OSPF | administration manual (2023)

SUPERVISION:You must have a full feature license to use OSPF routing.

Open Shortest Path First (OSPF) is an internal link-state routing protocol widely used in large enterprises. OSPF provides routing within a single Autonomous System (AS). This differs from BGP, which provides routing between autonomous systems.

An OSPF AS can contain only one area or consist of a group of areas connected to a backbone area. A router connected to more than one area is an area border router (ABR). An autonomous system border router (ASBR) sits between an autonomous OSPF system and a non-OSPF network. Routing information is contained in a link state database. Routing information is communicated between routers using Link State Advertisements (LSAs).

The main benefit of OSPF is that it quickly detects network connection failures and successfully converges network traffic in seconds without network loops. Additionally, OSPF has features to control which routes are propagated to accommodate the size of routing tables.

You can enable Bidirectional Forward Detection (BFD) with OSPF. BFThis is used to quickly locate hardware errors on the network. Routers running BFD communicate with each other, and when a timer expires on a connection, that router is declared down. The BFD then communicates this information to OSPF and the routing information is updated.

SUPERVISION:OPFFMIBs are not supported in this version.

For more information on OSPF routing, seeOSPF section of the FortiOS Administration Guide.

How OSPF works

areas

An OSPF implementation consists of one or more areas. A region consists of a group of connected networks. If you configure more than one area, the zero area is always the main area. An ABR connects one or more areas to the OSPF backbone area.

The FortiSwitch unit supports different types of areas: Auxiliary Areas, Not So Stubby Areas (NSSA), and Regular Areas. An auxiliary area is an interface without a configured default route. NSSA is a type of stub scope that can import external AS routes and send them to the backbone, but cannot receive external AS routes from the backbone or other scopes. All other areas are considered regular areas.

barrios

When an OSPF router starts up, it sends OSPF Hello packets to find neighbors on the same network. The neighbors exchange information and the link state databases of both neighbors are synchronized. At this point, these neighbors are called neighbors.

For two OSPF routers to become neighbors, the following conditions must be met:

• The interface subnet number and subnet mask must match on both routers.
• The values ​​of Hello Interval and Dead Interval must match.
• The routers must have the same OSPF Area ID.
• If authentication is used, they must pass the authentication checks.

In OSPF, routing protocol packets are only transmitted between neighboring routers.

route summary

Using route aggregation reduces the number of LSAs sent between routers. OSPF provides two types of route summaries:

• Between areas through an ABR. This method summarizes the routes in the scope configuration.

settings area

editar <area_IPv4_address>

adjustment range

Edit <ID>

Put the prefix <xxx.xxx.xxx.xxx> <xxx.xxx.xxx.xxx>

next

Movie

next

Movie

• Between an OSPF AS and a non-OSPF network through an ASBR. This method summarizes the external paths when redistributing them.

Configuration Summary Address

Edit <ID>

Put the prefix <xxx.xxx.xxx.xxx> <xxx.xxx.xxx.xxx>

next

Movie

Graceful Reboot Helper-Modus

Starting with FortiSwitchOS 6.4.3, if a neighbor router sends a grace LSA before rebooting, the FortiSwitch unit will enter auxiliary (neighbor) mode. The FortiSwitch unit keeps the newly started router in the forwarding path for OSPF routing as long as there are no changes to the network topology. Once the router reboot completes its normal reboot, the FortiSwitch unit exits help mode.

This feature is always on.

Database overflow protection

When the OSPF link-state database is large, some routers do not have enough resources to store the complete link-state database. To prevent database overflow, you can limit the number of AS external LSAs in the link-state database. When the maximum number of external AS LSAs is reached, the router deletes all external AS LSAs originating from it and stops creating external AS LSAs for the specified number of seconds.

By default, this feature is disabled.

