OSPF over IPSec VPN : Interface cost not being respected

[arismonty_beato]

Hello,

I am able to configure OSPF over IPSec tunnel, but:

- I have another OSPF interface (through a physical interface) with lower cost that is Up and routes in the routing table are using this preferred link with correct cost.

- When the IPSec tunnel comes Up, the routing table is modified; routes are now using the IPSec interface although I have defined a higher cost for the VPN interface... looks like something is forced.

Has anyone come across a similar situation?

Thanks,

Monty.

[emnoc]

No ,but you could use a . route-map and tag the routes and over the  ipsec-tunnel you adjust the metric.

With out seeing the cfg and route-table we will not know how to adjust the issue. Are the two routes 100% the same ( same prefix same prefix-length ) ?

Ken Felxi

[arismonty_beato]

Thanks Ken, 

The routes are exactly the same, as both links are between the same 2 fortigates.

I will check into the route map and tagging, but I've never seen this behavior with multiple Ethernet or VLAN links, even if it is between the same 2 fortigates... it seems to be something special with VPN.

Regards,

Monty