Print Download PDF Send Feedback

Previous

Next

OSPF

In This Section:

Types of Areas

Area Border Routers

High Availability Support for OSPF

Configuring OSPF - Gaia Portal

Configuring OSPF - Gaia Clish (ospf)

Monitoring IPv4 OSPFv2

Open Shortest Path First (OSPF) is an interior gateway protocol (IGP) used to exchange routing information between routers within a single autonomous system (AS). OSPF calculates the best path based on true costs using a metric assigned by a network administrator. RIP, the oldest IGP protocol chooses the least-cost path based on hop count. OSPF is more efficient than RIP, has a quicker convergence, and provides equal-cost multipath routing where packets to a single destination can be sent using more than one interface. OSPF is suitable for complex networks with a large number of routers. It can coexist with RIP on a network.

Gaia supports OSPFv2, which supports IPv4 addressing.

You can run OSPF over a route-based VPN by enabling OSPF on a virtual tunnel interface (VTI).

Types of Areas

Routers using OSPF send packets called Link State Advertisements (LSA) to all routers in an area. Areas are smaller groups within the AS that you can design to limit the flooding of an LSA to all routers. LSAs do not leave the area from which they originated, thus increasing efficiency and saving network bandwidth.

You must specify at least one area in your OSPF network—the backbone area, which has the responsibility to propagate information between areas. The backbone area has the identifier 0.0.0.0.

You can designate other areas, depending on your network design, of the following types:

Best Practice - It is generally recommended that you limit OSPF areas to about 50 routers based on the limitations of OSPF (traffic overhead, table size, convergence, and so on).

All OSPF areas must be connected to the backbone area. If you have an area that is not connected to the backbone area, you can connect it by configuring a virtual link, enabling the backbone area to appear contiguous despite the physical reality.

Note - If you need to connect two networks that both already have backbone areas and you do not want to reconfigure one to something other than 0.0.0.0, you can connect the two backbone areas using a virtual link.

Each router records information about its interfaces when it initializes and builds an LSA packet. The LSA contains a list of all recently seen routers and their costs. The LSA is forwarded only within the area it originated in and is flooded to all other routers in the area. The information is stored in the link-state database, which is identical on all routers in the AS.

Area Border Routers

Routers called Area Border Routers (ABR) have interfaces to multiple areas. ABRs compact the topological information for an area and transmit it to the backbone area. Check Point supports the implementation of ABR behavior as outlined in the Internet draft of the Internet Engineering Task Force (IETF). The definition of an ABR in the OSPF specification as outlined in RFC 2328 does not require a router with multiple attached areas to have a backbone connection. However, under this definition, any traffic destined for areas that are not connected to an ABR or that are outside the OSPF domain is dropped. According to the Internet draft, a router is considered to be an ABR if it has more than one area actively attached and one of them is the backbone area. An area is considered actively attached if the router has at least one interface in that area that is not down.

Rather than redefine an ABR, the Check Point implementation includes in its routing calculation summary LSAs from all actively attached areas if the ABR does not have an active backbone connection, which means that the backbone is actively attached and includes at least one fully adjacent neighbor. You do not need to configure this feature; it functions automatically under certain topographies.

OSPF uses the following types of routes:

All routers on a link must agree on the configuration parameters of the link. All routers in an area must agree on the configuration parameters of the area. A separate copy of the SPF algorithm is run for each area. Misconfigurations prevent adjacencies from forming between neighbors, and routing black holes or loops can form.

High Availability Support for OSPF

Gaia supports the OSPF protocol in clusters configured either via VRRP or ClusterXL.

In this configuration, the cluster becomes a Virtual Router. The neighbor routers see it as a single router, where the virtual IP address of the cluster becomes the router ID. Each member of the cluster runs the OSPF process, but only the master actively exchanges routing information with the neighbor routers. When a failover occurs, a standby member of the cluster becomes the master and begins exchanging routing information with the neighbor routers.

Gaia also supports the OSPF protocol over VPN tunnels which terminate in the VRRP or ClusterXL cluster.

VRRP

Gaia supports advertising of the virtual IP address of the VRRP Virtual Router instead of the actual interface IP address. If you enable this option, but do not enable Graceful Restart, OSPF runs only on the master of the Virtual Router. During a failover, a traffic break may occur, while the new VRRP master becomes active and learns the OSPF routes. This happens because the OSPF route database exists only on the master and is not synchronized on all members of the cluster. The larger the network, the more time it takes OSPF to synchronize its database and install routes again.

To avoid traffic loss during failovers, you can configure Graceful Restart. In this case, the master synchronizes the route table with the VRRP backup member. If the master fails, the backup member takes on a role of the new master, sends grace-LSAs to the OSPF neighbors, and establishes adjacencies with them. The new master keeps the kernel routes that were installed before the failover until it establishing full adjacency with the neighbors.

Note - You must use monitored-circuit VRRP, not VRRP v2, when configuring virtual IP support for OSPF or any other dynamic routing protocol.

ClusterXL

Gaia ClusterXL advertises the virtual IP address of the ClusterXL Virtual Router. The OSPF routes database of the master is synchronized across all members of the cluster. The OSPF task of each standby member obtains routing state and information from the master and installs the routes in the kernel as the master does. On a failover, one of the standby members becomes the new master and then continues where the old master failed. During the time that the new master resynchronizes routes database with the neighbor routers, traffic forwarding continues using the old kernel routes until OSPF routes are fully synchronized and pushed into the kernel.

