Subject: Tunnels and OSPF.

From: Tal Sarfaty <[email-masked]>
Date: Mon, 4 Nov 2002 16:51:33 +0200

Is it possible to force the traffic flowing between the OSPF backbone and one of the other areas, to go through a tunnel (for VPN purpose for instance)?

That is without the use of externals and without the use of static routes of course.

The topology can be addressed as a classic "Normal areas" "no summary" single OSPF AS, or any other.

Note that the naive solution would create a "recursive routing" to the destination address of the tunnel.

The last would cause tunnel oscillations.

Thanks,

Tal.

---

From: Sanjai Narain <[email-masked]>
Date: Mon, 4 Nov 2002 13:09:36 -0500

Tal: One solution that we have successfully tried is to define the VPN
as a collection of GRE tunnels. Each GRE tunnel G  is protected by an
IPSec tunnel between G's physical interfaces. Now, a new OSPF process is
run at each router, distinct from any other OSPF process running there.
This process will only see the network of GRE tunnels, and thereby route
and reroute only over these. GRE gives OSPF the illusion that tunnel end
points are directly connected (as intended), so you get routing over
your -secure- overlay nework. The overlay OSPF process must be a new one
to avoid routing loops. This is a well known solution and typing
GRE/OSPF/IPSec into Google will yield numerous case studies.

-- Sanjai Narain

Tal Sarfaty wrote:

> Is it possible to force the traffic flowing between the OSPF backbone
> and one of the other areas, to go through a tunnel (for VPN purpose
> for instance)?
>
> The topology can be addressed as a classic "<?xml:namespace prefix =
> st1 ns = "urn:schemas-microsoft-com:office:smarttags" />Normal areas"
> "no summary" single OSPF AS, or any other.
>
>
--
   Sanjai Narain
   Senior Research Scientist
   Telcordia Technologies
   445 South Street
   Morristown, NJ 07960
   USA
   Tel: +1 973 829 4515 Fax: +1 973 829 5888
   Email: [email-masked]