When a new path to an NSSA External (LSA type 7) route is brought up in the topology below, the existing path's cost to that route increments to exactly match the new path's cost. Therefore, both paths are entered into the routing table, which is NOT the desired behavior as it causes asymmetric routing. The asymmetrical traffic fails the inspection process on the ASA and we see the traffic being dropped.
I can increment the cost manually on an interface in the new path, and expected routing behavior is restored.
However, I don't understand WHY a preferable/lower cost path suddenly has it's metric increased when a separate path opens up...
Consider the following topology.
- All links are 1 Gig, and have an OSPF metric/cost of 10.
- Mutual route redistribution to/from BGP and OSPF is taking place on ASA1.
- Default route is being injected from BGP into OSPF Area 10 on ASA1.
- Link From ASA1 to R4 is currently shut.
ASA1 Routing table and config:
ASA1# show route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is 172.20.10.1 to network 0.0.0.0
B* 0.0.0.0 0.0.0.0 [20/0] via 172.20.10.1, 01:29:39
O IA 10.1.0.0 255.255.255.255 [110/21] via 10.3.5.1, 00:01:29, INSIDE-1
O IA 10.1.2.0 255.255.255.252 [110/30] via 10.3.5.1, 00:01:29, INSIDE-1
O IA 10.1.3.0 255.255.255.252 [110/20] via 10.3.5.1, 00:01:29, INSIDE-1
O IA 10.1.5.0 255.255.255.252 [110/84] via 10.3.5.1, 00:01:29, INSIDE-1
O IA 10.2.0.0 255.255.255.255 [110/21] via 10.3.5.1, 00:01:29, INSIDE-1
O IA 10.2.3.0 255.255.255.252 [110/20] via 10.3.5.1, 00:01:29, INSIDE-1
O 10.3.0.0 255.255.255.255 [110/11] via 10.3.5.1, 00:01:29, INSIDE-1
O 10.3.4.0 255.255.255.252 [110/20] via 10.3.5.1, 00:01:29, INSIDE-1
C 10.3.5.0 255.255.255.252 is directly connected, INSIDE-1
L 10.3.5.2 255.255.255.255 is directly connected, INSIDE-1
O 10.4.0.0 255.255.255.255 [110/21] via 10.3.5.1, 00:01:29, INSIDE-1
O 10.4.1.0 255.255.255.252 [110/30] via 10.3.5.1, 00:01:29, INSIDE-1
O 10.4.10.0 255.255.255.252 [110/84] via 10.3.5.1, 00:01:29, INSIDE-1
O 10.4.100.0 255.255.255.0 [110/30] via 10.3.5.1, 00:01:29, INSIDE-1
O 10.5.0.0 255.255.255.255 [110/85] via 10.3.5.1, 00:01:29, INSIDE-1
B 172.20.0.0 255.255.255.255 [20/0] via 172.20.10.1, 01:29:39
B 172.20.1.0 255.255.255.255 [20/0] via 172.20.10.1, 01:29:39
C 172.20.10.0 255.255.255.252 is directly connected, OUTSIDE
L 172.20.10.2 255.255.255.255 is directly connected, OUTSIDE
ASA1# show run router
router ospf 1
network 10.3.0.0 255.255.0.0 area 10
network 10.4.0.0 255.255.0.0 area 10
area 10 nssa default-information-originate metric 5 metric-type 1
log-adj-changes
redistribute bgp 65500 metric 5 metric-type 1 subnets
!
router bgp 65500
bgp log-neighbor-changes
address-family ipv4 unicast
neighbor 172.20.10.1 remote-as 65400
neighbor 172.20.10.1 activate
network 10.0.0.0
redistribute ospf 1
no auto-summary
no synchronization
exit-address-family
!
