topic Re: Advertise policy-based vpn route in OSPF in Firewall and Security Management

Advertise policy-based vpn route in OSPF

RickyDan — Thu, 21 Oct 2021 14:33:42 GMT

I have a policy-based site-to-site tunnel to Azure and my Azure networks will be in the 10.0.0.0/8 address space.

How do I advertise this route in OSPF?

Running 3600T/3800 on R80.40 Take 118

Re: Advertise policy-based vpn route in OSPF

PhoneBoy — Thu, 21 Oct 2021 23:02:59 GMT

You can only advertise a route that is configured somewhere (e.g. statically) and then redistribute that to OSPF.

Re: Advertise policy-based vpn route in OSPF

RickyDan — Fri, 22 Oct 2021 16:27:20 GMT

Yes so is there a static route I can create for this route and then advertise? Do I just put any random next-hop address or is there something specific I must do?

Re: Advertise policy-based vpn route in OSPF

PhoneBoy — Fri, 22 Oct 2021 17:40:19 GMT

My inclination would be to configure the route to use whatever the next hop is for the default route.
But that's just a guess.

Re: Advertise policy-based vpn route in OSPF

Timothy_Hall — Sat, 23 Oct 2021 00:19:58 GMT

I usually create the prefix as a blackhole route and then redistribute it which sounds scary, but as long as you have more specific routes than 10.0.0.0/8 in your routing table your traffic will still work fine. In R81+ you can just create a special "NAT Pool" entity in the Gaia OS instead, see here: sk165333: How to Redistribute NAT Prefixes with BGP or OSPF