Configuring OSPF - Gaia Portal

To configure OSPF:

  1. In the Network Management > Network interfaces page of the Gaia Portal, configure Ethernet Interfaces and assign an IP address to the interface.
  2. Open the Advanced Routing > OSPF page of the Gaia Portal.
  3. Define other Global settings, including the Router ID.
  4. Optional: Define additional OSPF areas (in addition to the backbone area).
  5. Optional: For each area, you can add one or more address ranges if you want to reduce the number of routing entries that the area advertises into the backbone.

    Note - To prevent an address range from being advertised into the backbone, select Restrict for the address range
  6. Configure OSPF Interfaces.
  7. Configure virtual links for any area that does not connect directly to the backbone area.

Configuring OSPF Global Settings

The following table shows the global settings that you can specify for OSPF. Configure these settings by clicking OSPF under Configuration > Routing Configuration in the tree view and scrolling down to these fields.

Global Settings for OSPF

Parameter

Description

Router ID

The Router ID uniquely identifies the router in the autonomous system. The router ID is used by the BGP and OSPF protocols. We recommend setting the router ID rather than relying on the default setting. This prevents the router ID from changing if the interface used for the router ID goes down. Use an address on a loopback interface that is not the loopback address (127.0.0.1).

Note - In a cluster, you must select a router ID and make sure that it is the same on all cluster members.

  • Range: Dotted-quad.([0-255].[0-255].[0-255].[0-255]). Do not use 0.0.0.0
  • Default: The interface address of one of the local interfaces.

RFC1583 Compatibility

This implementation of OSPF is based on RFC2178, which fixed some looping problems in an earlier specification of OSPF. If your implementation is running in an environment with OSPF implementations based on RFC1583 or earlier, enable RFC 1583 compatibility to ensure backwards compatibility.

  • Default: Selected

SPF Delay

Specifies the time in seconds the system will wait to recalculate the OSPF routing table after a change in topology.

  • Default: 2.
  • Range: 1-60.

SPF Hold Time

Specifies the minimal time in seconds between recalculations of the OSPF routing table.

  • Default:5.
  • Range: 1-60.

Default ASE Route Cost

Specifies a cost for routes redistributed into OSPF as ASs. Any cost previously assigned to a redistributed routed overrides this value.

Default ASE Route Type

Specifies a route type for routes redistributed into OSPF as ASs, unless these routes already have a type assigned.

There are two types:

  • Type 1 external: Used for routes imported into OSPF which are from IGPs whose metrics are directly comparable to OSPF metrics. When a routing decision is being made, OSPF adds the internal cost to the AS border router to the external metric.
  • Type 2 external: Used for routes whose metrics are not comparable to OSPF internal metrics. In this case, only the external OSPF cost is used. In the event of ties, the least cost to an AS border router is used.

Configuring OSPF Graceful Restart

OSPF Graceful Restart lets uninterrupted forwarding during a ClusterXL High Availability or VRRP cluster failover.

To enable OSPF Graceful Restart, do these:

To enable Graceful Restart in Gaia Portal:

  1. Go to Advanced Routing > OSPF.
  2. In the Global Settings section, select Graceful Restart.
  3. Enter the Grace Period in seconds (1 to 1800, default is 120).

    Note - On the DR and BDR, select the Graceful Restart Helper.

  4. Click Apply.

To see if Graceful Restart is enabled on a Security Gateway:

Configuring OSPF Areas

The following table lists the parameters for areas and global settings that you use when configuring OSPF on your system. As you add areas, each is displayed with its own configuration parameters under the Areas section.

OSPF Normal Type Area Configuration Parameters

Parameter

Description

Add Address Range

You can configure any area with any number of address ranges. Use these ranges to reduce the number of routing entries that a given area emits into the backbone and thus all areas. If a given IPv4 address aggregates a number of more specific IPv4 addresses within an area, you can configure an address that becomes the only IPv4 address advertised into the backbone. You must be careful when configuring an address range that covers parts of an IPv4 address not contained within the area. By definition, an address range consists of a IPv4 address and a mask length.

Note: To prevent a specific IPv4 address from being advertised into the backbone, select Restrict.

Add Stub Network

OSPF can advertise reachability to IPv4 addresses that are not running OSPF using a stub network. The advertised IPv4 address appears as an OSPF internal route and can be filtered at area borders with the OSPF area ranges. The IPv4 address must be directly reachable on the router where the stub network is configured; that is, one of the router's interface addresses must fall within the IPv4 address to be included in the router-LSA. You configure stub hosts by specifying a mask length of 32.

This feature also supports advertising an IPv4 address and mask that can be activated by the local address of a point-to-point interface. To advertise reachability to such an address, enter an IP address and a cost with a value other than zero.

Area Type

For descriptions of area types, see Types of Areas.

Options: Normal/Stub/NSSA.

Stub Area Parameters

The following table stub areas configuration parameters appear if you define the area as a stub area.

Parameter

Description

Cost for Default Route

Enter a cost for the default route to the stub area.

  • Range: 1-16777215.
  • Default: No default.

Import Summary Routes

Specifies if summary routes (summary link advertisements) are imported into the stub area or NSSA. Each summary link advertisement describes a route to a destination outside the area, yet still inside the AS (i.e. an inter-area route). These include routes to networks and routes to AS boundary routers.

  • Default: Selected.