R3 Routing table and config:
R3#show ip route | exc Codes|^
Gateway of last resort is 10.3.5.2 to network 0.0.0.0
O*N1 0.0.0.0/0 [110/15] via 10.3.5.2, 00:15:05, Ethernet1/1
O 10.1.0.0/32 [110/11] via 10.1.3.1, 01:24:20, Ethernet0/1
O 10.1.2.0/30 [110/20] via 10.2.3.1, 01:24:30, Ethernet0/2
C 10.1.3.0/30 is directly connected, Ethernet0/1
L 10.1.3.2/32 is directly connected, Ethernet0/1
O 10.1.5.0/30 [110/74] via 10.1.3.1, 01:24:20, Ethernet0/1
O 10.2.0.0/32 [110/11] via 10.2.3.1, 01:24:30, Ethernet0/2
C 10.2.3.0/30 is directly connected, Ethernet0/2
L 10.2.3.2/32 is directly connected, Ethernet0/2
C 10.3.0.0/32 is directly connected, Loopback0
C 10.3.4.0/30 is directly connected, Ethernet1/0
L 10.3.4.1/32 is directly connected, Ethernet1/0
C 10.3.5.0/30 is directly connected, Ethernet1/1
L 10.3.5.1/32 is directly connected, Ethernet1/1
O 10.4.0.0/32 [110/11] via 10.3.4.2, 01:24:20, Ethernet1/0
O 10.4.1.0/30 [110/20] via 10.3.4.2, 01:16:08, Ethernet1/0
O 10.4.10.0/30 [110/74] via 10.3.4.2, 01:24:20, Ethernet1/0
O 10.4.100.0/24 [110/20] via 10.3.4.2, 01:24:20, Ethernet1/0
O 10.5.0.0/32 [110/75] via 10.3.4.2, 01:24:20, Ethernet1/0
O N1 172.20.0.0 [110/15] via 10.3.5.2, 00:15:05, Ethernet1/1
O N1 172.20.1.0 [110/15] via 10.3.5.2, 00:15:05, Ethernet1/1
R3#show run | sec ospf
router ospf 1
area 10 nssa
network 10.1.0.0 0.0.255.255 area 0
network 10.2.0.0 0.0.255.255 area 0
network 10.3.0.0 0.0.255.255 area 10
R4 routing table and config:
R4#show ip route | exc Codes|^
Gateway of last resort is 10.3.4.1 to network 0.0.0.0
O*N1 0.0.0.0/0 [110/25] via 10.3.4.1, 00:16:13, Ethernet1/0
O IA 10.1.0.0/32 [110/21] via 10.3.4.1, 01:25:28, Ethernet1/0
O IA 10.1.2.0/30 [110/30] via 10.3.4.1, 01:25:33, Ethernet1/0
O IA 10.1.3.0/30 [110/20] via 10.3.4.1, 01:25:33, Ethernet1/0
O IA 10.1.5.0/30 [110/84] via 10.3.4.1, 01:25:28, Ethernet1/0
O IA 10.2.0.0/32 [110/21] via 10.3.4.1, 01:25:33, Ethernet1/0
O IA 10.2.3.0/30 [110/20] via 10.3.4.1, 01:25:33, Ethernet1/0
O 10.3.0.0/32 [110/11] via 10.3.4.1, 01:25:33, Ethernet1/0
C 10.3.4.0/30 is directly connected, Ethernet1/0
L 10.3.4.2/32 is directly connected, Ethernet1/0
O 10.3.5.0/30 [110/20] via 10.3.4.1, 01:18:49, Ethernet1/0
C 10.4.0.0/32 is directly connected, Loopback0
C 10.4.1.0/30 is directly connected, Ethernet1/3
L 10.4.1.1/32 is directly connected, Ethernet1/3
C 10.4.10.0/30 is directly connected, Serial2/0
L 10.4.10.1/32 is directly connected, Serial2/0
C 10.4.100.0/24 is directly connected, Ethernet0/0
L 10.4.100.1/32 is directly connected, Ethernet0/0
O 10.5.0.0/32 [110/65] via 10.4.10.2, 01:26:10, Serial2/0
O N1 172.20.0.0 [110/25] via 10.3.4.1, 00:16:13, Ethernet1/0
O N1 172.20.1.0 [110/25] via 10.3.4.1, 00:16:13, Ethernet1/0
R4#show run | sec ospf
router ospf 1
area 10 nssa
network 10.3.0.0 0.0.255.255 area 10
network 10.4.0.0 0.0.255.255 area 10
The cost from R3 to 0.0.0.0/0 is 15, which is what I would expect:
- Snip from R3's route table:
O*N1 0.0.0.0/0 [110/15] via 10.3.5.2, 00:15:05, Ethernet1/1 - R3 to ASA1 is one hop, cost of 10.
