OSPF - Point to Point Failover

[ddskier]

We currently have two point-to-point lines that connect our main office to our Collocation center. We primary force all traffic over the main point-to-point using static routing. (We do have some traffic going over the backup line via a policy route.) We are currently using the Detect Server (Ping) feature of the Fortinet units to know if the main point-to-point is down. The problem that we are running into is that we would like to move towards dual stacked IPv4 and IPv6, however, the Fortinet has no plans to support Detect Server feature for IPv6. So I was thinking about moving to a routing protocol setup like OSPF to accomplish the same thing as the Detect Server. Is this possible using OSPF with two point-2-point links that connect to the same two end points? Or does anyone have an alternative method?

[emnoc]

fwiw: Network 0.0.0.0 is the same as saying Area 0. On the default routing, just push or originate a default route into your ospf process like what most others do. If you have a internal uplink gateway devices ( i.e a cisco,juniper, etc..) push that default 0.0.0.0/0 into your ospf process from that device ( at the colo ). In fact you could have multiple exits and provide redundancey if you had a co-lo failure. This would require a 2nd colo uplink location, but that' s another whole design.

[emnoc]

After all that converges, the route with the least amount of hops is used for routing

Every thing you said is correct, except the above. Mertic is the only calculation and no where in the OSPF information base or computing, does hops ever comes into play. In fact you could more hops between location X and Y, but have a lower overall metric and that could be installed into the RIB. BGP, RIP, EIGRP (cisco) , all use hops in some shape or fashion for these distance vector protocols. I figure I would clarify this FWIW :on cisco, you can very much install opsf area statements as either network area 0 or network area 0.0.0.0 , fwiw you can use a network-number for routing via static routes of a default-network for gateway of last resort, but hardly ever seen anybody doing that today and no such need for this with any dynamic routing protocols & a proper defined network imho

[rwpatterson]

Yep... The lowest COST is used. My bad. :(

[ddskier]

Sorry it took me so long to respond, I have been swamped with other things. So I think I have a configuration setup that shoudl work (See Diagram). Questions: 1. Does that look right to you guys as it will route traffic by default on the Main Point-2-Point line first? Does the networking look right? 2. Once the routing gets the traffic from the Main Office to the Collocation via OSPF, I assume static and/or BGP routing takes over to route it to the Internet, right? Or do I have to use the " Redistribute" settngs of OSPF within the Fortigate unit? 3. Is there something specific I have to do to enable OSPFv3? or just setup IPv6 Networks and it' s automatic? Thanks for all the help!

[emnoc]

cool diagram and explanation, you can send the default route downwind via the right-side and have an automatic failover. PBR could be use as an alternative for traffic that you might want to breakout of the normal route-selection.

[ddskier]

ORIGINAL: emnoc cool diagram and explanation, you can send the default route downwind via the right-side and have an automatic failover. PBR could be use as an alternative for traffic that you might want to breakout of the normal route-selection.

Questions: 1. Does that look right to you guys as it will route traffic by default on the Main Point-2-Point line first? Does the networking look right? 2. Once the routing gets the traffic from the Main Office to the Collocation via OSPF, I assume static and/or BGP routing takes over to route it to the Internet, right? Or do I have to use the " Redistribute" settngs of OSPF within the Fortigate unit? 3. Is there something specific I have to do to enable OSPFv3? or just setup IPv6 Networks and it' s automatic?

[emnoc]

q1: yes q2: yes whatever access or reach at colo is what and how you get to the internte of course appropiate fwpolices and NAT/PAT ules q3: read the manual, the explain how to enable and to use IPv6. I never done IPv6 on fortigates outside of static and my other IPv6 routing has been bgp and EIGRP ( cisco ) But the concept starts with enabling ipv6 interfaces, applying v6 fwpolicy and placing routing dynamic or static. The same thing that ipv4 needs, you will need for ipv6 and the concept is all prefixes based no more class boundaries or classfull networks.

[ddskier]

Thanks for the help. Now that I think I have the settings planned out, I' m going to try them out. I' ll let you know how it goes.

[ddskier]

Ok I believe that I have the OSPF working. I see entires in both firewall' s routing table with a type of OSPF. I can even ping the various interfaces on the other firewall. The issue that I am running into now, is that OSPF is NOT adding a default route so that the " Company" firewall will route all Internet requests to the " Colo' firewall. (See previous diagrams.) Basically, the " Company" firewall doesn' t know to router Internet requests to the Colo. Any ideas on how I can get this default route working with my OSPF config?

[emnoc]

You did you investigate the OSPF originate at the colo? Worst case, you add statics and dead gateway detection.