Setting up OSPF can seem complicated because of the large number of configuration
possibilities that OSPF offers. However, in many cases a simple OSPF solution using a minimum
of NetDefendOS objects is needed and setup can be straightforward.
Let us examine again the simple scenario described earlier with just two NetDefend Firewalls.
In this example we connect together the two NetDefend Firewalls with OSPF so they can share
the routes in their routing tables. Both will be inside a single OSPF area which will be part of a
single OSPF autonomous system (AS). If unfamiliar with these OSPF concepts, please refer to
earlier sections for further explanation.
Beginning with just one of these firewalls, the NetDefendOS setup steps are as follows:
1. Create an OSPF Router object
Create a NetDefendOS OSPF Router Process object. This will represent an OSPF Autonomous Area
(AS) which is the highest level in the OSPF hierarchy. Give the object an appropriate name. The
Router ID can be left blank since this will be assigned automatically by NetDefendOS.
2. Add an OSPF Area to the OSPF Router
Within the OSPF Router Process created in the previous step, add a new OSPF Area object. Assign
an appropriate name and use the value 0.0.0.0 for the Area ID.
An AS can have multiple areas but in many cases only one is needed. The ID 0.0.0.0 identifies this
area as the backbone area which forms the central portion of the AS.
3. Add OSPF Interfaces to the OSPF Area
Within the OSPF Area created in the previous step, add a new OSPF Interface for each physical
interface that will be part of the area.
The OSPF Interface object needs the following parameters specified in its properties:
• Interface - the physical interface which will be part of the OSPF area.
• Network - the network on the interface that will be part of the area.
This does not need to be specified and if it is not, the network assigned to the physical
interface is used. For example if lan is the interface then lannet will be the default network.
• Interface Type - this would normally be Auto so that the correct type is automatically
selected.
• The Passive option No OSPF routers connected to this interface must be enabled if the
physical interface does not connect directly to another OSPF Router (in other words, with
another NetDefend Firewall that acts as an OSPF router). For example, the interface may only
be connected to a network of clients, in which case the option would be enabled.
The option must be disabled if the physical interface is connected to another firewall which is
set up as an OSPF Router. In this example, the physical interface connected to the other
firewall would have this option disabled.
4. Add a Dynamic Routing Rule
Finally, a Dynamic Routing Rule needs to be defined to deploy the OSPF network. This involves
two steps:
i. A Dynamic Routing Policy Rule object is added. This rule should be an Import rule that
enables the option From OSPF Process so that the previously defined OSPF Router Process
object is selected. What we are doing is saying that we want to import all routes from the
Chapter 4: Routing
349
To Next Page
Loading...
