Mutlisite Mesh Ring via IPSEC - OSPF setup
Hello Gurus,
I'm trying to setup a small ring between 3 sites with 3 ER605s connected to a single ISP at each site. I have the VPN tunnels established and can reach the subnets at each site from the other sites respectively. So no issues there.
I'm trying to now setup OSPF as eventually, I will have 6 site mesh setup and may not have entirely every site fully meshed together, so I want OSPF to be able to provide the path for traffic to reach other site if it is not directly connected via the tunnel.
I'm guessing this is possible, but I can't find any documentation on how to setup OSPF on these things and not sure if it will work across the IPSEC tunnel(s), or if I need to configure something else.
Any thoughts?
Thank you..
- Copy Link
- Subscribe
- Bookmark
- Report Inappropriate Content
Hi @ocbroadband
Only GRE supports OSPF or RIP. IPsec doesn't.
- Copy Link
- Report Inappropriate Content
Hi @ocbroadband
Only GRE supports OSPF or RIP. IPsec doesn't.
- Copy Link
- Report Inappropriate Content
@Clive_A OK Great! That's perfectly fine with me. Is there an example somewhere of how this is done? I've tried the GRE tunnel as well and it still didn't see any OSPF neighbors.
- Copy Link
- Report Inappropriate Content
@Clive_A I figured out what I had wrong and resolved the neighbors now showing. My other issue is how can I specify a network that resides at a specific location on the WAN interface and have traffic from the other sites go to that site?
- Copy Link
- Report Inappropriate Content
Hi @ocbroadband
ocbroadband wrote
@Clive_A I figured out what I had wrong and resolved the neighbors now showing. My other issue is how can I specify a network that resides at a specific location on the WAN interface and have traffic from the other sites go to that site?
Sounds like policy routing?
I don't think we can do thid with the GRE.
You can search if this is requested in the request page.
If you know any vendors capable of doing this, write in the report and that's helpful.
- Copy Link
- Report Inappropriate Content
@Clive_A Hi,
There are plenty of vendors that can specify destination routes for OSPF. Being that OSPF is actually up and running, its a matter of being able to define which locations are advertising which subnets, and it should then get propagated to the other connected OSPF neighbors and route it accordingly. I'm just not sure if there's something I need to do from one site to another. The use case for example would be, 2 sites with GRE up and OSPF between them. Site A has a shorter path to lets say google.com from its WAN connection and I want anyone at Site B accessing it (IP Addresss / IP range / etc.) to go over the GRE link since its advertised from Site A, and out Site A's WAN link. This is really a fairly standard option when implementing OSPF and really is what its targeted at for small networks.
- Copy Link
- Report Inappropriate Content
Hi @ocbroadband
ocbroadband wrote
@Clive_A Hi,
There are plenty of vendors that can specify destination routes for OSPF. Being that OSPF is actually up and running, its a matter of being able to define which locations are advertising which subnets, and it should then get propagated to the other connected OSPF neighbors and route it accordingly. I'm just not sure if there's something I need to do from one site to another. The use case for example would be, 2 sites with GRE up and OSPF between them. Site A has a shorter path to lets say google.com from its WAN connection and I want anyone at Site B accessing it (IP Addresss / IP range / etc.) to go over the GRE link since its advertised from Site A, and out Site A's WAN link. This is really a fairly standard option when implementing OSPF and really is what its targeted at for small networks.
Thank you for the suggestions. It still sounds like the Policy Routing instead of the OSPF. You destine the traffic from Site B of google.com to the gateway of the Site A, that indeed sounds like the PBR.
You may bring this up in the feature request page. We just added the OSPF and other routing protocols in recent firmware upgrades.
The development of the product is not instant. We need to move forward one by one and optimize the products.
Thank you again for bringing this up.
- Copy Link
- Report Inappropriate Content
@Clive_A Hi,
Sounds good. And to be clear, I'm not looking for instant results, just curious if there's a guide to do some of these things based on the features that have been added. I've not found anything definitive on how to accomplish this in the documentation. The docs merely state what each thing does. Being that the accomplishment of said goal is done differently based on the device you are configuring, it would be prudent to supply some use-case examples of how to do them if it is possible.
I'll experiment with the PBR and see if I can get something to work. As of now, I figured out somewhat how the OSPF is working between my 3 sites I have, so thats a start.
Lyle
- Copy Link
- Report Inappropriate Content
ocbroadband wrote
@Clive_A Hi,
Sounds good. And to be clear, I'm not looking for instant results, just curious if there's a guide to do some of these things based on the features that have been added. I've not found anything definitive on how to accomplish this in the documentation. The docs merely state what each thing does. Being that the accomplishment of said goal is done differently based on the device you are configuring, it would be prudent to supply some use-case examples of how to do them if it is possible.
I'll experiment with the PBR and see if I can get something to work. As of now, I figured out somewhat how the OSPF is working between my 3 sites I have, so thats a start.
Lyle
After some review of the PBR, it doesn't appear you can select an interface other than a 'WAN" interface for the traffic, so its very limited. The ability to select 'any' interface would definitely make this a viable option to route traffic from site A to site B across the GRE tunnel and out that Site B WAN interface. Seems like this is a limiting factor on all the potential methods to achieve what I'm attempting to do unless I'm just missing something.
My attempted solution was create an IP group with the subnets I want to reach through the GRE tunnel from Site A @ Site B that live outside Site B WAN, but the PBR that I'm specifying on Site A does not contain the GRE tunnel interface, only a 'WAN' type interface.
So I'm at a loss on how to tell the router to send any traffic across the GRE unless its a local subnet on Site B or somehow get OSPF to advertise that subnet from Site B to Site A that it has the path for that subnet as being more specific.
Thoughts?
- Copy Link
- Report Inappropriate Content
Information
Helpful: 0
Views: 460
Replies: 8
Voters 0
No one has voted for it yet.