OSPF over IPSec VPN Tunnel

I thought it was just like configuring any device for OSPF, however I was wrong

Actually your wrong, dynamic-routing  over ipsec-tunnel is like any other interface. In fact the OSPF proc has no ideal it's a vpn-tunnel interface vrs a vlan802.1q vrs phy.

Outside of many  setting a address over the tunnel and the ospf-type of tunnel it's absolutely has the same feel of a ethernet interface.

Ken

gilbertog wrote:

Hello.

 

I'm having a trouble setting up OSPF over IPSec in the network of my company.

 

We actually have created VPN tunnels between each branch office. This tunnels are in a simple configuration with static routes working well. We want to configure OSPF over this tunnels for, in a future, establish a dynamic full mesh topology.

 

I thought it was just like configuring any device for OSPF, however I was wrong. I need to know what Networks in the OSPF web based manager means. Let me explained. I thought I should establish there the networks i want to broadcast OSPF files by, so it would be the public network IP. I did this but it didn't work. Then, I put the IP intern network and neither work. I've already configure Interfaces (the tunnel interfaces) and established to redistribute connected networks and static ones. I'm getting crazy. If you know something, everything can help.

 

Thanks a lot.

Hi there,

1. Routing-based IPSEC is always recommended for later dynamic routing configuration. Try to avoid policy-based IPSEC in this situation.  So, make sure your IPSEC configuration is under "config vpn ipsec phase1-interface".

2. After your IPSEC tunnel is built up, go to the tunnel interface (the same name as your phase1-interface), config 32-bit local and remote IP address.

3. OSPF should be running on these tunnel interface. Once you configured the interface, the network type would be set to "point-to-point" automatically.

4. After you finished your OSPF configuration, please check if the interface is running OSPF first, by "get router info ospf interface", you should see the tunnel interface is in the list.

Hi Gilbertog,

I think i have exactly same settings in my company and its working like charm. My scenario is like this. I have configured site-to-site vpn on public interface(WAN interface) with my Head office and Branch office. When I first created VPN tunnels in 5.6.2 in GUI then in the Network-->Interface section automatically tunnels interface created. After that I changed that tunnel interface and put my own VPN tunnel private ip address on the tunnel interface. Then in the Networ-->OSPF section in GUI I did the following:

Area section: Area=0.0.0.0 TYpe=Regular Authentication= "As per your need"

Networks section: Click new network and put the VPN tunnel network which automatically created after creating VPN tunnels and put area 0.

Interface section: Click "Create New" then Put any name for Name portion. In the interface section select the VPN tunnels name when you created the tunnel during VPN tunnel creation. In the IP section you will put the VPN tunnel Interface IP (for me I put private IP) which you put in the Network-->Interface section. It must match otherwise it will show error. The use authentication as per your need and Put cost. The cost will be based on your requirements and the priority of your VPN tunnels. You can keep Hello and Dead interval intact.

After doing that you VPN tunnel should come up. One think you need to remember that if you are crating VPN tunnel with other vendor like cisco then you may face the problem with tunnels. In my case ospf adjacency did not came up because of mtu value. in that case you need to adjust MTU value to bring the tunnel up. 

Thanks.

Hi Gilbertog,

I can share you some documentations to configure OSPF over dynamic IPSec VPN

For your problem of "what Networks in the OSPF web based manager means" (Advanced inter-area Network)

Then I can not help you if I don't have your topology and the troubleshooting commands, please provide them if it is possible. 

So if I understand, you want, in a future, to replace your static routes and replace them by OSPF to configure dynamically your route table for each Fortigate. 

But in my view you are going to get some problem because if you build a full mesh topology under OSPF over IPSec you are going to generate lots of control traffic which will be not scalable, and not efficient.

 I can suggest you an other way to configure dynamically your full mesh topology under IPSec. It is better to use this topology, ADVPN hub-and-spoke (KB links). This one allows a traditional hub and spoke VPN’s spokes to establish dynamic, on-demand direct tunnels between each other so as to avoid routing through the topology’s hub device (useful link 3 and 4).

Be careful: ADVPN run under BGP,  (i.e : you have to abandon OSPF and re-create your configuration under BGP).

I hope my help has been useful.