OSPF - Point to Point Failover

[ddskier]

We currently have two point-to-point lines that connect our main office to our Collocation center. We primary force all traffic over the main point-to-point using static routing. (We do have some traffic going over the backup line via a policy route.) We are currently using the Detect Server (Ping) feature of the Fortinet units to know if the main point-to-point is down. The problem that we are running into is that we would like to move towards dual stacked IPv4 and IPv6, however, the Fortinet has no plans to support Detect Server feature for IPv6. So I was thinking about moving to a routing protocol setup like OSPF to accomplish the same thing as the Detect Server. Is this possible using OSPF with two point-2-point links that connect to the same two end points? Or does anyone have an alternative method?

[rwpatterson]

Possible and being done now by me. The up/down rate is far quicker than using the ping detection feature. Currently used between my home office and a photo lab I manage. I have one Internet connection while the lab has two. I can drop either one on the remote end and still connect through via the other VPN and OSPF without a care.

[emnoc]

OSPF would be your best bet and the 2 end-points on the same router is not of a concern. Just place both in area0 and set the metric on what path you prefer. You might need to enable asymmetrical routing if traffic egressing a interface does not fully return on the same path, but outside of that. It is a simple deployment. fwiw: I haven' t played with OSPFv3 but I think you could get creative and route IPv4 out one link via metrics and IPv6 out the other. You can then effectively load up both paths and use all available bandwidth just some food for thought

[ddskier]

Thanks for the input. Of all the routing protocols, I have not implemented OPSF before so I will need to learn as I go. I' m hoping to keep it a simple as possible. Couple of questions: 1. If I leave the default setup for the timers, would it really take 40 seconds for OSPF to figure out the link is not working and adjust the routing tables? What values do you guys recommend? 2. OSPF Networks: Do I want to define a network of 0.0.0.0 at the office side so that all internet requests get routed over to the collocation? (like in static routing) Then create a network of 10.10.x.x at the collocation side so that it routes office traffic back? Or do I have it reversed? 3. OSPF Interfaces: Do I need to create one interface for IPv4 and another for IPv6 even though it is the same physical route? 4. Can I use policy routing with this method? Or some how control that certain traffic from a source IP goes down the backup line? I would appreciate any additional insight.

[rwpatterson]

ORIGINAL: ddskier Thanks for the input. Of all the routing protocols, I have not implemented OPSF before so I will need to learn as I go. I' m hoping to keep it a simple as possible. Couple of questions: 1. If I leave the default setup for the timers, would it really take 40 seconds for OSPF to figure out the link is not working and adjust the routing tables? What values do you guys recommend?

I have never messed with the timers or tested that. Can' t say for sure.

2. OSPF Networks: Do I want to define a network of 0.0.0.0 at the office side so that all internet requests get routed over to the collocation? (like in static routing) Then create a network of 10.10.x.x at the collocation side so that it routes office traffic back? Or do I have it reversed?

The 0.0.0.0 area (A.K.A. ' the backbone' ) is shared between the two. It needs to be common. Any other area(s) may hang off that one.

3. OSPF Interfaces: Do I need to create one interface for IPv4 and another for IPv6 even though it is the same physical route?

Don' t use IPv6 myself, can' t say.

4. Can I use policy routing with this method? Or some how control that certain traffic from a source IP goes down the backup line?

There should be no reason you can' t use policy routing. You have different interfaces to point the traffic down, so in theory, you should be OK.

I would appreciate any additional insight.

[ddskier]

2. OSPF Networks: Do I want to define a network of 0.0.0.0 at the office side so that all internet requests get routed over to the collocation? (like in static routing) Then create a network of 10.10.x.x at the collocation side so that it routes office traffic back? Or do I have it reversed? The 0.0.0.0 area (A.K.A. ' the backbone' ) is shared between the two. It needs to be common. Any other area(s) may hang off that one.

I thought the areas were seperate from the " Networks" ? At least it looks like that from the OSPF GUI. If it is, is my reasoning for the networks correct?

[rwpatterson]

What is a network 0.0.0.0?

[ddskier]

I need to forward all internet traffic from the office to the collocation center. I' m thinking like static routing where you have 0.0.0.0 route so the firewall knows how to handle internet traffic. Is the concept the same with ospf with network 0.0.0.0?

[rwpatterson]

Not at all the same. You' re confusing areas with networks. With OSPF (Open Shortest Path First), the machines all communicate their routes, and the distances to the remote routes. After all that converges, the route with the least amount of hops is used for routing. If more than one route has the same distance, then ECMP (Equal Cost Multi Path) routing is established where the packet may travel between multiple paths to get to that same remote site. With OSPF, you can artificially alter the cost of a path (more cost for bandwidth, or slower link speed, etc) so that traffic uses another path. The beauty of any dynamic routing is that as soon as a new network is added to the mix, all the connected areas will know how to get to it without any manual intervention. FWIW, I never heard the term ' network 0.0.0.0' before as being the same as the area. It' s usually used as the default route.

[emnoc]

OSPF timers can be adjusted but when you do this take into consideration; 1: both sides must match & use the same timers 2: you increase the chance of flap due to a 1-2-3 missed which would not take place if the stand ospf timers where used