OSPF Help needed

[Parm Singh]

Hi Guys,

I wondering if someone can help

I have a 3750 connecting to our satellite office via 2 independent Metro E circuits terminated on 2911 routers. 

I've configured OSPF failover with ip route tracking for the HSRP.  This all works well, as per the attached diagram (Site BHX is on the bottom, STN on the right).

we would like to tansition to the new links slowly, hence want the new line's & equipment up side by site using a different IP (gateway LAN side)

Issue we have is as soon as we create the new WAN, devices on BHX start to route traffic to STN over this link, even though nothing is using the IP as gateway.

so it seems the route is being published / advertised to LAN devices.

config on BHX-01 is as follows;

interface GigabitEthernet0/0

description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$

ip address 172.10.0.2 255.255.255.0

duplex auto

speed auto

!

interface GigabitEthernet0/1

ip address 10.0.10.150 255.255.255.0

standby 1 ip 10.0.10.152

standby 1 preempt

standby 1 track 1 decrement 11

duplex auto

speed auto

!

router ospf 1

passive-interface GigabitEthernet0/1

network 10.0.10.0 0.0.0.255 area 0

network 172.10.0.0 0.0.0.255 area 0

!

ip default-gateway 172.10.0.1

ip forward-protocol nd

!

ip http server

ip http access-class 23

ip http authentication local

ip http secure-server

ip http timeout-policy idle 60 life 86400 requests 10000

!

ip route 0.0.0.0 0.0.0.0 172.10.0.1

!

!

I thought that by setting passive-interface GigabitEthernet0/1 nothing would be advertised to LAN.

what am i missing?  thanks in advance

Parm

[John Blakley]

Parm,

You said that when you bring this up, users start routing over it. Is BHX-01 the primary or the backup (new) link? On your primary router, did you specify a priority for hsrp or are you using the default for both routers? You said that no one is using this as a default gateway, so it's hard to see how traffic would be going over this link unless hsrp is converging and taking over as the active router.

HTH,
John

*** Please rate all useful posts ***

[Jon Marshall]

Parm

I'm finding your description really confusing but it is probably me.

The 3750 is at the top of your diagram  - yes ? 

It has two links to BHX site. You are running HSRP (with tracking) on the LAN interfaces ? 

Each WAN interface (gi0/0 on the router config you supplied) is using OSPF to advertise routes to the 3750 - is that correct ?

When you say you want to transition to the new links, which are the new links ? because you say you already have 2 routers configured in each site.

Jon

[Parm Singh]

Hi Guys,

sorry for teh confusion

Yes the 3750 is on the top of the diagram BHX-01 is primary router for site BHX, BHX-02 secondary. 

3750 cfg:

interface Loopback0

ip address 3.3.3.3 255.255.255.255

!

interface FastEthernet0

ip address 172.16.100.230 255.255.255.0

no ip route-cache cef

no ip route-cache

!

interface GigabitEthernet1/0/1

no switchport

ip address 172.10.0.1 255.255.255.0

speed 100

!

interface GigabitEthernet1/0/2

no switchport

ip address 172.10.1.1 255.255.255.0

speed 100

!

interface GigabitEthernet1/0/3

!

interface GigabitEthernet1/0/4

!

interface GigabitEthernet1/0/5

no switchport

ip address 172.10.2.1 255.255.255.0

speed 100

!

interface GigabitEthernet1/0/6

no switchport

ip address 172.10.3.1 255.255.255.0

speed 100

router ospf 1

log-adjacency-changes

network 3.3.3.3 0.0.0.0 area 0

network 172.10.0.0 0.0.0.255 area 0 

network 172.10.1.0 0.0.0.255 area 0

network 172.10.2.0 0.0.0.255 area 0

network 172.10.3.0 0.0.0.255 area 0

network 172.10.10.0 0.0.0.255 area 0

Site BHX alrady has a LL internet connection, with a watchguard firewall which creates a VPN back to site STN

we wanted to put this WAN in side by site and test before changing the HSRP IP to the one used by their current watchguard.

Hope thanks makes sence

Thanks again

cfg for BHX-02;

interface GigabitEthernet0/0

description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$

ip address 172.10.1.2 255.255.255.0

duplex auto

speed auto

!

interface GigabitEthernet0/1

ip address 10.0.10.151 255.255.255.0

standby 1 ip 10.0.10.152

standby 1 priority 91

standby 1 preempt

duplex auto

speed auto

!

router ospf 1

passive-interface GigabitEthernet0/1

network 10.0.10.0 0.0.0.255 area 0

network 172.10.1.0 0.0.0.255 area 0

STN-01 & 02 are the same bar the ip's

[Jon Marshall]

Just to clarify - which is the new link at BHX - is it the 10Mbps or 100Mbps link ?

When you say traffic is routed over the new link, is that outbound traffic, inbound traffic or both ?

Jon

[Parm Singh]

Hi Jon,

Both the 10 & 100 are new Metro-E links - which will replace their current 10Mb Leased line.

