In This Section: |
Open Shortest Path First (OSPF) is a link-state routing protocol that calculates forwarding tables in an IP-based internetwork. OSPF is the preferred Interior Gateway Protocol (IGP) for Check Point.
OSPF supports IPv6. OSPF for IPv6 is also referred to as OSPF version 3 (OSPFv3). OSPFv3 is defined in RFC 5340 (which makes RFC 2740 obsolete).
For IPv6, VRRP clusters are supported. ClusterXL clusters are not supported.
The IPv6 address appearing in the source of OSPF packets sent on the interface must be a link-local address, that is, an FE80::/64 address. A link-local address is automatically added to each interface when IPv6 is enabled on Gaia. The addresses are used for next hops, to advertise routes, and to send hello messages. OSPF advertises the IPv6 addresses defined by the user, but OSPF exchanges routes using the FE80 addresses. A /64 address is required by the OSPFv3 protocol. If the peer router does not use an FE80::/64 address, OSPFv3 does not work.
OSPFv2 is used with IPv4. See OSPF.
To use OSPFv3 with VRRPv3, enable the Virtual Address option on the IPv6 OSPF Interface configuration page. If the configured interface is part of the VRRP master virtual router, OSPFv3 runs on the interface. When you enable this option, OSPFv3 uses the VRRPv3 virtual link-local address for the interface as the source of its control packets. This cannot be the automatically configured link-local address—that is, you must change the link-local address for the interface to something other than the default. You must configure the same link-local address on all the routers in the VRRP group.
VRRP installs the link-local address only on the master, so OSPFv3 runs only on that router. If a failover occurs, VRRPv3 installs the link-local address on the new master and OSPFv3 starts running on that system. Because OSPFv3 runs on one router at a time, there is no synchronization of OSPFv3 state between the VRRP group members.
OSPFv3 has almost the same configuration parameters as OSPFv2.
To configure IPv6 OSPF:
Note - To prevent an address range from being advertised into the backbone, select Restrict for the address range |
Configure these IPv6 OSPF global parameters.
Note: Graceful Restart Helper is not supported.
Parameter |
Description |
---|---|
Router ID |
A number that uniquely defines the router in a routing domain.
|
SPF Delay |
The time (in seconds) the system waits before recalculating the OSPF routing table after a change in the topology.
|
SPF Hold Time |
The minimum time (in seconds) between recalculations of the OSPF routing table.
|
Default ASE Route Cost |
When routes from other protocols are redistributed into OSPF as ASEs, they are assigned this configured cost unless a cost has been specified for the individual route.
|
Default ASE Route Type |
When routes from other protocols are redistributed into OSPF as ASEs, they are assigned this route type, unless a type has been specified for the individual route. ASEs can either be type 1 or type 2.
|
Configure these IPv6 OSPF Area parameters.
The Areas section shows the IPv6 OSPF parameters of each area.
Add/Edit Area
Parameter |
Description |
---|---|
Area |
For the name of the area, choose an IPv4 address (preferred) or an integer. |
Use Stub Area Type |
A Stub Area is an area in which there are no Autonomous System External (ASE) routes. ASE routes are routes to destinations external to the AS. Note: The backbone area cannot be a stub area. NSSA Areas are not supported.
|
Stub Area Parameters
These parameters show if you define the area as a stub area.
Parameter |
Description |
---|---|
Cost for Default Route |
The cost for the default route to the stub area.
|
Totally Stubby |
An area in which there are no ASE routes or summary routes.
|
Add/Edit Address Range
Parameter |
Description |
---|---|
Address Range |
An area can be configured with any number of address ranges. Address ranges are used to reduce the number of routing entries that a given area will emit into the backbone (and hence all) areas. An address range is defined by a prefix and a mask length. If a given prefix aggregates a number of more specific prefixes within an area, then an address range can be configured and will be the only prefix advertised into the backbone. Be careful when configuring an address range that covers parts of a prefix that are not contained within the area. |
Restrict |
Prevent an address from being advertised into the backbone.
