Mutlisite Mesh Ring via IPSEC - OSPF setup

Mutlisite Mesh Ring via IPSEC - OSPF setup

Mutlisite Mesh Ring via IPSEC - OSPF setup
Mutlisite Mesh Ring via IPSEC - OSPF setup
2024-06-29 03:38:16 - last edited 2024-07-02 07:14:14
Model: ER605 (TL-R605)  
Hardware Version: V2
Firmware Version: 2.2.4 / 2.2.5

Hello Gurus,


I'm trying to setup a small ring between 3 sites with 3 ER605s connected to a single ISP at each site.  I have the VPN tunnels established and can reach the subnets at each site from the other sites respectively.  So no issues there.

 

I'm trying to now setup OSPF as eventually, I will have 6 site mesh setup and may not have entirely every site fully meshed together, so I want OSPF to be able to provide the path for traffic to reach other site if it is not directly connected via the tunnel.

 

I'm guessing this is possible, but I can't find any documentation on how to setup OSPF on these things and not sure if it will work across the IPSEC tunnel(s), or if I need to configure something else.

 

Any thoughts?

 

Thank you..

  0      
  0      
#1
Options
1 Accepted Solution
Re:Mutlisite Mesh Ring via IPSEC - OSPF setup-Solution
2024-07-01 02:55:49 - last edited 2024-07-02 07:14:14

Hi  @ocbroadband 

Only GRE supports OSPF or RIP. IPsec doesn't.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update!Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
Recommended Solution
  1  
  1  
#2
Options
8 Reply
Re:Mutlisite Mesh Ring via IPSEC - OSPF setup-Solution
2024-07-01 02:55:49 - last edited 2024-07-02 07:14:14

Hi  @ocbroadband 

Only GRE supports OSPF or RIP. IPsec doesn't.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update!Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
Recommended Solution
  1  
  1  
#2
Options
Re:Mutlisite Mesh Ring via IPSEC - OSPF setup
2024-07-01 11:19:10

  @Clive_A OK Great!  That's perfectly fine with me.   Is there an example somewhere of how this is done?  I've tried the GRE tunnel as well and it still didn't see any OSPF neighbors.

  0  
  0  
#3
Options
Re:Mutlisite Mesh Ring via IPSEC - OSPF setup
2024-07-01 17:29:48

  @Clive_A I figured out what I had wrong and resolved the neighbors now showing.   My other issue is how can I specify a network that resides at a specific location on the WAN interface and have traffic from the other sites go to that site?

  0  
  0  
#4
Options
Re:Mutlisite Mesh Ring via IPSEC - OSPF setup
2024-07-02 07:15:59

 Hi @ocbroadband 

ocbroadband wrote

  @Clive_A I figured out what I had wrong and resolved the neighbors now showing.   My other issue is how can I specify a network that resides at a specific location on the WAN interface and have traffic from the other sites go to that site?

Sounds like policy routing?

I don't think we can do thid with the GRE.

You can search if this is requested in the request page.

If you know any vendors capable of doing this, write in the report and that's helpful.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update!Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
  1  
  1  
#5
Options
Re:Mutlisite Mesh Ring via IPSEC - OSPF setup
2024-07-02 17:17:49 - last edited 2024-07-02 17:19:18

  @Clive_A Hi,

 

There are plenty of vendors that can specify destination routes for OSPF.   Being that OSPF is actually up and running, its a matter of being able to define which locations are advertising which subnets, and it should then get propagated to the other connected OSPF neighbors and route it accordingly.  I'm just not sure if there's something I need to do from one site to another.  The use case for example would be, 2 sites with GRE up and OSPF between them.  Site A has a shorter path to lets say google.com from its WAN connection and I want anyone at Site B accessing it (IP Addresss / IP range / etc.) to go over the GRE link since its advertised from Site A, and out Site A's WAN link.  This is really a fairly standard option when implementing OSPF and really is what its targeted at for small networks.

  0  
  0  
#6
Options
Re:Mutlisite Mesh Ring via IPSEC - OSPF setup
2024-07-04 00:36:41

Hi  @ocbroadband 

ocbroadband wrote

  @Clive_A Hi,

 

There are plenty of vendors that can specify destination routes for OSPF.   Being that OSPF is actually up and running, its a matter of being able to define which locations are advertising which subnets, and it should then get propagated to the other connected OSPF neighbors and route it accordingly.  I'm just not sure if there's something I need to do from one site to another.  The use case for example would be, 2 sites with GRE up and OSPF between them.  Site A has a shorter path to lets say google.com from its WAN connection and I want anyone at Site B accessing it (IP Addresss / IP range / etc.) to go over the GRE link since its advertised from Site A, and out Site A's WAN link.  This is really a fairly standard option when implementing OSPF and really is what its targeted at for small networks.

Thank you for the suggestions. It still sounds like the Policy Routing instead of the OSPF. You destine the traffic from Site B of google.com to the gateway of the Site A, that indeed sounds like the PBR.

You may bring this up in the feature request page. We just added the OSPF and other routing protocols in recent firmware upgrades.

The development of the product is not instant. We need to move forward one by one and optimize the products.

Thank you again for bringing this up.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update!Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
  1  
  1  
#7
Options
Re:Mutlisite Mesh Ring via IPSEC - OSPF setup
2024-07-04 02:43:16

  @Clive_A  Hi,

 

Sounds good.  And to be clear, I'm not looking for instant results, just curious if there's a guide to do some of these things based on the features that have been added.  I've not found anything definitive on how to accomplish this in the documentation.   The docs merely state what each thing does.  Being that the accomplishment of said goal is done differently based on the device you are configuring, it would be prudent to supply some use-case examples of how to do them if it is possible.

 

I'll experiment with the PBR and see if I can get something to work.   As of now, I figured out somewhat how the OSPF is working between my 3 sites I have, so thats a start.

 

Lyle

  1  
  1  
#8
Options
Re:Mutlisite Mesh Ring via IPSEC - OSPF setup
2024-07-05 11:45:08 - last edited 2024-07-05 11:46:49

ocbroadband wrote

  @Clive_A  Hi,

 

Sounds good.  And to be clear, I'm not looking for instant results, just curious if there's a guide to do some of these things based on the features that have been added.  I've not found anything definitive on how to accomplish this in the documentation.   The docs merely state what each thing does.  Being that the accomplishment of said goal is done differently based on the device you are configuring, it would be prudent to supply some use-case examples of how to do them if it is possible.

 

I'll experiment with the PBR and see if I can get something to work.   As of now, I figured out somewhat how the OSPF is working between my 3 sites I have, so thats a start.

 

Lyle

 

@Clive_A,

 

After some review of the PBR, it doesn't appear you can select an interface other than a 'WAN" interface for the traffic, so its very limited.  The ability to select 'any' interface would definitely make this a viable option to route traffic from site A to site B across the GRE tunnel and out that Site B WAN interface.  Seems like this is a limiting factor on all the potential methods to achieve what I'm attempting to do unless I'm just missing something.

 

My attempted solution was create an IP group with the subnets I want to reach through the GRE tunnel from Site A @ Site B that live outside Site B WAN, but the PBR that I'm specifying on Site A does not contain the GRE tunnel interface, only a 'WAN' type interface.

So I'm at a loss on how to tell the router to send any traffic across the GRE unless its a local subnet on Site B or somehow get OSPF to advertise that subnet from Site B to Site A that it has the path for that subnet as being more specific.

 

Thoughts?

  0  
  0  
#9
Options