Dear Checkmates,
We have realized, that we obviously lose all sessions, when we add a new interface to our security group and add it into ospf.
set ospf instance default interface bond1.2742 passive on
set ospf instance default interface bond1.2762 area 0.0.0.10 on
Thus I would like to enable OSPF graceful-restart on our securitygroup.
(Although in some comment of C_Atkinson here on the forum it is mentioned, that graceful-restart should not be required, although it refers to Cluster XL?
https://community.checkpoint.com/t5/Security-Gateways/OSPF-drops-on-cluster-failover-since-R81-10-up...
)
Is there anything I need to consider? We peer with Cisco Switches and I stumbled across:
"graceful-restart feature is an industry standard and Maestro supports it for both OSPF and BGP. That way you don't lose routes. graceful-restart must be supported by the peer and timers need to be in sync. The routes will stay while peering is built up after failover."
Can I assume this matches, since OSPF and graceful-restart helper already work?
Also I saw the following in the GUI:
"OSPF Graceful Restart is incompatible with VRRP preempt" mode. Please disable preempt mode before configuring graceful restart"
Since this is no VRRP Cluster and we already have graceful-restart-helper enabled, I think I can ignore this warning?
Do you think it is safe to issue:
set ospf instance default graceful-restart on ?
Thanks in advance and BR,
Thomas