|
Add/Edit Stub Network
Parameter |
Description |
---|---|
Address Range |
OSPF can advertise reachability to prefixes that are not running OSPF by configuring a stub network. The advertised prefix shows as an OSPF internal route and can be filtered at area borders with the OSPF area ranges. The prefix must be directly reachable on the router where the stub network is configured (that is, one of the routers interface addresses must fall in the prefix) in order to be included in the router-LSA. Stub hosts are configured by specifying a mask length of 128. An address range is defined by a prefix and a mask length. A prefix and mask can be advertised. That can be activated by the local address of a point-to-point interface. To advertise reachability to such an address, enter an IP address for the prefix and a non-zero cost for the prefix.
|
Cost |
The cost associated with the stub network. The higher the cost, the less preferred the prefix as an OSPF route.
|
To configure an IPv6 OSPF interface:
The OSPF interface configuration parameters are displayed showing the default settings. If you want to accept the default settings for the interface, no further action is necessary.
Note - The hello interval and dead interval must be the same for all routers on the link. Authentication is not supported for IPv6 OSPF interfaces.
Add/Edit Area
Parameter |
Description |
---|---|
Interface |
The interfaces for OSPF configuration. An interface must have an area associated with it in order to become active in OSPF. |
Area |
The OSPF area to which the interface belongs. An OSPF area defines a group of routers running OSPF that have the complete topology information of the area. OSPF areas use an area border router to exchange information about routes. Routes for a given area are summarized into the backbone area for distribution into other non-backbone areas. An area border router (ABR) is one that has at least two interfaces in at least two different areas. One of those areas must be the backbone or the router must have a virtual link configured. OSPF forces a hub and spoke topology of areas, with the backbone area always being the hub.
|
Hello interval |
The time, in seconds, between hello packets that the router sends on the interface. For a given link, this must be the same on all routers or adjacencies will not be created.
|
Dead interval |
The number of seconds after a router stops receiving hello packets that it declares the neighbor is down. Typically, the value of this field should be four times the size of the hello interval. For a given link, this field must be the same on all routers or adjacencies will not be created. The value must not be zero.
|
Retransmit interval |
The number of seconds between LSA retransmissions, for adjacencies belonging to this interface. Also used when retransmitting Database Description and Link State Request Packets. This should be well over the expected round-trip delay between any two routers on the attached network. The setting of this value should be conservative or needless retransmissions will result.
|
OSPF Cost |
The weight of a given path in a route. The higher the cost, the less preferred the link. You may explicitly override this setting in route redistribution. To use one interface over another for routing paths, give one a higher cost.
|
Election Priority |
The priority for becoming the designated router (DR) on this link. When two routers attached to a network both attempt to become a designated router, the one with the highest priority wins. If there is currently an elected DR on the link, it will remain the DR regardless of the configured priority. This feature prevents the DR from changing too often. This field is only relevant on a shared-media interface (Ethernet), as a DR is not elected on point-to-point type interfaces. A router with priority 0 is not eligible to become the designated router.
|
Passive |
An interface in passive mode does not send hello packets out of the given interface. This means no adjacencies are formed on the link. The purpose of passive mode is to make it possible for the network associated with the interface to be included in the intra-area route calculation. In non passive mode, the network is redistributed into OSPF and is an ASE. In passive mode, all interface configuration information is ignored, with the exception of the associated area and the cost.
|
Virtual Address |
Directs OSPFv3 to use the VRRPv3 virtual link-local address as the source of its control packets. When enabled, OSPFv3 runs on the interface only while the local router is the master with respect to a VRRPv3 state machine on the interface. Note: The VRRPv3 state machine must back-up an IPv6 link-local address that is not auto-configured on the interface.
|
The commands for OSPFv3 are similar to those for OSPFv2, except that instead of ospf
you type ipv6 ospf3
.
set ipv6 ospf
Clish commands. There are no add ipv6 ospf
commands. off
setting in the set
command. There are no delete ipv6 ospf
commands.To show the configuration, use show ipv6 ospf
commands.
To work with OSPFv3, you must enable IPv6 on Gaia. This automatically adds FE80::/64 link local to the interfaces.
