OSPF
The supported versions are OSPF v2 for IPv4, and OSPF v3 for IPv6.
The following is the "OSPF_simple" configuration.
It consists of deploying an area 0 over a LAN in which any neighbors are explicitly designated. All routes are imported from OSPF. The route of the subnet that is directly connected to the interface em3 (172.16.0.0/24), as well as the default route, are then redistributed in OSPF.
sns_log off; # default is "no extra log"
router id 192.168.97.219;
# This pseudo-protocol performs synchronization
# between BIRD's routing tables and the kernel.
protocol kernel {
learn; # Learn all alien routes from the kernel
persist; # Don't remove routes on bird shutdown
scan time 20; # Scan kernel routing table every 20 seconds
ipv4 {
export all; # THIS CONFIGURATION MUST BE ADJUSTED
preference 254; # Protect existing routes
};
}
# This pseudo-protocol watches all interface up/down events.
protocol device {
scan time 10; # Scan interfaces every 10 seconds
}
# The direct protocol automatically generates
# device routes to all network interfaces.
protocol direct {
ipv4; # Minimal IPv4 default channel config
interface "em2";
}
filter ospfexport {
if (source = RTS_DEVICE) || (net = 0.0.0.0/0)
then accept;
else reject;
}
protocol ospf MyOSPF {
area 0.0.0.0 {
stub no;
interface "em2" {
type broadcast;
neighbors {
192.168.97.103 eligible;
};
};
};
ipv4 {
export filter ospfexport;
import all;
};
}
NOTE
You are advised to set the value of the parameter priority 0 in the interface section of the OSPF node configuration, in order to disable the firewall's participation in elections for Designated Router/Backup Designated Router roles.
Allowing the OSPF protocol in filter policies
Filter rules are required in order to allow OSPF routing traffic to and from the firewall.
In the example of a filter policy below, the object router_103 represents the IP address (192.168.97.103) of the OSPF neighbor that was explicitly declared in the firewall configuration.
IMPORTANT
To ensure that OSPF operates correctly, you must allow OSPF unicast traffic in addition to multicast traffic, as shown in this example of a filter policy.
Checking the proper operation of OSPF dynamic routing
The command below indicates that the neighborhood has been set up ("full" status)
The neighbor is declared as the "Designated Router" ("dr" status):
bird> show ospf neighbors MyOSPF: Router ID Pri State DTime Interface Router IP 192.168.97.103 1 full/dr 00:34 em4 192.168.97.103
Received routes:
bird> show route protocol MyOSPF
3.3.3.3/32 via 192.168.97.103 on em4 [MyOSPF 16:17:38] * E2 (150/10/10000) [192.168.97.103]
192.168.97.0/24 dev em4 [MyOSPF 16:15:43] * I (150/10) [192.168.97.219]
The OSPF topology can be shown:
bird> show ospf topology area 0.0.0.0 router 192.168.97.103 distance 10 network 192.168.97.0/24 metric 10 router 192.168.97.219 distance 0 network 192.168.97.0/24 metric 10 network 192.168.97.0/24 dr 192.168.97.103 distance 10 router 192.168.97.103 router 192.168.97.219
As well as the LSA database:
bird> show ospf lsadb Global Type LS ID Router Age Sequence Checksum 0005 3.3.3.3 192.168.97.103 501 8000000a ec8a 0005 172.16.0.255 192.168.97.219 1150 80000001 81b6 0005 0.0.0.0 192.168.97.219 1150 80000001 37f1 Area 0.0.0.0 Type LS ID Router Age Sequence Checksum 0001 192.168.97.103 192.168.97.103 455 8000000a 2254 0002 192.168.97.103 192.168.97.103 456 80000006 9384 0001 192.168.97.219 192.168.97.219 1144 8000041b 0bf8
NOTE
Do note that the LSA type is shown on the left although it is generally used as the horizontal delimiter in conventional displays.