Can a PIX load balance outbound w/ OSPF?

[Randall White]

Hi All,

I have a PIX 515 that is dual homed to the Internet through 2 edge routers (1 router per ISP). How can I load balance outbound connections? It doesn't have to be perfect, I just want to utilize the second ISP.

Will this work if I run OSPF between the PIX outside interface and the routers? Also, if one link goes down I want it to fail over to the second link. I am not running BGP, both ISPs are advertising the same subnet.

Any ideas?

Thanks, Randy

[sachinraja]

You cannot run OSPF on PIX. PIX supports only RIP over it.

You cannot also add 2 default routes on the PIX to different destinations.

I dont think load sharing is possible unless you put a load balancer in between the devices.

[g.wrobel]

I suggest reading:

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_data_sheet09186a0080148714.html

and

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/mr.htm#1097803

it's possible.

[r.crist]

Interesting.. I didn't think this was possible since the PIX isn't a routing appliance. I wonder if these commands are used to support OSPF through the firewall, and not on it..?

This is worth configuring in a lab/test environment to see what it's all about.

[yusuff]

OSPF was introduced on PIX from ver 6.3

See Release Note below;

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/63rnotes/pixrn63.htm#32159

[jon-sills]

Yes, you can run OSPF on the PIX and the edge routers. I am actualy lab testing the concept and getting ready to roll the same scenario to production. You will need to insure that your IBR's are sending a default route to the PIX (and that your PIX shows equal cost routes for the default, or whatever routes your trying to load balance. Elsewise adjust at your IBR's until it does).

Caveats:

Upgrade Finesse to 6.3(2)

6.3(1) will work, however it has a bug that will cause endless invalid packet length errors on the LSA's. 6.3(2) fixes this.

Cisco reccomends that you authenticate OSPF neighbors. Unfortunately, should you attempt to configure md5 authentication with the PIX, you will break OSPF. I have had a TAC case open on this for a while now, and it currently looks like it's gonna require a code upgrade to fix it.

When configuring OSPF on the PIX, remember that your network statements have to use standard netmasks (network 10.1.1.0 255.255.255.0 area 0) rather than the reverse dotted decimal that a router would use (network 10.1.1.0 0.0.0.255 area 0).