NSSA (Not So Stubby Area) Parameters

The following table describes the configuration parameters for NSSA areas. These fields appear if you define the area as an NSSA (Not So Stubby Area). For more information on NSSA, see RFC 3101.

Parameter

Description

Translator Role

Specifies whether this NSSA border router will unconditionally translate Type-7 LSAs into Type-5 LSAs. When role is Always, Type-7 LSAs are translated into Type-5 LSAs regardless of the translator state of other NSSA border routers. When role is Candidate, this router participates in the translator election to determine if it will perform the translations duties. If this NSSA router is not a border router, then this option has no effect.

  • Default: Candidate.

Translator Stability Interval

Specifies how long in seconds this elected Type-7 translator will continue to perform its translator duties once it has determined that its translator status has been assumed by another NSSA border router. This field appears only if an area is defined as an NSSA with translator role as Candidate.

  • Default: 40 seconds.

Import Summary Routes

Specifies if summary routes (summary link advertisements) are imported into the stub area or NSSA. Each summary link advertisement describes a route to a destination outside the area, yet still inside the AS (i.e. an inter-area route). These include routes to networks and routes to AS boundary routers.

  • Default: On.

Cost for Default Route

Enter a cost associated with the default route to the NSSA.

Default Route Type

Specifies the route type associated with the Type-7 default route for an NSSA when routes from other protocols are redistributed into OSPF as ASs. If a redistributed route already has a route type, this type is maintained. If summary routes are imported into an NSSA, only then a Type-7 default route is generated (otherwise a Type-3 default route is generated). This field appears only if an area is defined as an NSSA into which summary routes are imported.

The route type can be either 1 or 2. A type 1 route is internal and its metric can be used directly by OSPF for comparison. A type 2 route is external and its metric cannot be used for comparison directly.

  • Default: 1

Redistribution

Specifies if both Type-5 and Type-7 LSAs or only Type-7 LSAs will be originated by this router. This option will have effect only if this router is an NSSA border router and this router is an AS border router.

  • Default: On

Type 7 Address Ranges

An NSSA border router that performs translation duties translates Type-7 LSAs to Type-5 LSAs. An NSSA border router can be configured with Type-7 address ranges. Use these ranges to reduce the number of Type-5 LSAs. Many separate Type-7 networks may fall into a single Type-7 address range. These Type-7 networks are aggregated and a single Type-5 LSA is advertised. By definition, a Type-7 address range consists of a prefix and a mask length.

Note: To prevent a specific prefix from being advertised, select On in the Restrict field next to the entry for that prefix.

Configuring OSPF Virtual Links

You must configure a virtual link for any area that does not connect directly to the backbone area. You configure the virtual link on both the ABR for the discontiguous area and another ABR that does connect to the backbone.

The virtual link acts like a point-to-point link. The routing protocol traffic that flows along the virtual link uses intra-area routing only.

To configure a virtual link:

  1. Create a Normal Type area (which does not connect directly to the backbone area) and configure an interface to be in that area.
  2. In the Virtual Links section, click Add.
  3. In the Add Virtual Link window, enter the Remote Router ID of the remote endpoint of the virtual link.
  4. Select the Transit Area. This is the area that connects both to the backbone and to the discontiguous area.
  5. Configure the following parameters for the virtual link:
    • Hello interval—Length of time, in seconds, between hello packets that the router sends on the interface. For a given link, this field must be the same on all routers or adjacencies do not form.
      • Default: 30.
    • Dead Interval—Number of seconds after the router stops receiving hello packets that it declares the neighbor is down. Typically, the value of this field should be four times that of the hello interval. For a given link, this value must be the same on all routers, or adjacencies do not form. The value must not be zero.
      • Range: 1-65535.
      • Default: 120.
    • Retransmit Interval—Specifies the number of seconds between LSA retransmissions for adjacencies belonging to this interface. This value is also used when retransmitting database description and link state request packets. Set this value well above the expected round-trip delay between any two routers on the attached network. Be conservative when setting this value to prevent unnecessary retransmissions.
      • Range: 1-65535 in number of seconds.
      • Default: 5.
    • Auth Type—Type of authentication scheme to use for a given link. In general, routers on a given link must agree on the authentication configuration to form neighbor adjacencies. This feature guarantees that routing information is accepted only from trusted routers.
      • Options: None / Simple / MD5.
      • Default: None.
  6. If you selected MD5 for the auth type, you must also configure the following parameters:
    • Add MD5 Key— If the Auth type selected is MD5, the MD5 List appears. Click Add and specify the MD5 Key ID and its corresponding MD5 key. If you configure multiple Key IDs, the Key ID with the highest value is used to authenticate outgoing packets. All keys can be used to authenticate incoming packets.
    • Key ID—The Key ID is included in the outgoing OSPF packets to enable the receivers to use the appropriate MD5 secret to authenticate the packet.
      • Range: 0-255.
      • Default: None
    • MD5 Secret—The MD5 secret is included in encrypted form in outgoing packets to authenticate the packet. Range: 1-16 alphanumeric characters. Default: None
  7. Repeat this procedure on both the ABR for the discontiguous area and an ABR that connects to the backbone area.

Configuring OSPF Interfaces

To configure an OSPF interface:

  1. In the Edit Interface window, assign the appropriate Area to each interface by selecting the OSPF area that this interface participates in.

    The OSPF interface configuration parameters are displayed showing the default settings. If you want to accept the default settings for the interface, no further action is necessary.

