4

I drew a diagram for the network to make it easy to understand my network issue.

enter image description here

  1. Site B,C and D communicate through MPLS and in case of failover they communicate through VPN tunnels.
  2. Site X communicate with Site B,C and D through MPLS only.
  3. Site A is a new site which has a firewall and P2P -EPL to SITE B.

I configured Site A so that traffic to Sites B, C, D, and X go through P2P and in case of failover it goes to Firewall.

Case 1: (Traffic goes through P2P)

OSPF is enabled (L3 switch) in (Site A), so all networks of (site A) will be advertised and see all other sites through MPLS. >>>> No issues and works like a charm!

Case 2: (Failover to Firewall)

In case of P2P is down, OSPF will not take an effect and traffic from Site A to Sites B, C, and D will go through Firewall, Site X will not be visible to Site A.

Solution: Since OSPF is enabled in Sites B, C and D with redistribute subnets, I added a static route for site A in each of the three sites and point it to the firewall for each site. Now site X can see site A. Awesome!!!

Case3: (Fall back to P2P)

Here is my issue, when P2P goes up OSPF in site A will take an effect again, and all static routes that I added for site A in all of the other sites will take an effect and point traffic to FW.

Solution 1: Remove static routes manually (which doesn’t make sense)

Solution 2: Keep the static routes but add AD to each route higher than OSPF AD, let’s say 200.

In this case if P2P is up OSPF (110) < 200, OSPF will win

If P2P is down Static 1<200 , Static will win and traffic will go through firewalls.

For some reason solution 2 worked only in Site B and didn’t work on Site C or D!!!!

I checked the configurations in Sites B, C, and D, and I found that Sites C and D has this extra command which was added by the previous network engineer

redistribute static route-map STATIC>OSPF

Why do you think solution 2 didn’t work on Sites C or D?

Your help and suggestions are much appreciated.

Improve this question
4
  • What about Solution 3 where you run OSPF across the firewall link with a higher cost than across the point-to-point link? That would be an automatic failover and fall back.
    – Ron Maupin ♦
    Commented Oct 17, 2017 at 21:41
  • Do you mean adding static routes in site A ? for example
    – m.alkishawi
    Commented Oct 17, 2017 at 22:03
  • No, my comment is about not using static routes at all.
    – Ron Maupin ♦
    Commented Oct 17, 2017 at 22:16
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Feb 21, 2018 at 16:36

2 Answers 2

Reset to default
2

The problem is that you are redistributing the static routes into OSPF, where they get the OSPF AD. At that point, it is the OSPF cost that dictates the where the traffic gets routed. The OSPF cost to the ASBR is smaller than the accumulated costs across the MPLS cloud and point-to-point link. Look at what is listed in the routing table on one of the sites that doesn't work.

You really need to be careful about removing the redistribution because it may be in place for something else. You could also change the route map to exclude redistribution of the static networks to Site A. You should investigate the redistribution because redistribution is an ugly solution, and you may be able to eliminate it altogether.

Alternatively, and I think more cleanly, you should be able to run OSPF across your VPNs, but assign those links higher costs than OSPF across the MPLS cloud. That would let OSPF dynamically change the routes to the lowest cost path that is up.

Improve this answer
0

We had a similar setup mpls and site to site vpns via firewall. When our mpls went down we used Cisco IOS IP SLA functionality to automatically add/remove the required route statements.

Improve this answer
12
  • Can you please explain more ? How did you use SLAs to add/remove static routes ?
    – m.alkishawi
    Commented Oct 17, 2017 at 22:05
  • Sure, I should have also mentioned in combination with Policy Based Routing PBR.
    – ssedwards
    Commented Oct 17, 2017 at 22:12
  • Sure, I should have also mentioned in combination with Policy Based Routing PBR. Basically, the IP SLA has the ability to monitor/track objects such as ip addresses/reliability. When used with PBR you can force the traffic to take a different route. So in our example..... Ah ha wait there.... We did the opposite... When the internet went down we told the traffic to use the MPLS. But when the MPLS went down, the routes where no longer in the routing table and used the default route and thus over the Site to Sites... So my questions are.... Add a static route for site A at site X TBC
    – ssedwards
    Commented Oct 17, 2017 at 22:21
  • Instead of at sites B,C,D. 2, What is the default route at sites B,C,D, if you lose connection to Site A over the MPLS why aren't the routes being cleared at Sites B, C, D and the default route kicking in?
    – ssedwards
    Commented Oct 17, 2017 at 22:23
  • I don't have access to site X , I only manage site A,B,C and D
    – m.alkishawi
    Commented Oct 17, 2017 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.