When you do initial configuration, set the router ID. Use this command:
|
Parameter |
Description |
|
Selects the highest interface address when OSPF is enabled. |
|
Specifies a specific IP address to assign as the router ID. Do not use 0.0.0.0 as the router ID address. Best Practice - Check Point recommends setting the router ID rather than relying on the default setting. Setting the router ID prevents the ID from changing if the default interface used for the router ID goes down. The Router ID uniquely identifies the router in the autonomous system. The router ID is used by the BGP and OSPF protocols. We recommend setting the router ID rather than relying on the default setting. This prevents the router ID from changing if the interface used for the router ID goes down. Use an address on a loopback interface that is not the loopback address (127.0.0.1). Note - In a cluster, you must select a router ID and make sure that it is the same on all cluster members.
|
set ipv6 ospf3 default-ase-cost <1-16777215> default-ase-type <1 | 2> spf-delay <1-60> | default spf-holdtime <1-60> | default |
Note: The graceful-restart-helper
parameter is not supported.
Parameter |
Description |
---|---|
default-ase-cost <1-16777215> |
When routes from other protocols are redistributed into OSPF as ASEs, they are assigned this configured cost unless a cost has been specified for the individual route.
|
default-ase-type <1|2> |
When routes from other protocols are redistributed into OSPF as ASEs, they are assigned this route type, unless a type has been specified for the individual route. ASEs can either be type 1 or type 2.
|
spf-delay <1-60> |
The time (in seconds) the system waits before recalculating the OSPF routing table after a change in the topology.
|
spf-holdtime <1-60> |
The minimum time (in seconds) between recalculations of the OSPF routing table.
|
Use the following commands to configure OSPFv3 (IPv6 OSPF) areas, including the backbone and stub areas.
NSSA is not available for OSPFv3
set ipv6 ospf3 area ospf_area <on | off> set ipv6 ospf3 area ospf_area stub <on | off> stub default-cost <1-677215> stub summary <on | off> range VALUE <on | off> range VALUE restrict VALUE stub-network VALUE <on | off> stub-network VALUE stub-network-cost <1-65535> |
Parameter |
Description |
---|---|
ospf_area |
For the name of the area, choose an IPv4 address (preferred) or an integer. |
|
A Stub Area is an area in which there are no Autonomous System External (ASE) routes. ASE routes are routes to destinations external to the AS. Note: The backbone area cannot be a stub area. NSSA Areas are not supported. Default: Off |
|
The cost for the default route to the stub area. Default: No default. |
|
An area in which there are no ASE routes or summary routes. Default: Off |
|
An area can be configured with any number of address ranges. Address ranges are used to reduce the number of routing entries that a given area will emit into the backbone (and hence all) areas. An address range is defined by a prefix and a mask length. If a given prefix aggregates a number of more specific prefixes within an area, then an address range can be configured and will be the only prefix advertised into the backbone. Be careful when configuring an address range that covers parts of a prefix that are not contained within the area. |
|
Prevent an address from being advertised into the backbone. |
|
OSPF can advertise reachability to prefixes that are not running OSPF by configuring a stub network. The advertised prefix shows as an OSPF internal route and can be filtered at area borders with the OSPF area ranges. The prefix must be directly reachable on the router where the stub network is configured (that is, one of the routers interface addresses must fall in the prefix) in order to be included in the router-LSA. Stub hosts are configured by specifying a mask length of 128. An address range is defined by a prefix and a mask length. A prefix and mask can be advertised. That can be activated by the local address of a point-to-point interface. To advertise reachability to such an address, enter an IP address for the prefix and a non-zero cost for the prefix.
|
|
The cost associated with the stub network. The higher the cost, the less preferred the prefix as an OSPF route. Default: 1 |
Note - The hello interval and dead interval must be the same for all routers on the link. Authentication is not supported for IPv6 OSPF interfaces.
set ipv6 ospf3 interface <interface_name> area <ospf_area> <on|off> cost
dead-interval <1-65535> hello-interval
passive <on | off> priority <0-255> retransmit-interval
virtual-address <on|off> |
Parameter |
Description |
---|---|
|
The interfaces for OSPF configuration. An interface must have an area associated with it in order to become active in OSPF. |
|
The OSPF area to which the interface belongs. An OSPF area defines a group of routers running OSPF that have the complete topology information of the area. OSPF areas use an area border router to exchange information about routes. Routes for a given area are summarized into the backbone area for distribution into other non-backbone areas. An area border router (ABR) is one that has at least two interfaces in at least two different areas. One of those areas must be the backbone or the router must have a virtual link configured. OSPF forces a hub and spoke topology of areas, with the backbone area always being the hub. For the name of the area, choose an IPv4 address (preferred) or an integer.
