Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

OSPF: Dangers of non-standard area design - Juniper way

OSPF: Dangers of having non-redundant backbone ABRs isolated areas



This is Part 2 of an OSPF story. Part 1 can be found here: http://forum.ivorde.ro/ospf-multi-area-scenario-with-isolated-areas-cisco-juniper-part-1-t19221.html


In the top diagram I have a non-standard OSPF network (only OSPF AS internal routes) that works well and optimized if all links and nodes are up.

I will show throughout this part some failing scenarios and how parts of the network can remain separated from each other even though there are physical paths.

Based on references from part 1 of this article, Juniper and Cisco have different behavior when it comes to acting as an ABR - more in depth RFC 3509.

Cisco approach: It needs one interface in area 0 - backbone to advertise it self in all areas that it is an ABR (B bit set) and to convert type 1 and type 3 LSAs from one area into type 3 LSA on another area. Without an interface in area 0, it will be a router inside both areas without sending summary LSAs with destinations from other non-backbone area.

Juniper approach: Juniper device will act as an ABR if it has two interfaces in two different areas, even two non-backbone areas. Thus, it will take Router and Summary LSAs from any area (let's say 20) and send Summary LSAs with those destinations to area 30.

Following information will be based on Juniper approach (part 3 will be based on a GNS lab).

In the picture above backbone area is the one on top and chained to it are Areas 10 and 20, next to these areas is chained area 40. Area 40 is isolated from the backbone.

Quiz 1: From Host A traffic to Host B will go via.... ? (remember this setup is based on Junos devices).

Answer: HostA - R3 - R4 - HostB



Why is that ? Let's look at OSPF database on R4 ( I prefer to start from destination ):


R4 injects the destination subnet 10.43.4.0/24 in area 20 in a type 1 Router LSA (interface is added to area 20) - Notice Type 1 LSA bits 0x1 - Acting as ABR.
R4 injects the destination subnet 10.43.4.0/24 in area 40 as a type 4 Summary LSA.

Both LSAs have Advertising Router ID R4 10.255.0.4.

Next we look at R3:


Based on this type 3 LSA that R3 received from R4, it forwards traffic to R4.

Quiz 2: What if link between R3 and R4 is down ? From Host A traffic to Host B will go via.... ?


Answer: HostA - R3 - R1 - R2 - R4 - HostB


So far so good. Redundancy works and I'm happy. But why does it work ?

Again, I start looking at R4. We know R4 injects Type 1 - Router LSA into area 20 that reaches R1 (type 1 has area scope).


Notice the bit 0x1, Advertising router R4 and network 10.43.4.0/24 Stub network.
Now we look at information that R1 injects into Area 10 (towards VR1 and R3):



R1 is present in Areas 10 and 20. It advertises it self in both Area 10 and area 20 as ABR (bit 0x1). In area 10 it sends a summary LSA with it's own ID as advertising router (send intra-area traffic for this network through me). This type 3 LSA reaches R3 R3 builds a route based on it.

Next questions will be more interesting as they start touching backbone area 0 .

Quiz 3: What if link between R1 and R2 is down ? From Host A traffic to Host B will go via.... ?

Answer: HostA - R3 - R1 - VR1 - VR2 - R2 - R4 - HostB


Interesting. Again I'm happy all works. But why does it work ?

This answer is obvious. It's traffic from area 10 via area 0 to area 20.

Quiz 4: What if all links are up except for link between VR2 and R2 ? From VR1 loopback traffic to Host B will go via.... ?

For curiosity sake, before this question is answered, I will show a traceroute from VR1 loopback to HostB:

This path is VR1 - VR2 - R2 - R4 - HostB. Why ? Because VR1 has an idea about 10.43.4.0/24 network via a type 3 LSA - Summary which was injected into Area 0 by VR2 and in this case.

To satisfy even more curious minds: type 3 LSA reaches VR1 via Area 0 from VR2 and via area 10 from R1. VR1 also converts the LSA from area 0 and injects it into area 10. Result ? LSA loop. This LSA will be present in area 10 from R1 and from VR1:



Now, for the answer: They don't go anywhere and packets are dropped Finally I am trully happy (not because of this because we reached a point where this design starts to show flaws.

Let's see why. After link between VR2 and R2 fails, area 0 is isolated from area 20 (where this 10.43.4.0/24 subnet is present).
Initially, my questions were: why ? What ? HM .. ?

Let's see, VR1 has a summary LSA for 10.43.4.0 via area 10:


Why isn't it using it to construct a route:

This points to outside the AS.

Since this network is received ONLY via non-backbone area by VR1 through a summary LSA (VR2 stopped sending the type 3 LSA from area 20 because link between VR2 and R2 failed) and VR1 has a full adjacency on the backbone still, it ignores these summaries.
How do we fix this ? Virtual links (Control plane), tunnels (forwarding plane).




So now VR1 has no adjacency in area 0, Only in area 10 and doesn't ignore tye summary lsa from R1, but traffic is still not flowing:


Hmm so it leaves VR1, R1 and nothig from R2. I look on R1 to see what does it's database contain:


So R1 has a Summary LSA ID 10.255.0.11 from VR1 on Area 10, but it does not send it to area 20.

Conclussion one: OSPF (I know Cisco and find out now also Juniper) does not use a type 3 LSA from non-backbone area to construct another type 3 lsa in another non-backbone area.

What if I move VR1 loopback from area 0 into area 10 ?


After this change, VR1 injects it's Router LSA into area 10 with loopback 10.255.0.11 (after moving loopback from area 0 to area 10).
Now R1 uses this destination and injects a Summary LSA into area 20.



Traffic from VR1 loopback to HostB now flows via non backbone area: area 10 and area 20.


Conclussion finale: A destination network is injected in area 1 via Router LSA, injected into area 2 as summary LSA and is not sent into any other area that is non transit area. Destinations local to an area (present in Router LSA) are sent to a non-backbone router as Summary LSA as well as to backbone.