  2. (Optional) Change any configuration parameters for the interface.

    Note - The hello interval, dead interval, and authentication method must be the same for all routers on the link.

Configuration Parameters for OSPF Interfaces

Parameter

Description

Area

The drop-down list displays all of the areas configured and enabled on your platform. An entry for the backbone area is displayed even if it is disabled.

An OSPF area defines a group of routers running OSPF that have the complete topology information of the given area. OSPF areas use an area border router (ABR) to exchange information about routes. Routes for a given area are summarized into the backbone area for distribution into other non-backbone areas. An ABR must have at least two interfaces in at least two different areas.

For information on adding an area Configuring OSPF Areas and Global Settings.

Hello interval

Specifies the length of time in seconds between hello packets that the router sends on this interface. For a given link, this value must be the same on all routers, or adjacencies do not form.

  • Range: 1-65535 in seconds
  • Default: For broadcast interfaces, the default hello interval is 10 seconds. For point-to-point interfaces, the default hello interval is 30 seconds.

Dead interval

Specifies the number of seconds after the router stops receiving hello packets that it declares the neighbor is down.

  • Recommended value: Four times the hello interval. For a given link, this value must be the same on all routers, or adjacencies do not form. The value must not be 0.
  • Range: 1-65535 in seconds.
  • Default: For broadcast interfaces, the default dead interval is 40 seconds. For point-to-point interfaces, the default dead interval is 120 seconds.

Retransmit interval

Specifies the number of seconds between LSA retransmissions for this interface. This value is also used when retransmitting database description and link state request packets. Set this value well above the expected round-trip delay between any two routers on the attached network. Be conservative when setting this value to prevent necessary retransmissions.

  • Range: 1-65535 in seconds.
  • Default: 5.

OSPF cost

Specifies the weight of a given path in a route. The higher the cost you configure, the less preferred the link as an OSPF route. For example, you can assign different relative costs to two interfaces to make one more preferred as a routing path. You can explicitly override this value in route redistribution.

  • Range: 1-65535.
  • Default: 1.

Election priority

Specifies the priority for becoming the designated router (DR) on this link. When two routers attached to a network both attempt to become a designated router, the one with the highest priority wins. If there is a current DR on the link, it remains the DR regardless of the configured priority. This feature prevents the DR from changing too often and applies only to a shared-media interface, such as Ethernet. A DR is not elected on point-to-point type interfaces. A router with priority 0 is not eligible to become the DR.

  • Range: 0-255.
  • Default: 1.

Passive

Specifies that the interface does not send hello packets, which means that the link does not form any adjacencies. This mode enables the network associated with the interface to be included in the intra-area route calculation rather than redistributing the network into OSPF and having it as an ASE. In passive mode, all interface configuration information, with the exception of the associated area and the cost, is ignored.

  • Options: On or Off.
  • Default: Off.

Use Virtual Address

Makes OSPF run only on the VRRP Virtual IP address associated with this interface. If this router is not a VRRP master, then OSPF will not run if this option is On. It will only run on the VRRP master. For more information, see Configuring Monitored-Circuit VRRP.

  • Options: On or Off.
  • Default: Off

Authorization Type

Specifies which type of authentication scheme to use for a given link. In general, routers on a given link must agree on the authentication configuration to form neighbor adjacencies. This feature guarantees that routing information is accepted only from trusted routers.

Options are:

  • None: Does not authenticate packets.

    This is the default option.

  • Simple: Uses a key of up to eight characters. Provides little protection because the key is sent in the clear, and it is possible to capture packets from the network and learn the authentication key.
  • MD5: Uses a key of up to 16 characters. Provides much stronger protection, as it does not include the authentication key in the packet. Instead, it provides a cryptographic hash based on the configured key. The MD5 algorithm creates a crypto checksum of an OSPF packet and an authentication key of up to 16 characters. The receiving router performs a calculation using the correct authentication key and discards the packet if the key does not match. In addition, a sequence number is maintained to prevent the replay of older packets.

Configuring OSPF - Gaia Clish (ospf)

Use the following group of commands to set and view parameters for OSPF. This syntax is shown below for each set of commands.

Note - Gaia does not have CLI commands for route filtering and redistribution. You must configure inbound routing policies and redistribution of routes through the Portal. You can configure route maps and route aggregation using CLI commands. Route map configuration done through the CLI takes precedence over route filtering and redistribution configured in the Portal. For example if OSPF uses route maps for inbound filtering, anything configured on the Portal page for inbound route filters for OSPF is ignored. You can still use the Portal to configure route redistribution into OSPF.

When you do initial configuration, set the router ID. Use this command:

set router-id [default | <ip_address>]

Parameter

Description

router-id default

Selects the highest interface address when OSPF is enabled.

router-id <ip_address>

Specifies a specific IP address to assign as the router ID. Do not use 0.0.0.0 as the router ID address.

Best Practice - Check Point recommends setting the router ID rather than relying on the default setting. Setting the router ID prevents the ID from changing if the default interface used for the router ID goes down.

The Router ID uniquely identifies the router in the autonomous system. The router ID is used by the BGP and OSPF protocols. We recommend setting the router ID rather than relying on the default setting. This prevents the router ID from changing if the interface used for the router ID goes down. Use an address on a loopback interface that is not the loopback address (127.0.0.1).

Note - In a cluster, you must select a router ID and make sure that it is the same on all cluster members.