We installed BHX-01 & 02 and everythign was fine.

As soon as STN-01 & 02 went live,  they lost all network traffic to BHX, running a tracert from BHX to STN showed it hopping onto the new links.

Hence it's was almost as if OSPF told their LAN that it was thre prefered route to STN. - i dont really understand this, and we had to remove BHX-01 from the LAN quickly as they can not afford the down time.

THanks Parm

[Jon Marshall]

As soon as STN-01 & 02 went live,  they lost all network traffic to BHX, running a tracert from BHX to STN showed it hopping onto the new links.

Hopping onto the new links where, at what point ie. did it go onto the new links from BHX or after it went via the 3750.

So BHX is up and running via it's new links and advertising OSPF routes to the 3750 ?

What about STN. Before the new links were activated what did STN have to connect back to the 3750 ? Was it a leased line ?

I'm sorry but this is still quite confusing because of the firewall.

Before the new lines were put in BHX and STN connected via an IPSEC tunnel. How did they connect to the 3750 or did they not ?

What is being used for connectivity at STN now (ie. not the new lines)  and how does that connectivity work ? Are there any routes being advertised from STN to the 3750 ?

Jon

[Parm Singh]

Sorry Jon

BHX & STN are on the diagram - Bottom & right respectivly

HQ is where the 3750 sits

We had a 100 & 10MB Ethernet Extention installed into both sites back to HQ

Prior to this both sites has Leased Line internet acess with a Watchguard firewall, tunneling the two sites together.

Put a 3750 back in HQ & each site has 2 x 2911's.  01 for the 100mb, 02 for the 10MB

i've provided the config on the 3750 & BHX-01 &  02  - STN-01 & 02 are the simiar config  but patch into

3750 ports

interface GigabitEthernet1/0/5

no switchport

ip address 172.10.2.1 255.255.255.0

speed 100

!

interface GigabitEthernet1/0/6

no switchport

ip address 172.10.3.1 255.255.255.0

speed 100

we wanted failover from the 100 to 10 on each site, hence the OSPF & track ip route

So BHX 01 & 02 were installed, as soon as we put STN -01 online a tracert from BHX to STN showed the packets traveling into the 3750  (172.10.x..x) hops

unfortunalyt we cound not test and had to restore services.

Hence it seems there maybe some L3 deivce in BHX, which is picking up the OSPF - however i thought setting the port on the 2911 as passive should prevent OSPF traveling to LAN.

i really want to just use OSPF on between the 2911's & 3750 for link failover, and stop it at the LAN ports of the 2911

- i hope this makes sence.

[Jon Marshall]

Parm

No need to apologise, it's just taking me a while to get this right in my head and i'm still not quite there.

i really want to just use OSPF on between the 2911's & 3750 for link failover, and stop it at the LAN ports of the 2911

Well i think you have done that with the passive statements. I don't think that's the problem.

So BHX 01 & 02 were installed, as soon as we put STN -01 online a tracert from BHX to STN showed the packets traveling into the 3750  (172.10.x..x) hops

Is this what you expected or not ?

i think the confusion comes from this in your original post -

Issue we have is as soon as we create the new WAN, devices on BHX start to route traffic to STN over this link, even though nothing is using the IP as gateway.

So are you saying that in BHX devices are still pointing to their old gateway ie. the firewall or have you already moved them over to the new leased line setup ?  Because it sounds from your above statement that the devices in BHX are still pointing at their old gateway ?

if they are pointing at the new gateway ie. the HSRP address on teh 2911 routers then packets would be sent via the 3750 because STN willbe advertising routes via OSPF to the the 3750 which will advertise them to BHX.

Jon

[Parm Singh]

Hi Jon,

That is exactly the issue.

Nothing LAN side had been changed - meaning both BHX & STN point to the DG of their esiting Watchgurard their old Gateway.

Hence i dont understand why traffic would strat to route through the new Cisco's, nothing has this set as default gateway.

I was therefore thinking maybe OSPF was traveling to the LAN somehow possibly they have some L3 devices in the mix, which detected the new OSPF routes.

I will have to do some more testing out of hours - and take it from there.

Thanks for confirming  :

really want to just use OSPF on between the 2911's & 3750 for link failover, and stop it at the LAN ports of the 2911

Well i think you have done that with the passive statements. I don't think that's the problem.

[Jon Marshall]

Parm

Right, now i fully understand.

Does the WatchGuard connect back to the main site in anyway (main site being the 3750 site ?).

Also, presumably the WatchGuard does not particpate in OSPF ?

Jon

[Parm Singh]

Hi Jon,

No the Watchgrard has no route to HQ (3750) nore is it configured for Dynamic Routing (OSPF)

Hence my confusion, i'm thinkinking there must be some other device hidden on the LAN which is activly learing routes.

Thanks Parm

[Jon Marshall]

Parm

Interesting problem, must admit.  I would like to know the solution if and when you find out. 

Edit - there is no chance that the IP address of the WatchGuard LAN interface has been reused on the 2911's is there ?

Jon