Hello,
I test in my lab a solution for a customer. The goal of this lab is to implement OSPF over IPSEC. The schema is very basic :
- one Headoffice with one WAN connection (area 0.0.0.0 for internal trafic and area 1.1.1.1 for VPN). The firewall name "fortilab_HQ".
- two remote sites with two internet connections (firewall name fortilab_R2 and fortilab_R1)
I already configured my area, interface, ... The configuration is OK, but I would like to improve the configuration like that :
1) I configured the summary-address on all sites (10.200.0.0/16 for HQ, 10.201.0.0/16 for R1, 10.202.0.0/16 for R2). But my headoffice still propagate the route learned by ospf to my remote firewall :
Is that possible to avoid the route "10.200.248.0" to be propagate ?
2) I would like to don't propagate the IP of the IPSEC interface IP to all my remote site. Is that possible to disable to propagation of these address (all my IPSEC interface are in subnet 192.168.30.0/24) ?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Will that's a IA route, so do you have it populated via the network statement? and what filtering do you have now that's deployed?
PCNSE
NSE
StrongSwan
The subnet 10.200.248.0/24 is declared on my internal cisco router (in area 0.0.0.0)
(fortilab_HQ) # get router info ospf database router lsa Router Link States (Area 0.0.0.0) LS age: 485 Options: 0x2 (*|-|-|-|-|-|E|-) Flags: 0x3 : ABR ASBR LS Type: router-LSA Link State ID: 1.1.1.1 Advertising Router: 1.1.1.1 LS Seq Number: 80000074 Checksum: 0x8ae7 Length: 36 Number of Links: 1 Link connected to: a Transit Network (Link ID) Designated Router address: 192.168.70.2 (Link Data) Router Interface address: 192.168.70.1 Number of TOS metrics: 0 TOS 0 Metric: 1 LS age: 1954 Options: 0x22 (*|-|DC|-|-|-|E|-) Flags: 0x0 LS Type: router-LSA Link State ID: 192.168.71.1 Advertising Router: 192.168.71.1 LS Seq Number: 8000006e Checksum: 0x4fc0 Length: 48 Number of Links: 2 Link connected to: a Transit Network (Link ID) Designated Router address: 192.168.70.2 (Link Data) Router Interface address: 192.168.70.2 Number of TOS metrics: 0 TOS 0 Metric: 10 Link connected to: Stub Network (Link ID) Network/subnet number: 10.200.248.0 (Link Data) Network Mask: 255.255.255.0 Number of TOS metrics: 0 TOS 0 Metric: 10 I only do a "summary-address" on my HQ fortigate like this :
config summary-address edit 1 set prefix 10.200.0.0 255.255.0.0 next end
Thanks
That summary is a external route not a IA route. Look at you route table.
A IA route is always path preferred over a ext type1 or type2. The real question is ; " do you really need to filter that IA route and if so why ? Do you have network-topo map explain your area0 bkbne and the other areas?
PCNSE
NSE
StrongSwan
emnoc wrote:
That summary is a external route not a IA route. Look at you route table.
A IA route is always path preferred over a ext type1 or type2.
totally agreed (after reading a few more docs.. ;) )
emnoc wrote:
The real question is ; " do you really need to filter that IA route and if so why ? Do you have network-topo map explain your area0 bkbne and the other areas?
I would like to filter all IA to don't have a lot of route on my remote site. In this lab, I have only one IA, but my customer will have more than 70 subnets. So, for lisibility, i would like to summarized and route the subnet 10.200.0.0/16 through my VPN.
schema : http://imageshack.com/a/img911/6832/R2rTnG.png
Thanks
Lucas
Hey,
you should be able to do this kind of route summarization via the range setting in the area!
config area edit 1.2.3.4 config range edit 1 set prefix 1.2.0.0 255.255.0.0 next end next end
You need to filter IA routes at the ABR. Once again what's your network-topology between the cisco and fortigate for area0 and the other area(s).
In all fairness 70 ospf routes is not alot of routes by any means. Route summarization is best at filtering and reduce routes inject via type5 external LSA between areas.
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1519 | |
1019 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.