  • Range: Dotted-quad.([0-255].[0-255].[0-255].[0-255]). Do not use 0.0.0.0
  • Default: The interface address of one of the local interfaces.

 

Configuring OSPF Global Settings

Global settings apply to all configured OSPF areas, including the backbone and stub areas.

To configure global settings:

Run this command:

set ospf {rfc1583-compatibility {on | off} | spf-delay {default | <delay>} | spf-holdtime {default | <holdtime>} | default-ase-cost <cost> | default-ase-type {1 | 2} | graceful-restart-helper {on | off} | graceful-restart {on | off | grace-period <seconds>}}

Parameter

Description

rfc1583-compatibility {on | off}

Ensure backward compatibility. This option is on by default.

spf-delay {default | <delay>}

Specify the <delay> value, in seconds, to wait before recalculating the OSPF routing table after a change in the topology. The default is 2 seconds.

spf-holdtime {default | <holdtime>}

Specify the minimal <holdtime>, in seconds, between recalculations of the OSPF routing table. The default is 5 seconds.

default-ase-cost <cost>

Specify the cost assigned to routes from other protocols that are redistributed into OSPF as autonomous systems external. If the route has a cost already specified, that cost takes precedent. Valid cost values are between 1 and 6777215.

default-ase-type {1 | 2}

Specify the type assigned to routes from other protocols that are redistributed into OSPF as autonomous systems external. If the route has a type already specified, that type takes precedent. Valid type values are 1 or 2.

graceful-restart-helper {on | off}

Specify whether the Check Point system should maintain the forwarding state advertised by peer routers, even when they restart, to minimize the negative effects caused by peer routers restarting.

graceful-restart {on | off | grace-period <seconds>}

Configure Graceful Restart - turn it on, turn it off, or set the grace period to a value between 1 and 1800 seconds. The default grace period is 120 seconds.

Configuring OSPF Graceful Restart

OSPF Graceful Restart lets uninterrupted forwarding during a High Availability or VRRP cluster failover.

To enable OSPF Graceful Restart, do these:

To enable Graceful Restart in Clish:

Run this command:

set ospf graceful-restart on

To see if Graceful Restart is enabled on a Security Gateway:

Configuring OSPF Areas

Use the following commands to configure OSPF areas, including the backbone and stub areas.

For OSPFv2, use the following commands.

set ospf area backbone <on | off>
 
set ospf area <ospf_area>
	<on| off>
	stub <on | off>
	stub default-cost <1-677215>
	stub summary <on | off>
	nssa <on | off>
	nssa default-cost <1-677215>
	nssa default-metric-type <1-2>
	nssa import-summary-routes <on | off>
	nssa translator-role <always | candidate>
	nssa translator-stability-interval <1-65535>
	nssa redistribution <on |off>
	nssa range <ip_addr> [restrict] <on | off>
 






Parameter



Description







backbone <on | off>



Specifies whether to enable or disable the backbone area. By default, the backbone area is enabled. You can disable the backbone area if the system does not have interfaces on the backbone area.







<on | off>



Specifies the area ID for a new OSPF area.
Best Practice - Check Point recommends that you enter the area ID as a dotted quad, but you can use any integer as the area ID. The area ID 0.0.0.0 is reserved for the backbone.







stub <on | off>



Specifies the area ID for a stub area. Stub areas are areas that do not have AS external routes.


Note: The backbone area cannot be a stub area.







stub default-cost <1-677215>



Specifies a default route into the stub area with the specified cost.







stub summary <on | off>



Specifies the OSPF area as totally stubby, meaning that it does not have any AS external routes and its area border routers do not advertise summary routes.







nssa <on | off>



Specifies the area ID for an NSSA.


Note: The backbone area cannot be an NSSA area.







nssa default-cost <1-677215>



Specifies the cost associated with the default route to the NSSA.







nssa default-metric-type <1-2>



Specifies the type of metric. The default, type 1, is equivalent to the Default ASE Route Type on the OSPF Portal page. A type 1 route is internal and its metric can be used directly by OSPF for comparison. A type 2 route is external and its metric cannot be used for comparison directly.







nssa import-summary-routes <on | off>



Specifies if summary routes (summary link advertisements) are imported into the NSSA.







nssa translator-role <always | candidate>



Specifies whether this NSSA border router will unconditionally translate Type-7 LSAs into Type-5 LSAs. When role is Always, Type-7 LSAs are translated into Type-5 LSAs regardless of the translator state of other NSSA border routers. When role is Candidate, this router participates in the translator election to determine if it will perform the translations duties.







nssa translator-stability-interval <1-65535>



Specifies how long in seconds this elected Type-7 translator will continue to perform its translator duties once it has determined that its translator status has been assumed by another NSSA border router. Default: 40 seconds.







nssa redistribution <on |off>



Specifies if both Type-5 and Type-7 LSAs or only Type-7 LSAs will be originated by this NSSA border router.







nssa range <ip_addr> [restrict] <on | off>



Specify the range of addresses to reduce the number of Type-5 LSAs for the NSSA border router. To prevent a specific prefix from being advertised, use the restrict argument.










Configuring OSPF Virtual Links


Use the following commands to configure OSPF virtual links. Configure a virtual link if the router is a border router that does not have interfaces in the backbone area. The virtual link is effectively a tunnel across an adjacent non-backbone area whose endpoint must be any of the adjacent area’s border routers that has an interface in the backbone area.


