Subject: Re: OSPF routers with port rules question

From: Alexander Cheskis <[email-masked]>
Date: Wed, 17 Dec 2003 00:04:46 +0300

Dear Mithell/Acee,

The situation, which I described, is very common in contemporary networks.

192.168.40.3, 192.168.40.4, etc . they are common servers, firewalls,
antiviruses etc. OSPFv2 based.

192.168.40.2 - smart router, supports OSPF, which get all traffic between top
and bottom networks, and forward it (sometimes for load balancing, sometimes for
redundancy) to relevant servers, I mentioned above.

In case that these firewalls can't support MPLS signaling, I wander that there
is NO way to configure smart router's OSPF to work as described.

The one-way, I found is to "simulate" two different OSPF routers inside smart
router, and duplicate LSDB tables.
The other dirty way is to do all routing with static routes.

May be there is another tricky way? To define smart router as ASBR and define
different areas on its top and bottom ports?

Thanks,
Alexander

-----Original Message-----
From: Erblichs [mailto:[email-masked]]
Sent: Tuesday, December 16, 2003 9:15 PM
To: [email-masked]
Subject: Re: OSPF routers with port rules question

Alexander Cheskis,

        The only way to favor or not favor a route in traditional
        OSPF hop by hop routing is with the link costs assigned
        to each hop of the route.

        However, even with an infinite link costs to for
        certain hops, if there is no alternate route available,
        the infinite link cost hop will still be used.

        Thus, within OSPF, I am not sure how you can enforce that
        the bottom networks not send or recieve traffic from the
        top networks. If packet policy routing is wanted, a MPLS
        OSPF network can possibly be used to achieve your results.

        Mithell Erblich
        Sr Network Software Engineer
        -----------------------------

Alexander Cheskis wrote:
>
> Dear Group,
>
> I need to find routing solution for attached (PDF scheme) network
configuration.
>
> Router 192.168.20.2 can relay traffic as shown:
>
> (port rule 1) From bottom networks (192.168.50.x) , to the bottom ports of
> 192.168.40.x
> (port rule 2) From the top networks (192.168.20.x), to the top ports of
> 192.168.30.x
>
> Obviously, when all port2port traffic is enabled on 192.168.20.2, everything is
> fine. All 5 routers are OSPF enabled in the same area.
> But when port rules are applied, bottom networks can't access top ones and visa
> versa.
>
> Thanks in advance,
> Alexander Cheskis
>
>   ------------------------------------------------------------------------
>                              Name: OSPF_and_PortRules.pdf
>    OSPF_and_PortRules.pdf    Type: Acrobat (application/pdf)
>                          Encoding: base64

---

From: Michael Rozhavsky <[email-masked]>
Date: Tue, 16 Dec 2003 13:40:23 -0800

Hi,

It really depends on the OS you have on 192.168.20.2 but you can
run two OSPF instances on your 192.168.20.2 (one for bottom half
and one for the top one), each one of them will use it's own routing
table (again assuming that your OS can do that). Bind corresponding
interfaces to related routing table and I think you'll get what you
are looking for.

HTH

> different areas on its top and bottom ports?
[snip]

Best regards,

--
   Michael Rozhavsky             [email-masked]
   Software Engineer
   Fortinet (Canada) Inc.
   4710 Kingsway Suite 400       Tel: (604) 430-1297 ext 309
   Burnaby, BC V5H 4M4 Canada    Fax: (604) 430-1296

---

From: Jing Shen <[email-masked]>
Date: Wed, 17 Dec 2003 18:40:51 +0800

I'm not sure whether I got clearly what it is desired.

To my understanding,  it is asked that traffic from
50' be routed to 40' ( then to other network), while
traffic from 20' be routed to 30'.and, not cut-through
is permitted.

To realize such situation, routing is not needed at
all. The point rule could be implemented as VLAN in a
Layer3 siwtch. that 40' and 50 be cataloged into one
VLAN and 20' 30' to another VLAN. The two VLAN is not
allowed to communicate with each other directly.

 --- Michael Rozhavsky <[email-masked]>
的正文：> Hi,
> > different areas on its top and bottom ports?

Jing Shen

ZheJiang University
P.R.China

' spamcontrol '

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around
http://mail.yahoo.com