Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ospf help

Guys currently we have one wan router and its connected to layer three switch (Switch A)….(via vlan 100) now the same layer three switch is connected to firewall (using layer three interface) the firewall is connected to another layer three switch Switch B trusted network) now there are couple of networks being used behind firewall. The current configs has all static routes……the default route is pointed towards WAN router (Ethernet interface) on the same switch static routes has been config for all the networks and it points towards the firewall external interface (which is connected to Switch A).

Now we have to redesign the network and we will be adding two WAN routers to same Service provider (but with different subnet) so the current switch A will be connected to different WAN routers for redundancy (both WAN routers is owned by same service provider. Now our primary focus is that the link which goes to first router shd be primary and the link which goes to second router shd be secondary and we have to use ospf between Switch A and routers. It shd not be active situation when first link fails the traffic shd be diverted to second router. Same shd be done on WAN routers as we will be using BGP between site and service provider.

Now I will use MED to do that but I am not sure how I will use ospf keeping in mind that we will be not suing ospf between firewall and switch. I am totally confused….how we will pick up and make preference on ospf for redundancy…….and how we will replace ospf with those static routes or static routes has to be there I am totally confused….can someone plz help me out …..first I thought that I will use HSRP but the problem is that we have to use different subnet between switch A and two routers…….in which we cant use HSRP

New Member

Re: ospf help

If both WAN routers are terminating in the same switch. why can't you set the WAN routers in the same VLAN and have HSRP running for this segment

Otherwise your option is to have firewalls running OSPF. You need redistribution from BGP to OSPF on WAN routers (not recommended if you receiving the whole internet routing table), or if you are only receiving default route from ISP you can do the following:

router ospf X

default-information originate

Note: WAN routers need to run ospf as well in this case.

New Member

Re: ospf help

thanks for reply now if you see above i have emntioned that , that both routers ethernet would be in different subnet so i cant use same vlan......secondly firewall cant use ospf....i hope its bit more clear ....i am totally confuse how i will do it...if u need any more info plz let me know

New Member

Re: ospf help

Well..That's the thing

you did not explain why they have to be in different subnet. I mean where's the limitation.

If you have them in the same switch, or even switches which are interconnected together you can always trunk that vlan across and have HSRP on "inside" interface of the WAN routers.

The outside interface (towards ISP) can have a different segment without worrying

you are pretty much stuck with this option unless your firewall knows OSPF. Otherwise you need to point the static route from the firewalls to an HSRP.

post a diagram if you think this explanation does not solve the problem

New Member

Re: ospf help

Thanks for your reply now probably i am pretty bad at explaning :-) now i need the solution form swicth A and two routers which will be attached to that switch (each router will b ein different subnet) now how will i config ospf so that all traffic shd go via first link to router 1 and if router 1 fails it will go through router 2......i have tro config bgp on wan routers as well.....what i am worried abt is how i will route traffic to networks which atre behind firewall.....before everything was static if u read my first post....and how will i config ospf???

New Member

Re: ospf help

I think you do not understand what i'm saying :)

- please tell me: how many interfaces on the WAN router you will use? Is it correct to assume that the WAN router will have a connection to the ISP (1 interface) and a connection to the switch A (another interface). Do you have a similar setup to on WAN router 2?

- both routers connect to the same switch A?

if the answer is YES to both questions, then definitely yes, you can use HSRP.

New Member

Re: ospf help

yes both routers connect to same switch A and if i have to use different subnets for LAN between switch and routers how can i use HSRP (i have mentioned that in previous email) both WAN routers will have connection to same did u get the point.....we dont want that both routers shd be active (ie loadbalancing)

Hall of Fame Super Silver

Re: ospf help

Hello Khan,

you can use OSPF to generate a default route of type O E1 on both WAN routers.

primary router will use a lower seed metric and will be preferred.

you can configure it to check that an eBGP default route is received

router ospf 10

! or other network used between SWA and router

network area 0

default-information originate type 1 route-map check-bgp

ip prefix-list only-default permit

access-list 11 permit host primary-ebgp-peer-address

route-map check-bgp permit 10

! check the presence of a BGP default

match ip address prefix only-default

! check default route BGP next-hop

match ip next-hop 11

set metric 50

WAN router B will use a seed metric of 100.

All this can work if SwitchA is after the firewall and can talk OSPF with both WAN routers.

Hope to help


New Member

Re: ospf help

Thanks Giuseppe

Now cant we use ospf cost on switch for primary link to router as well as towards secondray router???? if yes how we do it...i have two vlans different subnets (thats is design so cant change it) now i want that from switch the packet shd be routes to primary link and if primary link goes down or link between swicth and router goes down it shd divert toi secondry we will do that....both WAN routers are connected to same service provider.....thanks

Hall of Fame Super Silver

Re: ospf help

Hello Khan,

what I have suggested works for your scenario:

using an O E1 means that the OSPF metric for the is calculated as:

seed metric + path metric to ASBR

in your case with my suggested config it would be:

50+1 on the primary path

100+1 on secondary path

changing the cost on the links is not necessary you can use different seed metrics as I proposed.

Hope to help


New Member

Re: ospf help


I understood you very well but i just wanted to give you a solution to your problem.

My question was very simple. Why do you need to use different subnets when you don't have to.

Why can't you just use the same subnet! Because i'm telling you: you can with the setup that you have.

That's the key: "you can use the same subnet and do HSRP". Now it's up to you if you want to be flexible or not and go this way.

I think you do not understand the flexibility that you have with you gear and your existing setup.

The switch NEEDS to be only layer 2 for routers WAN1 and WAN2, and firewall.


Setup vlan 100 on the switch:

vlan 100


int fa0/1

switchport mode access

switchport access vlan 100

description To WAN_A

int fa0/2

switchport mode access

switchport access vlan 100

description TO WAN_B

int fa0/3

switchport mode access

switchport access vlan 100

description TO FW1

VERY IMPORTANT NOTE: Do not route or allocate an IP address to vlan100 on the SWITCH. Switch should not participate in VLAN 100 routing. WAN1 and WAN2 will route this subnet , and the firewall

Now you have yourself a layer 2 setup for connection to WAN_A and WAN_B, subsequently you can do HSRP on those routers.

define ip addresses:



HSRP between the 2:

HSRP messages will easily flow through vlan 100 layer 2 setup on the switch.


bring up interface

configure ip

(note. if you have trunk to your firewall. you need to define vlan 100 on the fw, if you plan to use separate interface, no need to do so)

setup default gateway on the firewall to HSRP address of routers.

Thats about it.

The key here is that your switch is a layer 2 interconnection point for vlan 100

As you need to have different subnets on routers