For OSPFv2 use the following commands:






set ospf area backbone virtual-link ip_address


 	transit-area ospf_area <on | off>


	transit-area ospf_area hello-interval <1-65535> | default


	transit-area ospf_area dead interval <1-4294967295> | default


	transit-area ospf_area retransmit-interval <1-4294967295> | default


	transit-area ospf_area authtype none


	transit-area ospf_area authtype simple password


	transit-area ospf_area authtype md5 key authorization key id secret md5 key


	transit-area ospf_area authtype md5 key authorization key id off














Parameter



Description







ip_address transit-area ospf_area <on | off>



Specifies the IP address of the remote endpoint of the virtual link and transit area, which is a specified OSPF area you configure using the set ospf area command. Configure the OSPF area you are using as the transit area before you configure the virtual link. The transit area is the area shared by the border router on which you configure the virtual link and the router with an interface in the backbone area. Traffic between the endpoints of the virtual link flow through this area. The virtual link IP address functions as the router ID of the remote endpoint of the virtual link.







ip_address transit-area ospf_area hello-interval <1-65535>



Specifies the interval, in seconds, between hello packets that the router sends on the specified interface. For a given link, this value must be the same on all routers or adjacencies do not form.







ip_address transit-area ospf_area hello-interval default



Specifies an interval of 10 seconds.







ip_address transit-area ospf_area dead-interval <1-4294967295>



Specifies the number of seconds after which a router stops receiving hello packets that it declares the neighbor down. Generally, you should set this value at 4 times the value of the hello interval. Do not set the value at 0. For a given link, this value must be the same on all routers or adjacencies do not form.







ip_address transit-area ospf_area dead-interval default



Specifies a value of 40 seconds.







ip_address transit-area ospf_area retransmit-interval <1-4294967295>



Specifies the number of seconds between link state advertisement transmissions for adjacencies belonging to the specified interface. This value also applies to database description and link state request packets. Set this value conservatively, that is, at a significantly higher value than the expected round-trip delay between any two routers on the attached network.







ip_address transit-area ospf_area retransmit-interval default



Specifies a value of 5 seconds.







ip_address transit-area ospf_area authtype none



Specifies not to use an authentication scheme for the specified interface.







ip_address transit-area ospf_area authtype simple password



Specifies to use simple authentication for the specified interface. Enter an ASCII string that is 8 characters long. Generally, routers on a given link must agree on the authentication configuration to form neighbor adjacencies. Use an authentication scheme to guarantee that routing information is accepted only from trusted peers.







ip_address transit-area ospf_area authtype md5 key authorization key id secret MD5 secret



Specifies to use MD5 authorization. Enter at least one key ID and its corresponding MD5 secret. If you configure multiple key IDs, the largest key ID is used for authenticating outgoing packets. All keys can be used to authenticate incoming packets. Generally, routers on a given link must agree on the authentication configuration to form neighbor adjacencies. Use an authentication scheme to guarantee that routing information is accepted only from trusted peers.










Configuring OSPF Interfaces


Use the following commands to configure a backbone and other areas, such as stub areas, for specified interfaces.


For OSPFv2 use the following commands:






set ospf


	area <backbone | <ospf_area> range <ip_prefix> <on | off>


	area <backbone | <ospf_area> range <ip_prefix> restrict <on | off>


	stub-network <ip_prefix> <on | off>


	stub-network <ip_prefix> stub-network-cost <1-677722>


	


set ospf interface <if_name>


	area <backbone | <ospf_area> <on | off>


	hello-interval <1-65535> | default


	dead-interval <1-65535> | default


	retransmit-interval <1-65535> | default


	cost <1-65535>


	priority <0-255>


	passive <on | off>


	virtual-address <on | off>


	authtype none


	simple password


	md5 key authorization key id secret md5 secret


	md5 key authorization key id














Parameter



Description







area <backbone | <ospf_area> range <ip_prefix> <on | off>



Select an area from the areas already configured. 
Any area can be configured with any number of address ranges. These ranges are used to reduce the number of routing entries that a given area transmits to other areas. If a given prefix aggregates a number of more specific prefixes within an area, you can configure an address range that becomes the only prefix advertised to other areas. Be careful when configuring an address range that covers part of a prefix that is not contained within an area. An address range is defined by an IP prefix and a mask length. If you mark a range as restrict, it is not advertised to other areas.







area <backbone | <ospf_area> range <ip_prefix> restrict <on | off>



Any area can be configured with any number of address ranges. These ranges are used to reduce the number of routing entries that a given area transmits to other areas. If a given prefix aggregates a number of more specific prefixes within an area, you can configure an address range that becomes the only prefix advertised to other areas. Be careful when configuring an address range that covers part of a prefix that is not contained within an area. An address range is defined by an IP prefix and a mask length. If you mark a range as restrict, it is not advertised to other areas.







stub-network <ip_prefix> <on | off>



Specifies a stub network to which the specified interface range belongs. Configure a stub network to advertise reachability to prefixes that are not running OSPF. The advertised prefix appears as an OSPF internal route and is filtered at area borders with the OSPF area ranges. The prefix must be directly reachable on the router where the stub network is configured, that is, one of the router’s interface addresses must fall within the prefix range to be included in the router-link-state advertisement. Use a mask length of 32 to configure the stub host. The local address of a point-to-point interface can activate the advertised prefix and mask. To advertise reachability to such an address, enter an IP address for the prefix and a non-zero cost for the prefix.







