A
A
Alexander2017-12-13 15:32:08
Ping
Alexander, 2017-12-13 15:32:08

What are the problems with OSPF over GRE?

So, we have three virtual FreeBSDs, two of them connected by a GRE tunnel to the 10.0.0.0/30 network via external interfaces (sorry for the scheme):
lan1 -- (gre0 10.0.0.1 | em0 1.1.1.2) server1 -- gateway -- server2 (em0 2.2.2.2 | gre0 10.0.0.2) -- lan2
The "servers" have gateway_enable=YES, frr_enable=YES and running zebra with ospfd.
If all three machines are made routers and raised on real OSPF interfaces, routing works perfectly, hellos go every 10 seconds, neighbors are seen, the connectivity is what it should be and everything is pinged from everywhere.
If we remove the dynamics from the gateway, connect the servers with a GRE tunnel, configure the IPsec transport mode on the external interfaces and run OSPF through the tunnel (I really want such a scheme in production), then the magic begins:

  • hellos start going in a row in one direction, while the responses come in about a dead interval of seconds (although the second router sends them in a row to the tunnel in the same way, also not receiving hellos from the first one until the dead interval passes);
  • route tables, respectively, are updated out of time, and routers disappear from each other's neighbors;
  • pings to lan do not follow the tunnel at all, while the route to this network, if it came through OSPF, disappears from the table, it is worth starting a ping;
  • during the passage of multicasts, pings do not even go to the other end of the tunnel.

All of this happens on both sides. Firewalls are off, with static routes lan'y behind the tunnel are available to each other. But with OSPF, this is such nonsense.
Help me find where the dog is buried - in me or somewhere else.
Thank you.

Answer the question

In order to leave comments, you need to log in

1 answer(s)
A
Alexander, 2017-12-16
@Adorne

Thanks to a friend from the opennet.ru forum, he directed me to the right path: since redistribute connected was enabled, the "external" network through which the tunnel worked was also given. In doing so, he turned himself in. Removed this network from the announcement - everything went like clockwork.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question