Configuring IPv4 OSPFv2 Virtual Links in Gaia Clish

Important - In a ClusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., you must configure all the Cluster Members in the same way.

The virtual link is effectively a tunnel across an adjacent non-backbone area, whose endpoint must be any of the adjacent area's border routers that has an interface in the backbone area.

You must configure a virtual link for any area that does not connect directly to the backbone area.

You configure the virtual link on both the ABR for the discontiguous area and another ABR that does connect to the backbone.

The virtual link acts like a point-to-point link.

The routing protocol traffic that flows along the virtual link uses intra-area routing only.

The configuration is applicable to OSPF Multiple Instances (see Configuring IPv4 OSPFv2 Multiple Instances).

set ospf [instance {<1-65535> | default}] area backbone

      virtual-link <Router ID> transit-area <Area ID>

            authtype cryptographic key <1-255> {off | algorithm <Algorithm> secret "<Password>"}

            authtype {none | simple "<Password>"}

            dead-interval {<1-65535> | default}

            hello-interval {<1-65535> | default}

            {off | on}

            retransmit-interval {<1-65535> | default}

Parameter

Description

set ospf instance {<1-65535> | default} area backbone

Configures the backbone area.

set ospf instance {<1-65535> | default} area backbone virtual-link <Router ID> transit-area <Area ID>

Configures the virtual link and the transit area.

If the router is an Area Border Router with no interfaces in the backbone area, a Virtual Link must be configured to connect it to the backbone.

This link is effectively a tunnel across an adjacent Transit Area.

The other endpoint of the Virtual Link must be an OSPF router which has an interface connected to the backbone, and which also has an interface connected to the Transit Area.

A Transit Area is the area shared between the two endpoint routers of the Virtual Link. LSAs are sent to/from the backbone via this Transit Area.

  • <Router ID>

    The Router ID of the other endpoint for this Virtual Link (for example:192.168.3.4)

  • <Area ID>

    The Transit Area, which connects this router to the other endpoint of the Virtual Link.

    Important - You must configure this area before you configure its settings. Use the "set ospf area" command.

    Supported formats:

    • An integer between 1 and 4294967295

    • Dotted quad form (for example, 0.0.0.1 for area id 1)

virtual-link <Router ID> transit-area <Area ID> authtype cryptographic key <1-255> {off | algorithm <Algorithm> secret "<Password>"}

Disables (off) or enables (algorithm) the cryptographic authentication with MD5 or HMAC.

Authentication guarantees that routing information is accepted only from trusted routers. A message digest or message authentication code is included in outgoing OSPF packets, so that receivers can authenticate these packets.

This OSPFv2 HMAC-SHA authentication (RFC 5709) is backward-compatible with the OSPFv2 MD5 authentication.

Important - Both OSPF sides must agree on these settings for the OSPF authentication to work, and to form OSPF adjacencies.

For cryptographic authentication, at least one key needs to be configured, with Key ID, Algorithm, and Secret.

If you configure multiple keys:

The available algorithms are listed in the decreasing order of their cryptographic strength:

  • hmac-sha-512 - Provides a cryptographic SHA-512 hash based on the configured secret.

  • hmac-sha-384 - Provides a cryptographic SHA-384 hash based on the configured secret.

  • hmac-sha-256 - Provides a cryptographic SHA-256 hash based on the configured secret. We recommend this algorithm for best interoperability.

  • hmac-sha-1 - Provides a cryptographic SHA-1 hash based on the configured secret.

  • md5 - Provides a cryptographic MD5 hash based on the configured key.

A shared secret (password) for cryptographic authentication:

  • For HMAC algorithms - Alphanumeric string from 1 to 80 characters. May not contain spaces or '\' characters.

  • For MD5 algorithm - Alphanumeric string from 1 to 16 characters. May not contain spaces or '\' characters.

virtual-link <Router ID> transit-area <Area ID> authtype {none | simple "<Password>"}

Disables (none) or enables (simple) the authentication.

Authentication guarantees that routing information is accepted only from trusted routers.

In general, all routers on an interface or link must agree on the authentication settings to form adjacencies.

The simple password must contain from 1 to 8 alphanumeric ASCII characters.

virtual-link <Router ID> transit-area <Area ID> dead-interval {<1-65535> | default}

Configures the time after receipt of the last Hello packet, at which a neighbor is declared dead.

Typically this is four times the Hello interval.

All routers on an interface must have the same dead interval.

Range: 1-65535 seconds, or default

Default: 40 seconds for broadcast networks, 120 seconds for point-to-point networks

virtual-link <Router ID> transit-area <Area ID> hello-interval {<1-65535> | default}

Configures the delay time between Hello packets on this Virtual Link.

For a given link, this value must be the same for all OSPF routers.

The OSPF Hello Protocol is responsible for establishing and maintaining adjacencies (i.e. connections) between neighboring OSPF routers.

For broadcast networks, the Hello is also used to dynamically discover neighbors.

Range: 1-65535 seconds, or default

Default: 10 seconds for broadcast networks, 30 seconds for point-to-point networks

virtual-link <Router ID> transit-area <Area ID> {off | on}

Removes (off) or creates (on) a Virtual Link.

virtual-link <Router ID> transit-area <Area ID> retransmit-interval {<1-65535> | default}

Configures the time between LSA retransmissions for this interface.

This value is also used when retransmitting database description and link state request packets.

This value should be much higher than the expected round-trip delay between any two routers on the network.

Being conservative helps avoid unnecessary retransmissions.

Range: 1-65535 seconds, or default

Default: 5 seconds