Questions about ospf topology

[tigerxxx1]

Hi,

i'm not so familiar with dynamic routing and ospf.

I have two IPVPN Cisco routers, those routers have tunnels to many remote sites.
the main routers have ospf enabled.
they have ospf area via each remote site. the routers work in active/active mode.
they also have area 0 - BB against the BB Switch inside.
so today the BB Switch is getting updates to which router it should pass the packet to each network through R1 or R2.

now, i want to remove the OSPF from the BB switch and replace it with Checkpoint FW without OSPF.
i want to configure 2 hsrp on routers(R1 primary on hsrp1, R2 primary on hsrp2), and to configure the FW to send traffic through the routers with either active/passive between the routers (send always to R1, and if failes send to R2) or load balancing between two hsrp addresses.

I have two questions:
1. if both routers have routes through ospf to network X, if I send the packet from the FW to R1, will always R1 send the packet forward or it will send some packets to R2 to process based on costs etc..? (will be load balancing between routers on packets coming from routers to remote sites or I have to make the load balancing from the FW level ?)

2. if indeed the router who gets the packet from fw is the same who forwards it to remote site(if it's wrong, correct me), and lets say I do load balancing from FW to routers, so when R1 get packet from fw, it forwards the packet to remote site5, now the return packet from remote site5 can choose R2 to send the packet through because it has maybe better cost(right?). which cause some assymetric route (same session goes through r1 and comes back through r2).. does that normal and optimal with dynamic routing and ospf? or it will cause problems or slower traffic, etc..

Thanks a lot!!

[Jon Marshall]

Amir

1) You can only tell this by looking at the routing table. If both R1 and R2 are receiving the same routes from the WAN and they are peering with each other then they should each send any packets to remote destinations direct onto the WAN because the cost of going via the other router will be higher.

2) Yes you could well get asymmetric routing ie. traffic goes out via R1 and comes in via R2. Generally speaking asymmetric routing in redundant networks is quite common because routing protocols only consider the next hop. If you have devices that keep track of the connection in the path then this can cause a problem. Firewalls are one of the main considerations in this respect. But your firewall is behind the routers so it is not a concern for you.

Jon

[tigerxxx1]

Thanks a lot!

it was very helpful.