- ASA1 is injecting the default route as a Type 1 metric, with a cost of 5.
Now, if I no shut the interface between ASA1 and R4 that cost from R3 to ASA1 increments.
No shut the interfaces from R4 to ASA1:
ASA1# conf t
ASA1(config)# int g0/2
ASA1(config-if)# show run int g0/2
!
interface GigabitEthernet0/2
shutdown
nameif INSIDE-2
security-level 100
ip address 10.4.1.2 255.255.255.252
ASA1(config-if)# no shut
R4 sees the neighborship establish, and now sees a default route with a cost of 15:
R4#
*Sep 10 18:42:27.746: %OSPF-5-ADJCHG: Process 1, Nbr 172.20.10.2 on Ethernet1/3 from LOADING to FULL, Loading Done
R4#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override
Gateway of last resort is 10.4.1.2 to network 0.0.0.0
O*N1 0.0.0.0/0 [110/15] via 10.4.1.2, 00:01:31, Ethernet1/3
10.0.0.0/8 is variably subnetted, 18 subnets, 3 masks
O IA 10.1.0.0/32 [110/21] via 10.3.4.1, 01:42:37, Ethernet1/0
O IA 10.1.2.0/30 [110/30] via 10.3.4.1, 01:42:42, Ethernet1/0
O IA 10.1.3.0/30 [110/20] via 10.3.4.1, 01:42:42, Ethernet1/0
O IA 10.1.5.0/30 [110/84] via 10.3.4.1, 01:42:37, Ethernet1/0
O IA 10.2.0.0/32 [110/21] via 10.3.4.1, 01:42:42, Ethernet1/0
O IA 10.2.3.0/30 [110/20] via 10.3.4.1, 01:42:42, Ethernet1/0
O 10.3.0.0/32 [110/11] via 10.3.4.1, 01:42:42, Ethernet1/0
C 10.3.4.0/30 is directly connected, Ethernet1/0
L 10.3.4.2/32 is directly connected, Ethernet1/0
O 10.3.5.0/30 [110/20] via 10.4.1.2, 00:01:31, Ethernet1/3
[110/20] via 10.3.4.1, 01:35:58, Ethernet1/0
C 10.4.0.0/32 is directly connected, Loopback0
C 10.4.1.0/30 is directly connected, Ethernet1/3
L 10.4.1.1/32 is directly connected, Ethernet1/3
C 10.4.10.0/30 is directly connected, Serial2/0
L 10.4.10.1/32 is directly connected, Serial2/0
C 10.4.100.0/24 is directly connected, Ethernet0/0
L 10.4.100.1/32 is directly connected, Ethernet0/0
O 10.5.0.0/32 [110/65] via 10.4.10.2, 01:43:19, Serial2/0
172.20.0.0/32 is subnetted, 2 subnets
O N1 172.20.0.0 [110/15] via 10.4.1.2, 00:01:31, Ethernet1/3
O N1 172.20.1.0 [110/15] via 10.4.1.2, 00:01:31, Ethernet1/3
R3 now sees the default route (and all other NSSA External/LSA Type 7 routes) with a cost of 25. EVEN the route directly to ASA1 which cost 15 just a moment ago!
