How to redistribute virtual IP into ospf?

[journeyman]

Hi All, Sorry for the long explanation... Our existing fgt 60C 4.0mr1 has OSPF configured and we currently redistribute only some connected networks using access-list and routemap. We want to add a virtual IP range and redistribute it into OSPF. One of the WANs has a static IP range we need to reach. Due to an address conflict with our internal network*, we have previously used virtual IP and borrowed a part of an existing connected network. This works fine (the connected network is redistributed). We now need to expand the size of the virtual IP and would prefer to move it onto an unused network. * it' s complicated The proposed virtual IP side of things is configured and that is working fine with the new range. This has been tested on a LAN client with a temprorary static route added to bypass the OSPF on the LAN. The only issue is how to redistribute the virtual IP network into OSPF. The WAN is reached either via a static route (backup path) or bgp (primary path). The VIP configuration prefers the bgp route if present and falls back to the static route. My test area does not have the bgp link. BGP is not redistributed at this stage (see * above). When I tried to redistribute the virtual IP range using redistribute static (hoping the VIP link between the real and virtual ranges would give good karma), this did not work. Is the solution as simple as creating a connected network to contain the virtual IP range? If so, is there a loopback interface I can use? A null route perhaps? Are there better solutions? I' d prefer to use the most elegant solution (other than re-addressing, not possible). I admit to some confusion on this and any suggestions will be gratefully received. I' ve tried to summarise the system below stated two different ways, happy to post more explicit details. Desired outcome: A client on 192.168.10.0/24 on internal1 can reach 192.168.20.0/22 via wan1 or wan2 thinking it is 172.16.200.0/22. Stated a diffferent way: OSPF redistributes 172.16.200.0/22 into LAN (192.168.10.0/24) on internal1 WAN network is 192.168.20.0/22, reachable (a) static via wan1 or bgp via wan2 VIP *was* a small range say 192.168.20.200-249 onto 172.16.20.200-249 (connected on a vlan interface) VIP *to become* the full range 192.168.20.0/22 onto 172.16.200.0/22 Without the OSPF redistribution, 172.16.200.0/22 does not need to exist on the fgt outside the VIP definition. How to redistribute the VIP address range? As mentioned, suggestions most welcome.

[red_adair]

put a static route towards the VIP and announce that route. Or try to bind the VIP to a LO interface and announce that along with a /32 IP. -R.

[journeyman]

thanks for the suggestions, although I' ve not had time to try. one thing, what do you mean by LO interface?

[Jan_Scholten]

Loopback Interface

[journeyman]

Just posting the working config for completeness; although it' s been a while, I' ve only recently got back to this. I made the static route a blackhole route and everything is fine from there. It would appear that you can' t assign a loopback as the interface of a VIP configuration (4.0 MR3) although this was how I thought it would work. Final config: 1. Declare a VIP on the interface facing the clients who need to see the fake addresses. Declare the starting fake address and the required real destination range. 2. Create a policy from source (client) interface to the actual outbound (server) interface. Set the destination address to be the VIP already configured. 3. Create a static route to the fake VIP range and set this to blackhole (no gateway or interface required). 4. Redistribute static routes into OSPF; filter using routemap if required. The VIP addresses are only mentioned in the VIP config (starting address) the static route (relevant subnet) and the access-list if configured.