by OSPF/IS-IS)
http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/16448-default.html

I have referenced:

• http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/13692-21.html
• http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/7039-1.html#t32
• http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_ospf/configuration/12-4t/iro-12-4t-book/iro-cfg.html#GUID-4AABEB56-2125-488B-B5A4-A5650F3159BB

here

Configurations are as follows:

R1

    interface GigabitEthernet0/0
 ip address 192.168.30.150 255.255.255.0
 ip virtual-reassembly in
 duplex auto
 speed auto
 no cdp enable
!
interface GigabitEthernet0/1
 ip address 192.168.100.1 255.255.255.0
 ip ospf 10 area 0
 duplex auto
 speed auto
!         
router ospf 10
 redistribute static subnets
 network 192.168.100.0 0.0.0.255 area 0
 default-information originate always
!
ip forward-protocol nd
!
ip http server
no ip http secure-server
!
ip route 192.168.100.0 255.255.255.0 GigabitEthernet0/0 192.168.30.1

I feel like I am close, but would appreciate any suggestions. If it would be of any use, I can upload PCAP's, OSPF neighbor lists, IP routers, etc...

Appreciation in advance.

----Update-----

Issue: R1 not propagating static route to other OSPF neighbors.

R1

 interface GigabitEthernet0/0
 ip address 192.168.30.150 255.255.255.0
 ip virtual-reassembly in
 duplex auto
 speed auto
 no cdp enable
!
interface GigabitEthernet0/1
 ip address 192.168.100.1 255.255.255.0
 duplex auto
 speed auto
!
router ospf 10
 network 192.168.100.0 0.0.0.255 area 0
 default-information originate
!
ip forward-protocol nd
!
ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 192.168.30.1

show ip route brief and show ip ospf database

Gateway of last resort is 192.168.30.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 192.168.30.1, GigabitEthernet0/0
      10.0.0.0/29 is subnetted, 5 subnets

ospf database

OSPF Router with ID (192.168.100.5) (Process ID 10)

                Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
10.1.15.1       10.1.15.1       1958        0x800001DF 0x005A29 2
10.10.10.10     10.10.10.10     400         0x800000BF 0x005E4D 2
172.10.10.2     172.10.10.2     1453        0x800000DD 0x007EDC 5
192.168.100.5   192.168.100.5   1329        0x800000B5 0x00E84F 1
192.168.200.5   192.168.200.5   1963        0x800001E7 0x00412C 4

                Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
10.1.11.6       10.10.10.10     2400        0x8000008F 0x00BEC4
10.1.12.1       10.10.10.10     1400        0x8000008B 0x001403
10.1.21.2       10.1.15.1       1958        0x800000CD 0x00E177
10.1.22.2       192.168.200.5   1963        0x800000CE 0x00B412
10.1.31.2       192.168.200.5   1963        0x800000CD 0x00898D
192.168.100.2   172.10.10.2     1639        0x80000001 0x00DB36
192.168.200.6   192.168.225.254 1480        0x800000CE 0x00323D

                Type-5 AS External Link States

Link ID         ADV Router      Age         Seq#       Checksum Tag
0.0.0.0         192.168.100.5   1324        0x80000005 0x00ECE5 10

R2 show ip ospf database

    OSPF Router with ID (172.10.10.2) (Process ID 10)

                Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
10.1.15.1       10.1.15.1       341         0x800001E0 0x00582A 2
10.10.10.10     10.10.10.10     775         0x800000BF 0x005E4D 2
172.10.10.2     172.10.10.2     239         0x800000DE 0x00C568 4
192.168.100.5   192.168.100.5   1706        0x800000B5 0x00E84F 1
192.168.200.5   192.168.200.5   328         0x800001E8 0x003F2D 4


                Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
10.1.11.6       10.10.10.10     2776        0x8000008F 0x00BEC4
10.1.12.1       10.10.10.10     1776        0x8000008B 0x001403
10.1.21.2       10.1.15.1       342         0x800000CE 0x00DF78
10.1.22.2       192.168.200.5   328         0x800000CF 0x00B213
10.1.31.2       192.168.200.5   328         0x800000CE 0x00878E
192.168.100.2   172.10.10.2     2015        0x80000001 0x00DB36

                Type-5 AS External Link States

Link ID         ADV Router      Age         Seq#       Checksum Tag
0.0.0.0         192.168.100.5   1703        0x80000005 0x00ECE5 10

Updated

R1: Configuration

interface Loopback0
 ip address 10.1.1.1 255.255.255.255
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 ip address 192.168.30.150 255.255.255.0
 ip virtual-reassembly in
 duplex auto
 speed auto
 no cdp enable
!
interface GigabitEthernet0/1
 ip address 192.168.99.5 255.255.255.248
 duplex auto
 speed auto
!
router ospf 10
 redistribute static subnets
 passive-interface GigabitEthernet0/0
 network 192.168.99.4 0.0.0.3 area 0
 default-information originate
!
ip forward-protocol nd
!
ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 192.168.30.1

R1: Show Ip ospf database

         Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
10.1.1.1        10.1.1.1        920         0x80000003 0x00A2CD 1
172.10.10.2     172.10.10.2     921         0x80000003 0x004FB4 1

                Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
192.168.99.6    172.10.10.2     921         0x80000001 0x009A41

                Type-5 AS External Link States

Link ID         ADV Router      Age         Seq#       Checksum Tag
0.0.0.0         10.1.1.1        1041        0x80000001 0x006E2E 10

R2: Show ip ospf database

OSPF Router with ID (172.10.10.2) (Process ID 10)

                Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
10.1.1.1        10.1.1.1        1046        0x80000003 0x00A2CD 1
172.10.10.2     172.10.10.2     1045        0x80000003 0x004FB4 1

                Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
192.168.99.6    172.10.10.2     1045        0x80000001 0x009A41

                Type-5 AS External Link States

Link ID         ADV Router      Age         Seq#       Checksum Tag
0.0.0.0         10.1.1.1        1166        0x80000001 0x006E2E 10

• R1: eth0/0: 192.168.30.150/24
• R1: eth0/1: 192.168.99.5/29 --> R2
• R2: eth1/0/1: 192.168.99.6/29
• R2: eth1/0/2: 10.1.11.6/29 --> R3: 10.1.11.5
• R2: eth1/0/4: 10.1.21.1/29 --> R4: 10.1.21.2
• R2: eth1/0/3: 10.1.31.1/29 --> R5: 10.1.31.2

Answer 1

If I read correctly, you want all the routers to send traffic without a specific route through R1 to the firewall. This is where you would use a default route:

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 <firewall lan address>

With that static route in place, you can use:

default-information originate

Only use this command on R1, not the other routers. This command will inject the default route, 0.0.0.0 0.0.0.0, into OSPF as long as the default route exists in the routing table of R1.

The command you have, default-information originate always will unconditionally inject the default route into OSPF. This will get the traffic to R1, but unless R1 has a default route, or specific routes for all the routes on the Internet, this really won't do you much good. You can use this command, but you should also have a default route in R1 to tell R1 to send traffic for routes about which it does know to the firewall.

Edit:

Based on the discussion on Chat, your firewall has no way to know where to send traffic destined for any networks behind R1. This is because you have removed OSPF from it. You will either need to set up static routes on the firewall for all the LAN networks, or you will need to re-enable OSPF on the firewall.

Answer 2

Does the firewall have a route back to Router1 for the other subnets in the network?

When pinging the firewall interface are the failures time-outs or unreachables, if unreachables, what type of unreachables are they?