topic Re: Nokia IPSO wont form an OSPF neighbor relationship with a Gaia 77.30 appliance in Firewall and Security Management

Nokia IPSO wont form an OSPF neighbor relationship with a Gaia 77.30 appliance

jonathan_franc1 — Tue, 27 Nov 2018 15:43:41 GMT

Hi we are in the process of upgrading some legacy NOKIA firewall clusters (vrrp cluster) to Gaia appliances running 77.30, this requires us to upgrade the B cluster first, unfortunately the Gaia will not form an OSPF relationship with the Nokia cluster over a LES.

The Gaia is fine to Cisco neighbours, if we spoof the NOKIA with a cisco device its fine, if we spoof the Gaia with a Cisco device its fine too. The best we can get with Gaia to Nokia is INIT at the Nokia end and DROTHER at the Gaia end ??

Any ideas??

Re: Nokia IPSO wont form an OSPF neighbor relationship with a Gaia 77.30 appliance

AlekseiShelepov — Tue, 27 Nov 2018 16:31:53 GMT

How OSPF is configured on IPSO and on Gaia? - OSPF on Gaia
Did you add correct rules for OSPF in policy? - How to allow Dynamic Routing protocols traffic

Do you see OSPF packets in fw ctl zdebug + drop on Gaia gateway?

Re: Nokia IPSO wont form an OSPF neighbor relationship with a Gaia 77.30 appliance

jonathan_franc1 — Tue, 27 Nov 2018 16:47:32 GMT

We can see ospf hello at both ends using tcpdump

The firewall rules are the same as this is an in situ upgrade using the same ip's and ospf worked fine Nokia to Nokia, i can see no drops in the tracker logs. I will try the fw ctl zdebug + drop command now.

Re: Nokia IPSO wont form an OSPF neighbor relationship with a Gaia 77.30 appliance

jonathan_franc1 — Fri, 15 Feb 2019 09:36:43 GMT

Ok we resolved this temporarily by adding a Cisco device between the two checkpoint devices, when we subsequently upgraded both ends to gaia we had to set the default cluster ID to 2 on the second device to get it to form an OSPF relationship. Would this have resolved the problem on the VRRP Nokia's too?