VPN route prefered over L2 in OSPF

[mgauthier]

Hello,

I'm having some trouble to change my OSPF topology.

Firewall site4-fw1 is in Area 1 and everything else in Area 0.

At this time site4-fw1 prefered to used direct VPN to contact 10.10.1.0/24 on site1 (blue square).

Interface cost is ok. 100 for VPN and 1 for L2 link.

In OSPF database, LSA for both network is the same (metric 10)

Do you have any idea ? Should I tried to set a route map to force metric ?

[hbac]

Hi @mgauthier, 

Can you check the routing table by running "get router info routing-table detail 10.10.1.1" in the CLI? 

Regards, 

[mgauthier]

FortiGate-VM64-KVM # get router info routing-table details 10.10.1.0

Routing table for VRF=0
Routing entry for 10.10.1.0/24
Known via "ospf", distance 110, metric 10, best
Last update 00:01:50 ago
* 100.65.0.5, via vpn1 distance 0

FortiGate-VM64-KVM # get router info routing-table details 10.10.1.1

Routing table for VRF=0
Routing entry for 10.10.1.0/24
Known via "ospf", distance 110, metric 10, best
Last update 00:01:56 ago
* 100.65.0.5, via vpn1 distance 0

[hhasny]

Hi,

Is the VPN route a static route?

Static route would have lower AD if compare to OSPF.

Lower AD would be preferred.

Checked the routing database table 'get router info routing-table database' and see the ADs.

regards

[mgauthier]

No, the only static route is the fake public ip for the vpn 

FortiGate-VM64-KVM # sh router static
config router static
edit 1
set dst 80.0.1.0 255.255.255.252
set gateway 80.0.4.2
set device "port2"
next
end

FortiGate-VM64-KVM

[mgauthier]

This lab has been done on Eve NG with :

• FGT VM KMV 6.4.14
• Arista Veos 4.29.4M
• VPCs (Native)

You can find all config change/add below to reproduce

simulationwan.txt 

site1-fw1.txt 

site2-fw1.txt 

site2-sw1.txt 

site3-sw1.txt 

siite4-fw1.txt 

site5-fw1.txt