Home
Help
Search
Login
Register
OPNsense Forum
»
Archive
»
17.7 Legacy Series
»
OSPF Redistribute Remote Site-to-Site IPSEC networks
« previous
next »
Print
Pages: [
1
]
Author
Topic: OSPF Redistribute Remote Site-to-Site IPSEC networks (Read 7226 times)
pongafence
Newbie
Posts: 29
Karma: 1
OSPF Redistribute Remote Site-to-Site IPSEC networks
«
on:
August 14, 2017, 02:02:11 pm »
Hi guys,
In out DC, we use OPNsense almost exclusively now. With the exception for one server that runs our old Sophos UTM appliance.
We would like to decommission this, we can complete an Site-to-Site IPSEC tunnel. And traffic flows behind the OPNsense firewall, its internal networks, and our branch site and it's internal networks. But we have a separate OPNsense firewall as well that protects another network, which we use OSPF to publish routes between the two.
So the question is, how do we redistribute Site-to-Site IPSEC tunnel networks to the OSPF Areas? Ive tried selecting Kernel Routes, Static Routes and Connected Routes as well for redistribution.
Logged
fabian
Hero Member
Posts: 2769
Karma: 200
OPNsense Contributor (Language, VPN, Proxy, etc.)
Re: OSPF Redistribute Remote Site-to-Site IPSEC networks
«
Reply #1 on:
August 14, 2017, 04:58:22 pm »
If you have a router in two areas, it will become an ASBR and should do that automatically.
Logged
pongafence
Newbie
Posts: 29
Karma: 1
Re: OSPF Redistribute Remote Site-to-Site IPSEC networks
«
Reply #2 on:
August 15, 2017, 01:19:29 am »
Yup, they are, however none of the other firewalls/routers that are connected to the Shared network are receiving the routes.
Logged
pongafence
Newbie
Posts: 29
Karma: 1
Re: OSPF Redistribute Remote Site-to-Site IPSEC networks
«
Reply #3 on:
August 15, 2017, 01:51:24 am »
Also, I noticed that when I go into "Diagnostics" -> "OSPF" -> "Routing Table".
My remote IPSEC site does not show up in the list, only the locally connected route.
Logged
fabian
Hero Member
Posts: 2769
Karma: 200
OPNsense Contributor (Language, VPN, Proxy, etc.)
Re: OSPF Redistribute Remote Site-to-Site IPSEC networks
«
Reply #4 on:
August 15, 2017, 08:38:43 am »
You may check the output of ifconfig. You may have an issue because there is no local interface for IPsec traffic.
Logged
pongafence
Newbie
Posts: 29
Karma: 1
Re: OSPF Redistribute Remote Site-to-Site IPSEC networks
«
Reply #5 on:
August 15, 2017, 10:25:06 am »
Roger thank, will do. And should there be no local interface? I am noticing as well in my firewall rules, that it's blocking almost all but ICMP traffic coming in over the IPSEC tunnel.
Logged
fabian
Hero Member
Posts: 2769
Karma: 200
OPNsense Contributor (Language, VPN, Proxy, etc.)
Re: OSPF Redistribute Remote Site-to-Site IPSEC networks
«
Reply #6 on:
August 15, 2017, 01:14:06 pm »
Usually in a site to site tunnel, there is no interface because ESP is handled in kernel. The problem in this case is, that the firewall has no shared network between your sites which is afaik a requirement for OSPF.
You may need to tunnel another protocol inside of ESP to get this working or use BGP between the routers and redistribute OSPF/BGP so the connection between the routers will use a TCP based connection.
Logged
pongafence
Newbie
Posts: 29
Karma: 1
Re: OSPF Redistribute Remote Site-to-Site IPSEC networks
«
Reply #7 on:
August 17, 2017, 11:38:46 am »
Thank you for the suggestion! I'll give it a go and try use BGP between IPSEC tunnels.
Logged
Print
Pages: [
1
]
« previous
next »
OPNsense Forum
»
Archive
»
17.7 Legacy Series
»
OSPF Redistribute Remote Site-to-Site IPSEC networks