Checkpoint OSPF Routing

I have static routes configured, and now I want to implement OSPF Routing over the LES Circuits.  The LES Circuit have been recently installed, and I now need to route traffic over the circuits

So do you want to know how to configure OSPF? On the firewall or the switches?

I have OSPF configured on both Firewall and Switches and have formed neighbour relationships.

I need to able to advertise the static routes on the firewall to the switches, If I do not need static routes how will be able to advertise the routes in OSPF as these networks are not directly connected on the firewall.

i.e. Firewall Static Route 10.15.1.0/24 10.15.10.10 (Switch nest hop)

The 10.15.1.0 network is located of the Cisco switch, On the firewall I am able to advertise directly connected networks.

>I need to able to advertise the static routes on the firewall to the switches,
>The 10.15.1.0 network is located of the Cisco switch,

If the network is connected to the cisco switch, why does the firewall need to advertise it to the cisco switch???

I must be missing something...

so you've formed an OSPF adjacency between 1 or 2 Layer 3 switches?. Where in relation to the firewall are the routes that you want to redistribute?

I have formed adjacency between 1 layer 3 switch and the firewall. The routes I want to redistribute are hanging off the layer 3 switches.

Currently on the firewall they are configured as static routes and I want to provide resilency for the les circuit.

Don,
this is might be a mis-configurtion on my behalf, although I was under the impression that you could only advertise directly connected network or static routes within ospf

please can you post you layer switch config.

>The routes I want to redistribute are hanging off the layer 3 switches.

If the networks are connected to the switch, you can either add a network statement for those networks, or you can redistribute them as connected.

Personally, I would add a network statement.

I agree with donjohnston. You could also make them OSPF passive-interfaces.

Don,

L3 SW ------------------------------------ FW

The Firewall and the switch are on 2 differenet sites seprated by the LES Circuit, I want to advertise the route from the firewall not switch, I want the LES Circuit to failover if either les circuit is unavailable.

THe network statement can explain what do I need to advertise

please can you do

show ip ospf ne

from the L3 switch

can you also do

show ip int brief

>The Firewall and the switch are on 2 differenet sites seprated by the LES Circuit,

Doesn't matter.

>I want to advertise the route from the firewall not switch,

Right. But why have the FW advertise a static route? It's so much easier to let the FW learn the route through OSPF.

>I want the LES Circuit to failover if either les circuit is unavailable.

And it will... If you let the FW learn about the router through OSPF. Otherwise you have to implement SLA.

I have advertised connected networks via the switch by using the following commands.

The routes are not being advertised on the firewall, the only networks that it see are the LES link of 10.15.10.0 and 10.15.11.0

Router ospf 1
net 10.15.1.0  0.0.0.255 area 0
net 10.15.5.0  0.0.0.255 area 0
net 10.15.6.0  0.0.0.255 area 0

Then it seems that an adjacency is not being formed. Please post the output of a "show ip ospf neigh" on the switches and the equivalent on the FW.  

Also, it would help if we could see the interface config and the OSPF config on the switches and FW.

Don,

The adjacency seems to be OK, I have attached the config.

please can you post the routing table for the firewall.

I have attached the routing table

It's the 10.15.1.0/24 network that you want the switches to advertise to the FW, right?

If so, you'll need a network statement on the switches.

network 10.15.1.0 0.0.0.255 area 0

And you've got a static route on the FW for the 10.15.1.0 network. Static routes are preferred by default. If you want to see the OSPF route, you'll need to either delete the static route or raise it's administrative distance (AD) to be greater than the OSPF AD on the FW.

Don,

I have about 10 networks I wnat the switch to advertise and yes 10.15.1.0/24 is one of the net. I had added the static route back in to the firewall as once I removed the route, the packets were dropped.

The networks I advertised are below

net 10.15.1.0  0.0.0.255 area 0
net 10.15.5.0  0.0.0.255 area 0
net 10.15.6.0  0.0.0.255 area 0

The reason the packets were dropped is switch wasn't advertising the networks.

Assuming the 1.0, 5.0 and 6.0 networks are connected to the switches, you'll need OSPF network statements for those networks in your config (or redistribute the connected networks into OSPF).

Don,

I had network statement on the switch 5.0 and 6.0 as below, is this correct network statement on the switch ?

net 10.15.5.0  0.0.0.255 area 0
net 10.15.6.0  0.0.0.255 area 0

For the 5.0 and 6.0 networks, yes. But 1.0 is missing.

Can you post the routing table of the switch please?

Hi Don,

I have posted the switched routing table

Good.

Make sure you have network statements for the networks you want advertised (1.0, 5.0 and 6.0).

Then either delete the static routes from the FW or raise their ADs.

can you post

show ip ospf database router


from the switch.

OK I added the network statement on the switch 10.15.1.0 0.0.0.255 area 0
Still not working I ran a ping from box on the 10.15.1.x subnet and once I remove the static route from the firewall the ping failed

Please post the config of the switch.

Here you go!

show ip ospf database router

Here you go!

Can you post the OSPF database from the FW?