stub-network <ip_prefix> stub-network-cost <1-677722>



Configure a stub network to advertise reachability to prefixes that are not running OSPF. The advertised prefix appears as an OSPF internal route and is filtered at area borders with the OSPF area ranges. The prefix must be directly reachable on the router where the stub network is configured, that is, one of the router’s interface addresses must fall within the prefix range to be included in the router-link-state advertisement. Use a mask length of 32 to configure the stub host. The local address of a point-to-point interface can activate the advertised prefix and mask. To advertise reachability to such an address, enter an IP address for the prefix and a non-zero cost for the prefix.







interface <if_name> area <backbone | <ospf area> <on | off>



Specifies the OSPF area to which the specified interface belongs.







interface <if_name> hello-interval <1-65535>



Specifies the interval, in seconds, between hello packets that the router sends on the specified interface. For a given link, this value must be the same on all routers or adjacencies do not form.







interface <if_name> hello-interval default



Specifies the default value for the hello interval, which is 10 seconds.







interface <if_name> dead-interval <1-65535>



Specifies the number of seconds after which a router stops receiving hello packets that it declares the peer down. Generally, you should set this value at 4 times the value of the hello interval. Do not set the value at 0. For a given link, this value must be the same on all routers or adjacencies do not form.







interface <if_name> dead-interval default



Specifies the default value for the dead interval, which is 40 seconds







interface <if_name> retransmit-interval <1-65535>



Specifies the number of seconds between link state advertisement transmissions for adjacencies belonging to the specified interface. This value also applies to database description and link state request packets. Set this value conservatively, that is, at a significantly higher value than the expected round-trip delay between any two routers on the attached network.







interface <if_name> retransmit-interval default



Specifies the default for the retransmit interval, which is 5 seconds.







interface <if_name> cost <1-65535>



Specifies the weight of the given path in a route. The higher the cost, the less preferred the link. To use one interface over another for routing paths, assign one a higher cost.







interface <if_name> priority <0-255>



Specifies the priority for becoming the designated router (DR) on the specified link. When two routers attached to a network attempt to become a designated router, the one with the highest priority wins. This option prevents the DR from changing too often. The DR option applies only to a share-media interface, such as Ethernet or FDDI; a DR is not elected on a point-to-point type interface. A router with a priority of 0 is not eligible to become the DR.







interface <if_name> passive <on | off>



Enabling this option puts the specified interface into passive mode; that is, hello packets are not sent from the interface. Putting an interface into passive mode means that no adjacencies are formed on the link. This mode enables the network associated with the specified interface to be included in intra-area route calculation rather than redistributing the network into OSPF and having it function as an autonomous system external.


off







interface <if_name> authtype none



Specifies not to use an authentication scheme for the specified interface.







interface <if_name> authtype simple password



Specifies to use simple authentication for the specified interface. Enter an ASCII string that is 8 characters long. Generally, routers on a given link must agree on the authentication configuration to form peer adjacencies. Use an authentication scheme to guarantee that routing information is accepted only from trusted peers.







interface <if_name> authtype md5 key authorization key id secret md5 secret



Specifies to use MD5 authorization. Enter at least one key ID and its corresponding MD5 secret. If you configure multiple key IDs, the largest key ID is used for authenticating outgoing packets. All keys can be used to authenticate incoming packets. Generally, routers on a given link must agree on the authentication configuration to form peer adjacencies. Use an authentication scheme to guarantee that routing information is accepted only from trusted peers.










Monitoring IPv4 OSPFv2


To monitor and troubleshoot OSPFv2 for IPv4, run these commands:


show ospf
   border-routers
   database
      area {backbone | <area_id>}
      areas [detailed]
      asbr-summary-lsa [detailed]
      checksum
      database-summary
      detailed
      external-lsa [detailed]
      network-lsa [detailed]
      nssa-external-lsa [detailed]
      opaque-lsa [detailed]
      router-lsa [detailed]
      summary-lsa [detailed]
      type {1 | 2 | 3 | 4 | 5 | 6 | 7}
   errors {dd | hello | ip | lsack | lsr | lsu | protocol}
   events
   interface <interface_name> [detailed | stats]
   interfaces [detailed | stats]
   neighbor <neighbor_IP> [detailed]
   neighbors [detailed]
   packets
   routemap
   summary


Where:






Parameter



Description







border-routers



Shows the state of each area border router:


  • Router ID
  • OSPF area
  • Associated route cost






database


  area {backbone | <area_id>}


  areas [detailed]


  checksum


  database-summary


  detailed


  external-lsa [detailed]


  inter-area-prefix-lsa [detailed]


  inter-area-router-lsa [detailed]


  intra-area-prefix-lsa [detailed]


  link-lsa [detailed]


  network-lsa [detailed]


  router-lsa [detailed]


  type {1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9}



Show the OSPF database information:


