Path Selection with OSPF external routes VS "O" routes

[braveheart]

We have couple of route based site-to-site vpn with cost/priority configured on the Fortigate 500 D firewalls and its working fine. So we are adding layer 3 (Active and Standby )connectivity through the service provider MPLS network where we need to connect our Head Office and Data Center. We are running routing protocol OSPF with my Fortigate 500 D with PE Router to make OSPF adjacency. During implementation we found that the routes we are receiving from provider PE router  is E1/E2 routes. Our goal was to use Active layer 3 connection through MPLS will be Primary Link and and Standby one will be Secondary if primary one fails. We put the cost on the Active link 3 and Standby 6. Although we put the lowest cost for Active and Standby Link  compare to our existing route based VPN(Cost starts from 10 and onward) nevertheless traffic is NOT passing through the Active and Standby Link. I think this is because as Fortigate 500 D  sees the Layer 3 routes as external routes. I know that regardless of a route's metric or administrative distance, OFPS will choose routes in the following order: Intra-Area(O)-->Inter-Area(O IA) --> External Type 1(E1) --> External Type 2 (E2) -->NSSA Type 1(N1)-->NSSA Type 2(N2) etc. So, is there any way to show provider external E1/E2 routes as "O" (OSPF) routes in Fortigate 500 D.  If I can do that then I can put cost on all those "O" routes and make the Layer 3 primary one as our primary link. Any feedback will be appreciated. 

Thanks. 

[emnoc]

Your logic is correct. E routes are looked at last if the route are internal. You have another solution run BGP and us that to carry the routes for the VPN. If your BGP background is weak, RIPv2 would be my next pick.

Ken

[braveheart]

Hi Emnoc,

Thanks for your quick answer. Actually If I go to RIPV2 option then how can I accomplish that? It will be very helpful for me if you can provide any web link or sample configuration. 

By the way, just adding more information regarding the scenario, in OSPF routing table we can see all our Site-Site vpn and both layer 3 links(active and standby). Although I put lowest cost(3 and 6) for Layer 3 links nevertheless VPN routes (cost starts from 10) always wins and Fortigate passing traffic through VPN. Its because of "E routes" VS "O routes". In case of failure of VPN links then Layer3(Active first and if active is down then standby) links kick in and starts passing traffic. 

[Toshi_Esumi]

Most likely your MPLS provider is using BGP internally if you getting E2 routes for routes on the other ends. You should talk to the provider and consider terminating MPLS with BGP and likely they can forward BGP metrics like communities between your HQ and Datacenter. With that you can set priority higher/lower on routes advertised from one circuit than ones from the other, then you can use route-maps to control outgoing paths flexibly. OSPF is limited in terms of manipulating routes. Also if they offer BGP over MPLS, they might offer templates of BGP configuration for failover. Likely for Cisco or Juniper routers though.

[emnoc]

I agree if they get routes from the  PE via  BGP they can do whatever in any shape or fashion for path selection and failover or  backdoors iBGP if you wanted that over the backup links. The possibilities are wide and deep at that point.