Also, what IP address are you pinging and what IP address are you sending the ping from?

http://www.techsneeze.com/ospf-issue-nokia-checkpoint-cisco-12-3

It maybe a compatibility problem

try the following on the cisco switch

router ospf 1
 no capability lls

Bud I try that command still not working, although the Cisco and Checkpoint can form adjacency, just not advertising the networks to the Nokia

did you reset the ospf adjacencies?

yea I use the command clear ip opsf process, on the nokia i am only seeing 4 net. regardless of how many net statement i advertise on the cisco sw

On cisco, you can do "show ip ospf database router"

Can you do an equivalent command on the Nokia and post the output.

Thanks.

Wait a minute...

"on the nokia i am only seeing 4 net."

What Nokia??? I thought we were dealing with a CheckPoint Firewall and a Cisco Switch.

OK, Nokia is the platform with uderlying OS which controls the routing, interfaces etc.. Checkpoint is on top of Nokia which with the firewall rules

rochey2009,

sh ip ospf database router

So you don't have a CheckPoint Firewall appliance? You're running CheckPoint software on a Nokia box?

Nokia is a Checkpoint appliance

http://www.checkpoint.com/products/ip-appliances/index.html

Please can you post Checkpoint, OSPF config

Rochey2009,

The OSPF is done on the Nokia

Sorry, can you post the Nokio OSPF config?

I have attached ospf-config in a post above, if you need more info let me know!

Sorry, I can't see the Nokia ospf config

Hi,

All the config is done by the web interface, I can do show commands from the cli

Have you tried setting the cisco as an ospf point-to-point.

interface GigabitEthernet1/0/18
 ip ospf network point-to-point


interface GigabitEthernet2/0/25
 ip ospf network point-to-point

I will give that a go

You can also try some debugging on the voyager.

In Voyager, go to Configuration > Routing > Routing Options. Under OSPF drop-down list, select All and click on Apply. This will generate ipsrd.log.* files under /var/log. Collect the logs during the time when OSPF errors are occuring. There might be multiple files created.

The OSPF LSA from the L3 switch is being received by the Nokia. I'm wondering if there is a bug in the Nokia.

As an alternative to running OSPF:

If you install another Cisco switch next to the Nokia. You could use Etherchannel to combine the two LES circuits together and continue using static routes on the Nokia. The Etherchannel will load balance traffic over both of the LES circuits and continue to work if one of LES circuits fails.

Do you have any Inbound Route Filters defined under

Config on the home page
Inbound Route Filters Link in the Routing Configuration section
Filter Inbound OSPF routes

Also, what protocol rank have you given to OSPF?

Rochey,

no inbound router filters defined

no OSPF rank

The only config is on the advertising the connected networks on the backone area for  10.15.10.0, 11.0

Rochey,

I have attached the routing options for rank ospf and inbound route filters

Give the debugging a shot.

In Voyager, go to Configuration > Routing > Routing Options. Under OSPF drop-down list, select All and click on Apply. This will generate ipsrd.log.* files under /var/log. Collect the logs during the time when OSPF errors are occuring. There might be multiple files created.

Then clear  the adjacencies from the Cisco end.

Log file attached

What is the state of the adjacency at the moment?

They are both up Full/DR

Please can you shut down one of the OSPF links - subnet 10.15.10.0, so that we only have one link between the Nokia and the Cisco.

Then switch on the OSPF debug on the Nokia.

Then clear the OSPF process from the cisco end.

Repost the debug.

Thanks.

From my previous post

Have you tried setting the cisco as an ospf point-to-point.

interface GigabitEthernet1/0/18
 ip ospf network point-to-point


interface GigabitEthernet2/0/25
 ip ospf network point-to-point

Have you removed this config.

Yes I have set the interfaces ip ospf network point-to-point, and reset ospf still no joy

Have you removed the

ip ospf network point-to-point command.

No do you want me to remove it ?

yes please remove the

ip ospf network point-to-point

from both of the ports going to the LES links

shut down one of the ports going to LES links so that you only have one OSPF adjacency formed between the Nokia and the Cisco

Then start another OSPF debug on the nokia.

Then restart the OSPF process on the cisco.

repost the debug.

OSPF Logs, the 10.15.1.0 route is getting advertise but I am still unable to ping from the 10.15.1.x subnet

try the following on the cisco

paste the following into the config


router ospf 1
 no network 10.15.1.0 0.0.0.255 area 0
 no network 10.15.6.0 0.0.0.255 area 0
 no net 10.15.5.0  0.0.0.255 area 0
 redistribute connected subnets

The Nokia is not advertsing any ospf routes

Did you mean that the Nokia isn't receiving any OSPF routes?

Got it working mate, changed the Router ID on the Nokia to 10.15.10.101 and it started adding the OSPF Routes into the routing table.

Thanks for your help

excellent. I'm glad you've got it working.

Regards.

Hi,

Did you bring both links back to the up state?

Yep I did, to test the connection I ran a continuous Ping from 10.15.1.x and shutdown one interface it dropped a few pings and then re-established.

Now the question should I remove the redistrubute connected and add the network statements manually ?

So I have remove redist connected subnets and add in the the manually network statements. by adding net statement will this broadcast hello's for all interface in this network ?

network 10.15.1.0 0.0.0.255 area 0

no passive-interface vlan 2

Yes, when you use the network statement OSPF will send hello's out onto that VLAN. To stop OSPF from sending hellos use

passive-interface vlan 2

Rochey, The OSPF is all working as expected. Thanks again for sticking with it!