My network. https://imgur.com/a/5QI1NNq

enter image description here

So my question is, on the 3 yellow above. Sub networks, I've used static routing, but on the other side of the internet (blue field) I've used Ospfv2. on the purple, green, yellow and the servers part.

I do know that you should not use OSPF through firewall / internet. I do not know why. I don't know if I use GRE (the general encapsulation).

Is it correct if I say it like this "An ospf network with intermittent links can increase traffic every time a router sends information. This lack of scalerbility in ospf which makes it unsituable for routing across internet?

In general: I do not know why I should not use Ospf through internet / firewall.

I would also like to know, why sub networks prefer static routing:


In general: I do not know why I should not use Ospf through internet / firewall.

There are exceptions, but generally speaking, if the traffic is untrusted, then routing is untrusted. In other words, if I'm on the untrusted side of the firewall, presumably you want to filter my traffic to make sure I don't send malicious traffic.

If that's the case, then why would you trust my routing information? I could send you bad routes, spoof networks, or blackhole traffic. OSPF assumes routing sources are trusted, but here, this is not the case.

Is it correct if I say it like this "An ospf network with intermittent links can increase traffic every time a router sends information. This lack of scaleability in ospf which makes it unsuitable for routing across internet?

This may have been a concern 25 years ago when bandwidth was very limited, but network speeds are so much greater now that the amount of OSPF traffic, relative to available bandwidth, is trivial.

It's also true that maintaining state tables, flooding updates and calculating shortest paths would not work at Internet scale. OSPF requires too much processing and too much memory for that. Moreover, the Internet topology does not fit very well into OSPFs area hierarchy.

But the real reason is because OSPF assumes the best path to a destination is the lowest cost (highest bandwidth) path. On the Internet between different organizations, this is not true. Paths are chosen for other reasons such as monetary cost, peering agreements, or other administrative reasons. OSPF doesn't let you control routing in that way. BGP gives you much more administrative control over what routes (prefixes) you advertise, what ones you accept from others, and how you evaluate the preferred ones.

  • but it is correct to use static routing, in the sub network right? – Lilly Nov 21 '19 at 3:30
  • what if autentication SHA is been added? would it be the same answer you provided – Lilly Nov 21 '19 at 3:54
  • Yes. Authentication only proves it's really me sending routes. I can still send you bad routes. – Ron Trunk Nov 21 '19 at 13:10

I have production experience with redundant ASAs in routed mode using both static and OSPF routing, but not in a VPN configuration.

A pair of ASAs running static routing can fail over almost immediately, including syncing their socket state table. It is hard for a user to notice the failover.

But OSPF does not execute HA failover in an ASA pair. The passive ASA has no OSPF neighbors. When the failover occurs you will suffer a ~30 second network outage until OSPF neighbors reestablish.

In your case that network hit might also impact your VPN tunnels (although I don’t have experience with that). The lack of routing on the backup ASA also makes monitoring and maintenance of that box...inconvenient.

In my network designs “edge” ASAs usually used static routing, because the static routing was easy to configure. I sometimes used OSPF for “Chokepoint” ASAs because manually setting up the static routes was unmaintainable. Fortunately, ASA failovers are infrequent enough that I was able to (temporarily) accept the occasional network hit.

An alternative for the chokepoint ASA situation is to deploy the ASA pair as a layer-2 firewall, running OSPF between the routers on either side. Quick HA failover restored!

EDIT: it is also true that ASAs are missing some of the more “esoteric” OSPF features and configuration options. Let your real routers be your designated routers and keep your OSPF configuration simple around the ASAs. ASAs are also vulnerable to CPU spikes due to traffic: if those traffic-caused CPU spikes cause an OSPF neighbor reset you are going to have a bad day. Static routing is more reliable, if the topology is simple enough to make it maintainable.

  • Hmm, thank you so much! interesting – Lilly Nov 21 '19 at 3:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.