1

We have a scenario where a customer is having a managed L3VPN installed and would like to run OSPF internally. The issue is that the provider will not allow us to provide and manage the CE device and they will only use BGP as the CE-PE protocol. They've told us that we can run OSPF internally and form a neighbourship between our L3 switch and their managed CE. They will then redistribute the routes into BGP and in turn, advertise those routes to their PE.

That doesn't seem like a valid design to me. That means at each site we'll need to run an instance of OSPF in area 0 and as far as OSPF is concerned every site will be a different autonomous system, right? Due to the BGP in the middle (between managed CE - PE) the routes will be external OSPF routes and we wont be able to connect our area 0's together.

I think it will work for now but I imagine it will cause headaches in future if we try to scale or make the solution slightly more complicated. I think if we ever decided to have a backup leased line or VPN tunnel the LSA's would be type 2 and therefor a preferred path than the external routes caused by type 5 LSAs.

I know OSPF as a CE-PE protocol is valid and would essentially address all the concerns above but I think that option is probably off the table.

Are there any caveats/concerns with the solution above? Should we be pushing harder for the provider to run OSPF as the CE-PE protocol?

Improve this question
7
  • 1
    You may find that OSPF over WAN circuits can be problematic. It depends on how large your Area 0 gets, and how stable the WAN circuits are. This approach can cause every WAN router to reconverge OSPF every time there is a little hiccup on one link. BGP will stabilize your WAN.
    – Ron Maupin ♦
    Jul 26, 2016 at 16:19
  • Thanks Ron. I guess this is why the majority of SP's I've dealt with prefer BGP for CE-PE. Would we still suffer the same problem if we did not have an area 0 and used the MPLS as the 'superbackbone', with each site being its own area? I think this is a Cisco Validated Design (CVD) and would probably be the way I would do it if I had the choice.
    – Mark
    Jul 26, 2016 at 16:48
  • I don't think you would have the same problem. We use BGP and MPLS for site connections, and OSPF within the sites. Most sites have very few routers, so they are in a single OSPF area. The larger sites can have multiple OSPF areas. This eliminates the problem of flapping links or routers going down in one site from affecting all the other sites.
    – Ron Maupin ♦
    Jul 26, 2016 at 17:00
  • The question you need to answer is, "Does every site need to know about all the routes in every other site, or can I use a default route and let MPLS determine where to send the traffic?"
    – Ron Maupin ♦
    Jul 26, 2016 at 17:02
  • 1
    I think you missed the part about each site using a default route to get out of the site. The default route is injected into OSPF with the default-information originate command. Each site does have its own Area 0. OSPF at a site only knows about the routes at the site, and the default route to the MPLS cloud. This has proven to be a very stable arrangement. I don't know how many sites you have, but OSPF does have a practical limit on the number of routers in an area, and slow WAN links exacerbate convergence problems.
    – Ron Maupin ♦
    Jul 26, 2016 at 17:11

1 Answer 1

Reset to default
4

Yes, as you say backup links will cause an issue in the future unless you provider lets you run OPSF CE-PE and sets up some sham links.

One workaround would be to use GRE tunnels between sites and run OSPF over the tunnels. The tunnel endpoints would need to be advertised through BGP. The OSPF routes would arrive over the tunnel. This does lower you MTU though, which may cause issues and obviously there is work to configure this from your side. I would push for the provider to enable OSPF on the PE-CE

Improve this answer
3
  • Why would a GRE tunnel between sites solve this problem? Do you mean GRE tunnels from our L3 over to our other L3's at other sites? That would make the LSA's type 2 then and OSPF area 0 would be connected?
    – Mark
    Jul 26, 2016 at 11:26
  • That's the idea. You can use the tunnels as in-area links to extend area 0 out to all sites. As you say LSAs would then be type 1 or 2 instead of type 5. You could even split the network up into areas and use the tunnels as area 0, with the CE router summarising between area 0 and the site's area if the network is large enough to warrant multiple areas.
    – user27899
    Jul 26, 2016 at 12:18
  • Thanks Qualeboy, very helpful. That second part is genius! At least as far as workarounds go. We only have a few routers on each site, probably a maximum of 5 sites for now so single area should be fine. Unfortunately the provider has insisted BGP but has revealed that VPLS is an upcoming service they'll offer soon. I think in future if we stick with this provider we'll end up with VPLS and a leased line for redundancy.
    – Mark
    Jul 26, 2016 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.