OSPF routing take precedence over ISP redundancy feature

[ankda14]

Hi All,

I was testing ISP redundancy feature on R77.30 platform. To make configuration less , i ran OSPF protocol between firewall and cisco routers. The firewall routing is as below:

S 0.0.0.0/0 via 192.168.254.192, eth1, cost 0, age 1787
O 3.3.3.3/32 via 192.168.229.192, eth2, cost 3, age 1258
via 192.168.254.192, eth1
C 127.0.0.0/8 is directly connected, lo
O 192.168.120.0/24 via 192.168.254.192, eth1, cost 2, age 1320
O 192.168.121.0/24 via 192.168.229.192, eth2, cost 2, age 1320
C 192.168.155.0/24 is directly connected, eth0
C 192.168.215.0/24 is directly connected, eth3
C 192.168.229.0/24 is directly connected, eth2
C 192.168.254.0/24 is directly connected, eth1


I am reaching 3.3.3.3 from my internal machine( 192.168.215.219).

192.126.254.0/24 is primary ISP link
192.168.229.0/24 is backup ISP link

These both links are terminated on firewall.

When i generate traffic from inside machine, path takes backup ISP and which is totally understandable as cost is high for this route in firewall routing table.

But in ISP redundancy, I have configured primary ISP first and backup ISP 2nd in order.

Failover is working properly but it seems this is working through OSPF routing configuration not through ISP redundancy. Please correct me if i am wrong. I tried to bring 192.126.254.0/24 cost to 3 in firewall routing table but didn't worked.

Kindly let us know if this setup is fine or i need to test through static routes? how another default route will be used in this case if already i have default route pointed to next hop of primary ISP?

Thanks

[mdjmcnally]

For ISP Redundancy to work correctly in a HA, ie Primary/Backup process then you configure the NextHop address under the ISP Redundancy in the Gateway Object on the Interfaces.

Which ever is the Active ISP will be the Default Gateway of the Unit, ie if disconnect the Primary ISP interface then the Check Point will reconfigure itself to make the Default Gateway on the Check Point the Backup NextHop and the Primary NextHop will not show in the Routing Table anymore.

If you start advertising more explicit routes via OSPF from the two ISP Routers then any traffic for those destinations will take precedence over the Default Gateway.

By all means peer with OSPF for the INTERNAL interfaces but not the External.