Safe values for OSPF timers on FWSM?

[max.caines_2]

I have a pair of FWSMs running active/passive. Firmware is 4.1. I want to reduce the failover time by tuning the OSPF hello and dead timers. I'm thinking of 1 second and 3 seconds, but given this is a disruptive change, I'd like an opinion on whether these values are OK for the FWSM

Thanks

Max Caines, University of Wolverhampton

[Vibhor Amrodia]

Hi,

I think it would be better to not reduce the values too much as the Default values are 10 Sec and 40 Sec respectively.

It might cause unexpected Flaps on the OSPF.

Refer:-

http://www.cisco.com/c/en/us/td/docs/security/fwsm/fwsm41/command/reference/fwsm_command_ref/no.html#wp1646737

We have an enhancement for the NSF for the Dynamic protocols on the ASA device expected in the future:-

CSCsu90386

Thanks and Regards,

Vibhor Amrodia

[max.caines_2]

Hi Vibhor

OK, point taken, but there are people running sub-second timers on OSPF without problems, and while NSF may be coming for the ASA, the FWSM doesn't support it and isn't ever going to. What I was hoping was that someone might actually have tried this, but it looks like no-one has. Fortunately we are going to replace the FWSMs with a pair of Palo Altos which do support NSF, so I may leave it

Thanks

Max

[Vibhor Amrodia · Accepted solution]

Hi Max,

I think this might be dependent on the your network and the latency. It would be different for different cases but i have seen it working successfully with such low timers in some cases.

Thanks and Regards,

Vibhor Amrodia

[max.caines_2]

HI Vibhor

OK, I think you've convinced me. I shall leave them alone. As there won't be any more updates for the FWSM, it's only hardware failure that would cause a reconvergence event, so I think we'll live with that

Regards

Max