enter image description hereNetwork:

R1, (loopback
R2, (loopback

ASA (active),
ASA (passive),

R1 has two bgp transit upstreams. R2 and R1 has iBGP so R2 can route via R1. R2 will, after ospf is confirmed working, get one of the transit upstreams. Both R1 and R2 now has a static route for to (asa).

Do I have to divide the /21 subnet into smaller areas, or can it, in its whole, be part of area 0 (if so, I don't understand how R1 or R2 would know to reach everything on the /21 by routing to the asa).

Divide the /21

area 0

area 1

OR, have the network as a whole in area 0?

area 0
  • 2
    A few thoughts... first, it would help if you gave us a diagram of your proposed addressing between R1, R2, and the ASAs. Next, loopback netmasks must not overlap with other loopback netmasks (i.e instead of you should use Finally, there seems to be a basic misunderstanding of what ospf network statements do; they don't limit what addresses you can receive in an LSA... network statements map a local router interface to an OSPF Area number... however, once an interface has an adjacent neighbor on that interface, you can learn any network from a valid LSA – Mike Pennington Oct 22 '13 at 18:51
  • I realized I had confused the loopback addresses with the link net addresses. They all sit in the same /29, while the loopback addresses obviously reside outside of this range. Hope this clarifies. – 3molo Oct 22 '13 at 19:41
  • 1
    I'm on the cusp of providing my own answer; however, it would really help to get a big picture description (or better still a cloud-level diagram) of what you're trying to do from a business perspective with the ASAs and the routers. The business-level diagram would help us understand how all these pieces might fit together, as well as other constraints you could be dealing with – Mike Pennington Oct 23 '13 at 11:02
  • 1
    Uploaded an image, not sure if that helps at all. Now R1 and R2 both have the entire /21 as a static route via asa. I'd like to have it more dynamically, so if R2 loses contact with asa it would instead send traffic bound for asa via R1, and not continue to send it to what it cant reach. – 3molo Oct 23 '13 at 11:53
  • Thank you! I need to run to work, but I will respond after work tonight unless someone covers my thoughts first – Mike Pennington Oct 23 '13 at 12:18

Like Mike said (in the comments) the network command will search for interfaces within that range and start advertising through it. It will also take the subnet of that interface and advertise it into OSPF. A cleaner way of looking at it that now a days instead of giving the network command you can go into an interface and add it to the OSPF proccess. This in turn does the same as the network command (find interface - advertise it)

If you say /24 or /21 doesn´t matter it's just a wider scope for OSPF to search for the interface.

Now back to your issue, the /21 won´t be advertised unless you have an interface as /21 and are advertising it in OSPF. What you could do is a static route (pointing to null0) on the ASA and redistribute it into OSPF (redistribute static subnets). Other methods like summary address are only available in ABR and ASBR (OSPF Border routers). Or you could, if applicable inject a default route in OSPF at the ASA.

The area part totally depends on your setup but if we are only talking OSPF within routers and ASA we can safely assume that one Area 0 will suffice. Try not to get mixed up with areas and networks here. Without going into to much detail and explinations of area and LSA just remember the golden rule, every area has to connect to the center (area 0), and area 0 can not be discontiguous.

Also remember if you want to redistribute iBGP into OSPF you need to allow it within BGP with "bgp redistribute-internal".

Based on your information i hope this is what you where looking for.


| improve this answer | |
  • On the ASA I would simply add each sub interface (in the hundreds) to the ospf process? All I really need is to not have to use static routes on the routers to the asa, and on the asa towards the routers, in order to be able to lose one of the routers without sending traffic there. – 3molo Oct 23 '13 at 7:38
  • You can add one network command that covers these interfaces, which will add those interfaces to the OSPF and advertise the networks to the OSPF, or like a said create a null0 route on the ASA box and redistribute that into OSPF. And on the routers you add those networks/interfaces to the OSPF. – Gustav Haraldsson Oct 23 '13 at 9:41
  • ASA can't null route, to my knowledge. At least not to a null device. Can you elaborate on it further? – 3molo Oct 23 '13 at 11:14
  • Yeah sorry, you would need to route it to your next router behind and do tha null routing there. But i guess that won´t work in your scenario. Thus i think you need to include the networks that you want to advertise from the ASA to the OSPF or keep the static routes on the two Routers pointing it to the active ASA ip. You can still advertise the router IP's to OSPF. – Gustav Haraldsson Oct 23 '13 at 12:07
  • Can I on the routers 'default-information originate always' to give a default route to the asa? In that case asa will know how to reach out even if one of R1 or R2 are dead. Secondly, regarding including the networks I want to advertise, do you mean by simply configure each of the ASAs subinterfaces to be a part of the ospf process and thus it will announce them to R1 and R2? – 3molo Oct 23 '13 at 12:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.