  • area {backbone | <area_id>} - Router-link state, network-link state, AS-border-router-link state, AS- external-link state, and summary-link state statistics for the specified OSPF area; for each interface in this OSPF area, shows the checksum, sequence number, and link count
  • areas [detailed] - Router-link state, network-link state, AS-border-router-link state, AS- external-link state, and summary-link state statistics for each OSPF area; for each OSPF interface, shows the checksum, sequence number, and link count
  • checksum - Checksum sum for each OSPF interface
  • database-summary - Summary of all types of LSAs
  • detailed - Detailed statistics on all types of LSAs
  • external-lsa [detailed] - Type 5 (AS-external) LSA statistics for each OSPF area
  • inter-area-prefix-lsa [detailed] - Type 3 (Summary) LSA statistics for each OSPF area (OSPFv3 only)
  • inter-area-router-lsa [detailed] - Type 4 (ASBR) LSA statistics for each OSPF area (OSPFv3 only)
  • intra-area-prefix-lsa [detailed] - Type 9 (Intra-Area Prefix) LSA statistics for each OSPF area (OSPFv3 only)
  • link-lsa [detailed] - Type 8 (Link) LSA statistics for each OSPF area (OSPFv3 only)
  • network-lsa [detailed] - Type 2 (Network) LSA statistics for each OSPF area
  • router-lsa [detailed] - Type 1 (Router) LSA statistics for each OSPF area
  • nssa-external-lsa [detailed] - Type 7 (NSSA) LSA statistics for each OSPF area (OSPFv2 only)
  • opaque-lsa [detailed] - Opaque LSA statistics for each OSPF area (OSPFv2 only)
  • summary-lsa [detailed] - Summary of all LSAs for each OSPF area (OSPFv2 only)
  • type {1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9} - LSA statistics for each type of LSA:
    • 1 - Router LSA
    • 2 - Network LSA
    • 3 - Summary LSA in OSPFv2, Inter-Area Prefix LSA in OSPFv3
    • 4 - Summary ASBR LSA in OSPFv2, Inter-Area Router LSA in OSPFv3
    • 5 - External LSA in OSPFv2, AS-External LSA in OSPFv3
    • 7 - NSSA LSA in OSPFv2 only, not supported in OSPFv3
    • 8 - Link LSA in OSPFv3 only, not supported in OSPFv2
    • 9 - Intra-Area Prefix LSA in OSPFv3 only, not supported in OSPFv2






errors {dd | hello | ip | lsack | lsr | lsu | protocol}



Number of error messages sent, per type:


  • dd - Database description error messages
  • hello - Hello error messages
  • ip - IP error messages
  • lsack - Link-state acknowledgment error messages
  • lsr - Link-state request error messages
  • lsu - Link-state update error messages
  • protocol - Protocol error messages






events



Number of these types of events:


  • Interface down
  • Interface up
  • Virtual interface down
  • Virtual interface up
  • Designated Router (DR) elections
  • Router ID (RID) changes
  • Area border router (ABR) changes
  • AS border router (ASBR) changes
  • RFC1583 changes
  • LSA self-advertisement messages






interface <interface_name> [detailed | stats]



Shows OSPF information for the specified interface:


  • <int> - interface name
    • IP address
    • Area ID
    • State
    • Number of logged errors (NC)
    • DR Interface IP address
    • BDR Interface IP address
  • detailed -
    • IP Address
    • Area
    • Router ID
    • Network type
    • Cost
    • Authentication type
    • Error count
    • Event count
    • Transmit delay
    • State
    • Priority
    • Designated Router (DR) ID and interface IP address
    • Backup Designated Router (BDR) ID and interface IP address
    • Hello, Dead, Wait, and Retransmit timers (in seconds)
    • Next Hello timer
    • Neighbor count
    • Count of lost 2-way connections with neighbors
  • stats -
    • Total Errors
    • Hello Interval Mismatch
    • External Option Error
    • Delayed Ack Count
    • Dead Interval Mismatch
    • Lost Neighbor Count
    • Authentication Errors
    • Duplicate Router ID
    • Neighbor Errors
    • Newer Self LSA Count
    • Neighbor Count






interfaces [detailed | stats]



Shows OSPF information for all interfaces:


  • Without command options
    • IP address
    • Area ID
    • State
    • Number of logged errors (NC)
    • DR Interface IP address
    • BDR Interface IP address
  • detailed -
    • IP Address
    • Area
    • Router ID
    • Network type
    • Cost
    • Authentication type
    • Error count
    • Event count
    • Transmit delay
    • State
    • Priority
    • Designated Router (DR) ID and interface IP address
    • Backup Designated Router (BDR) ID and interface IP address
    • Hello, Dead, Wait, and Retransmit timers (in seconds)
    • Next Hello timer
    • Neighbor count
    • Count of lost 2-way connections with neighbors
  • stats -
    • Total Errors
    • Hello Interval Mismatch
    • External Option Error
    • Delayed Ack Count
    • Dead Interval Mismatch
    • Lost Neighbor Count
    • Authentication Errors
    • Duplicate Router ID
    • Neighbor Errors
    • Newer Self LSA Count
    • Neighbor Count






neighbor <neighbor_IP> [detailed]



Shows OSPF information for the specified OSPF neighbor:


  • Priority
  • State
  • Number of logged errors






neighbors [detailed]



Shows OSPF information for each OSPF neighbor:


  • IP address
  • Priority
  • State
  • Number of logged errors






packets



Shows the number of received (Rx) and transmitted (Tx) OSPF packets:


  • Hello Rx
  • Hello Tx
  • Link State Update Rx
  • Link State Update Tx
  • Link State Ack Rx
  • Link State Ack Tx
  • Link State Request Rx
  • Link State Request Tx






routemap



Shows OSPF Import Policy and Export Policy.







summary



Shows detailed OSPF configuration.











						










	06 February 2018
	
		© 2018 Check Point Software Technologies Ltd. All rights reserved.