Use the following commands to configure database overflow protection:

Configure OSPF Router

Enable database overflow

define database-overflow-max-external-lsa <0-2147483647>

Set database overtime for recovery <0-65535>

Movie

configure OSPF

If you plan to use virtual routing and forwarding (VRF) with OSPF, you must create a VRF instance before configuring OSPF. To seeVirtual routing and forwarding.

Using the GUI:

1. Create a virtual switch interface. To seechange virtual interfaces.
2. GonnaRouter > Configuration > OSPF > Configuration.
   1. If you want to use a VRF instance, select it from theVRFdrop down list
   2. ChooseMake it possiblecheckbox
   3. Enter a unique 32-bit number in dotted decimal format for the Router ID.SUPERVISION:OSPF routing will not work without a router ID.
   4. If you want to advertise default routes in OSPF, configure the default route option and enter the routing metric (cost) for other routing protocols.
   5. If you want to redistribute non-OSPF routes, selectAbleConnected, Static, RIP, BGP, or ISIS and enter the routing metric in the Metric field.
   6. chooseUpdate.
3. GonnaRouter > Configuration > OSPF > Ranges, select the VRF instance, ornoneand then selectAdd OSPF Area.
   1. Enter the IP address of the range.
   2. Select whether the scope is an auxiliary scope, NSSA, or a normal scope.
   3. chooseadd.
4. GonnaRouter > Configuration > OSPF > Networking, select the VRF instance, ornoneand then selectadd network.
   1. Enter the network identifier.
   2. Enter the IP address and netmask separated by a space. Use an IP address that includes the virtual interface of the switch.
   3. Select the created area.
   4. chooseadd.
5. GonnaRouter > Configuration > OSPF > Interfaces, select the VRF instance, ornoneand then selectConfigure the OSPF interface.
   1. Select the same authentication type that you selected for the realm.
   2. If you want static bidirectional direct detection, selectMake it possibleoGlobal.
   3. Enter the maximum transmission unit.
   4. Enter the cost.
   5. Enter the number of seconds between sending hello packets.
   6. Enter the number of seconds that no Hello packet is received before the OSPF router decides that a neighbor is down.
   7. chooseadd.

Using the CLI:

Configuring OSPF with IPv4 on the FortiSwitch unit involves the following main steps:

1. Entry into OSPF configuration mode.
2. Configure Router ID.

   Each router must have a unique 32-bit number.SUPERVISION:OSPF routing will not work without a router ID.

3. create an area.

   You must create at least one area.

4. configure the network.

   Place one or more nets in each area.

5. Configure the OSPF interface.
6. Non-OSPF route redistribution.

   Advertise these non-OSPF routes within OSPF.

7. Check OSPF configuration.

SUPERVISION:

• You can also configure OSPF with IPv6Configure OSPF6 RouterDomain.
• Starting with FortiSwitchOS 7.0.0, OSPF supports VRF. To create multiple routing tables on the same router, use thevrf-configurationcommand belowConfigure OSPF Router.

Entry into OSPF configuration mode

Enter OSPF configuration mode to access all OSPF configuration commands:

# ospf-router configuration

Configure Router ID

Each router within an area must have a unique 32-bit number. The router ID is written in dotted decimal format, but it is not an IPv4 address.SUPERVISION:OSPF routing will not work without a router ID.

definir router-id <router-id>

For example:

# ospf-router configuration

(ospf) # Set Router ID 1.1.1.2

create an area

You must create at least one area. The range number is written in dotted decimal format (for example, set the range from 100 to 0.0.0.100).

settings area

Edit <Area Number>

Set Link (Default | Disable | Enable)

define type {nssa | normal |outline}

Movie

For example:

(ospf) # configuration area

(range) # edit 0.0.0.4

(0.0.0.4) # define escribe nssa

configure the network

Use this subcommand to identify OSPF-enabled interfaces. The prefix length on the interface must be equal to or greater than the prefix length on the network declaration.

configuration network

Edit <network number>

Define area <area>

set prefix <network prefix> <mask>

For example:

(ospf)# configuration network

(Network) # Edit 1

(1) # Define range 0.0.0.4

(1) # Define prefix 10.1.1.0 255.255.255.0

Configure the OSPF interface

Configure interface-related OSPF settings. Enter a meaningful name for the OSPF interface name.

configuration interface

editar <ospf_interface_name>

Set Priority <1-255>

For example:

(ospf) # configuration interface

(ospf interface) # edit hi1

(hi1) # set priority 255

SUPERVISION:The following values ​​must match for an adjacency to form:

• Type and area number
• Interface subnet and mask
• hi break
• dead gap

Non-OSPF route redistribution

Distribute non-OSPF routes (static or directly connected routes) within OSPF:

redistribute config {bgp | connected | isis | tear | static}

set state activated

Define the metric <integer>

Define measurement type {1 |2}

Movie

Add route summary:

Configuration Summary Address

Edit <ID>

Put the prefix <xxx.xxx.xxx.xxx> <xxx.xxx.xxx.xxx>

next

Movie

For example:

(ospf) # redistribute connected configuration

(connected) # set state enabled

(connected) # end

(ospf) # Configuration summary address

(abstract address) # edit 1

added new entry '1'

(1) # Define prefix 10.1.0.0 255.255.0.0

(1) # next

(abstract address) # end

Check OSPF configuration

oObtain information about the OSPF routerThe command has options to view various aspects of OSPF configuration and status. For example:

Get Neighbor OSPF Router Information {<neighbor_ID> | all | detail | detail all | <interface IP address>}

Get router information from ospf database {letter | autogenerated | Routers | network | Summary | abstract asbr| outside | nssa-external | opaque link | opaque area | opaque | maximum age}

configuration example

The following example shows a very simple OSPF network with one area. FortiSwitch 1 has an OSPF interface to FortiSwitch 2:

Configuring system interfaces

These are the same configuration steps as for static routing.

switch 1

Configuration system interface

Edit vlan10-p3

define ip 30.1.1.1 255.255.255.0

establecer Permitir acceso ping https http ssh telnet

define vlanid 10

next

Edit vlan40-p4

define ip 10.11.101.1 255.255.255.0

establecer Permitir acceso ping https http ssh telnet

define vlanid 40

Movie

Configuration switch interface

edit "port3"

Set native-vlan 10

next

"port4" edition

set native-vlan 40

next

Movie

switch 2

Configuration system interface

Edit vlan20-p8

define ip 20.50.1.1 255.255.255.0

establecer Permitir acceso ping https http ssh telnet

define vlanid 20

next

Edit vlan40-p4

define ip 10.11.101.2 255.255.255.0

establecer Permitir acceso ping https http ssh telnet

define vlanid 40

Movie

Configuration switch interface

"port8" edition

set native-vlan 20

next

"port4" edition

set native-vlan 40

next

Movie

Configure the OSPF router

Configure OSPF as follows:

1. Set the router ID.
2. Create the area.
3. Create the network (define the network prefix and assign it to a range).
4. Configure an OSPF interface.

switch 1

Configure OSPF Router

Set the router ID to 10.11.101.1

settings area

edit 0.0.0.0

next

Movie

configuration network

edit 1

Define Range 0.0.0.0

Set prefix 10.11.101.0 255.255.255.0

next

Movie

configuration interface

edit vlan40

set costs 100

Set priority 100

next

Movie

config redistribute connected

set state activated

Movie

Movie

switch 2

Configure OSPF Router

Set the router ID to 10.11.101.2

settings area

edit 0.0.0.0

next

Movie

configuration network

edit 1

Define Range 0.0.0.0

Set prefix 10.11.101.0 255.255.255.0

next

Movie

configuration interface

edit vlan40

set costs 100

Set priority 100

next

Movie

config redistribute connected

set state activated

Movie

Movie

Check OSPF Neighbors

Get all the information from the neighboring OSPF router

Checking OSPF routes

Obtain information about the OSPF router