R3#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override
Gateway of last resort is 10.3.5.2 to network 0.0.0.0
O*N1 0.0.0.0/0 [110/25] via 10.3.5.2, 00:03:16, Ethernet1/1
[110/25] via 10.3.4.2, 00:03:16, Ethernet1/0
10.0.0.0/8 is variably subnetted, 18 subnets, 3 masks
O 10.1.0.0/32 [110/11] via 10.1.3.1, 01:44:22, Ethernet0/1
O 10.1.2.0/30 [110/20] via 10.2.3.1, 01:44:32, Ethernet0/2
[110/20] via 10.1.3.1, 01:44:22, Ethernet0/1
C 10.1.3.0/30 is directly connected, Ethernet0/1
L 10.1.3.2/32 is directly connected, Ethernet0/1
O 10.1.5.0/30 [110/74] via 10.1.3.1, 01:44:22, Ethernet0/1
O 10.2.0.0/32 [110/11] via 10.2.3.1, 01:44:32, Ethernet0/2
C 10.2.3.0/30 is directly connected, Ethernet0/2
L 10.2.3.2/32 is directly connected, Ethernet0/2
C 10.3.0.0/32 is directly connected, Loopback0
C 10.3.4.0/30 is directly connected, Ethernet1/0
L 10.3.4.1/32 is directly connected, Ethernet1/0
C 10.3.5.0/30 is directly connected, Ethernet1/1
L 10.3.5.1/32 is directly connected, Ethernet1/1
O 10.4.0.0/32 [110/11] via 10.3.4.2, 01:44:22, Ethernet1/0
O 10.4.1.0/30 [110/20] via 10.3.5.2, 00:03:16, Ethernet1/1
[110/20] via 10.3.4.2, 01:36:10, Ethernet1/0
O 10.4.10.0/30 [110/74] via 10.3.4.2, 01:44:22, Ethernet1/0
O 10.4.100.0/24 [110/20] via 10.3.4.2, 01:44:22, Ethernet1/0
O 10.5.0.0/32 [110/75] via 10.3.4.2, 01:44:22, Ethernet1/0
172.20.0.0/32 is subnetted, 2 subnets
O N1 172.20.0.0 [110/25] via 10.3.5.2, 00:03:16, Ethernet1/1
[110/25] via 10.3.4.2, 00:03:16, Ethernet1/0
O N1 172.20.1.0 [110/25] via 10.3.5.2, 00:03:16, Ethernet1/1
[110/25] via 10.3.4.2, 00:03:16, Ethernet1/0
As I said above, I can force the traffic over to my preferred path (R3 to ASA1) by manually setting the cost on R4's link to ASA1 higher:
R4#show run int eth1/3
Building configuration...
Current configuration : 90 bytes
!
interface Ethernet1/3
description ASA1-Gi0/2
ip address 10.4.1.1 255.255.255.252
end
R4#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R4(config)#int eth1/3
R4(config-if)#ip ospf cost 20
Now R3 sees the cost to 0.0.0.0/0 via R4 at 35, and drops it from the route table in favor of it's direct path to ASA1.
BUT it doesn't decrement the cost back to 15!
R3#show ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
Known via "ospf 1", distance 110, metric 25, candidate default path, type NSSA extern 1
Last update from 10.3.5.2 on Ethernet1/1, 00:09:23 ago
Routing Descriptor Blocks:
* 10.3.5.2, from 172.20.10.2, 00:09:23 ago, via Ethernet1/1
Route metric is 25, traffic share count is 1
Finally, I can shutdown the link between R4 and ASA1 again, and the cost between R3 and ASA1 decrements back to 15.
ASA1# show run int g0/2
!
interface GigabitEthernet0/2
nameif INSIDE-2
security-level 100
ip address 10.4.1.2 255.255.255.252
ASA1# conf t
ASA1(config)# int g0/2
ASA1(config-if)# shut
Voila...
R3#show ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
Known via "ospf 1", distance 110, metric 15, candidate default path, type NSSA extern 1
Last update from 10.3.5.2 on Ethernet1/1, 00:00:49 ago
Routing Descriptor Blocks:
* 10.3.5.2, from 172.20.10.2, 00:00:49 ago, via Ethernet1/1
Route metric is 15, traffic share count is 1
____ __ ____ __ __ ____ ____ __ ______
\ \ / \ / / | | | | \ \ / / | | | \
\ \/ \/ / | |__| | \ \/ / | | `----) |
\ / | __ | \_ _/ | | / /
\ /\ / | | | | | | |__| |__|
\__/ \__/ |__| |__| |__| (__) __
(__)