|
|
The weight of a given path in a route. The higher the cost, the less preferred the link. You may explicitly override this setting in route redistribution. To use one interface over another for routing paths, give one a higher cost.
|
|
The number of seconds after a router stops receiving hello packets that it declares the neighbor is down. Typically, the value of this field should be four times the size of the hello interval. For a given link, this field must be the same on all routers or adjacencies will not be created. The value must not be zero.
|
|
The time, in seconds, between hello packets that the router sends on the interface. For a given link, this must be the same on all routers or adjacencies will not be created.
|
|
An interface in passive mode does not send hello packets out of the given interface. This means no adjacencies are formed on the link. The purpose of passive mode is to make it possible for the network associated with the interface to be included in the intra-area route calculation. In non passive mode, the network is redistributed into OSPF and is an ASE. In passive mode, all interface configuration information is ignored, with the exception of the associated area and the cost.
|
|
The priority for becoming the designated router (DR) on this link. When two routers attached to a network both attempt to become a designated router, the one with the highest priority wins. If there is currently an elected DR on the link, it will remain the DR regardless of the configured priority. This feature prevents the DR from changing too often. This field is only relevant on a shared-media interface (Ethernet), as a DR is not elected on point-to-point type interfaces. A router with priority 0 is not eligible to become the designated router.
|
|
The number of seconds between LSA retransmissions, for adjacencies belonging to this interface. Also used when retransmitting Database Description and Link State Request Packets. This should be well over the expected round-trip delay between any two routers on the attached network. The setting of this value should be conservative or needless retransmissions will result.
|
|
Directs OSPFv3 to use the VRRPv3 virtual link-local address as the source of its control packets. When enabled, OSPFv3 runs on the interface only while the local router is the master with respect to a VRRPv3 state machine on the interface. Note: The VRRPv3 state machine must back-up an IPv6 link-local address that is not auto-configured on the interface.
|
Note - If OSPF is used without the virtual-address option in a VRRP cluster, you must make sure that each router selects a different
|
Example of OSPFv3 configuration:
set ipv6 ospf3 interface eth1 area backbone on
To change default OSPFv3 parameters:
set ipv6 ospf3 interface eth1 cost 2
set ipv6 ospf3 interface eth1 priority 2
set ipv6 ospf3 interface eth1 hello-interval 20
set ipv6 ospf3 interface eth1 dead-interval 80
set ipv6 ospf3 interface eth1 retransmit-interval 20
To configure OSPFv3 to run on the VRRP Virtual Address:
set ipv6 ospf3 interface eth1 virtual-address on
You can monitor IPv6 OSPF in the Gaia Portal and in the Gaia Clish.
To monitor and troubleshoot the IPv6 OSPFv3, run this command:
show ipv6 ospf3
border-routers
database
area {backbone | <
area_id>}
areas [detailed]
checksum
database-summary
detailed
external-lsa [detailed]
inter-area-prefix-lsa [detailed]
inter-area-router-lsa [detailed]
intra-area-prefix-lsa [detailed]
link-lsa [detailed]
network-lsa [detailed]
router-lsa [detailed]
type {1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9}
errors {dd | hello | ip | lsack | lsr | lsu | protocol}
events
interface <
interface_name> [detailed | stats]
interfaces [detailed | stats]
neighbor <
neighbor_IP> [detailed]
neighbors [detailed]
packets
routemap
summary
Where:
Parameter |
Description |
---|---|
|
Shows the state of each area border router:
|
|
Show the OSPF database information:
|
|
Number of error messages sent, per type:
|
|
Number of these types of events:
|
|
Shows OSPF information for the specified interface:
|
|
Shows OSPF information for all interfaces:
|
|
Shows OSPF information for the specified OSPF neighbor:
|
|
Shows OSPF information for each OSPF neighbor:
|
|
Shows the number of received (Rx) and transmitted (Tx) OSPF packets:
|
|
Shows OSPF Import Policy and Export Policy. |
|
Shows detailed OSPF configuration. |