OSPF Central and Remote Site(s) Design

[mnlatif]

Hi,

Can someone present some tips in designing a Hub and Spoke design network for OSPF (Running over IPSec using DMVPNs).

The network consists of two Major sites having DMVPN Hubs (Hub1 and Hub2)located in different continents.

Each remote\spoke site has two Tunnel interfaces connecting to each Hub.

The 2 hubs also have a dedicated link through a MPLS network.

When designing an OSPF network of similar design, what are the best practices

1. How should Area0 defined ? Will it be spread over both major sites ?

2. Since the Hub sites will access some networks through Hub1 and some through Hub2. Can they still be made Stub Sites ?

The Hub sites also need to have a default route for local internet access.

3.Should each major sites be further sub-divided into more areas ?

Two major sites have 2Mb of BW between them with almost 50% Avg usage at this time.

Remote sites have BW between 256K-1Mb.

Thanks,

Naman

[mheusinger]

Hi,

have a look at

"Configuring Dynamic Multipoint VPN Using GRE Over IPSec With OSPF, NAT, and CBAC"

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008019d6f7.shtml

where you can find some explanations and configuration examples.

For design rules be aware that the possibility of subdividing into different areas depends on the existance of an ABR. Now an OSPF router will become ABR in case it has an interface in area 0.

From this you can conclude that you need area 0 in all major sites (just in case), and as it cannot be splitted you would have area0 across the DMVPN construct.

The question about subdividing your network into different areas can be answered by looking at the CPU and memory load of your routers.

Generally I would recommend it with your construction as then you are able to control the amount of information sent through route summarization (area range on ABR) - personal taste. It depends also on the number of routers involved.

Regarding your stub question: a stub area does not get external routes but a default route from the ABR instead. In case this doesn´t conflict with your internet default route go ahead.

Hope this helps

Martin

P.S.: Personally I call the default route the "highlander" route. There can only be one and in case there are more then they will fight each other ;-)