We recently switched R80.40 gateways running JHA take 118 (latest) from MPLS BGP controlled routing to using OSPF over IPSec tunnels using VTIs.
A problem we observed was that re-advertised BGP or static routes would appear in the OSPF database as host routes for the relevant network. I mean by this that a re-advertised static route for eg 192.168.131.0/24 would get installed as a route to 192.168.131.0/32, making hosts in this subnet unreachable.
I found sk117693 (https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...) but the router-id is correctly set as the VIP on both cluster members (we have 4 clustered gateways).
Work around was to construct a filter to exclude /32 (255.255.255.255) routes when processing OSPF LSAs:
set inbound-route-filter ospf2 instance default restrict-all-ipv4
set inbound-route-filter ospf2 instance default route 10.0.0.0/8 between 8 and 31 on
set inbound-route-filter ospf2 instance default route 172.16.0.0/12 between 12 and 31 on
set inbound-route-filter ospf2 instance default route 192.168.0.0/16 between 16 and 31 on
Is this a known issue?
Sample config on gateway originating connected, static and BGP routes:
set router-id 41.1.1.1
set bgp external remote-as 65000 on
set bgp external remote-as 65000 description "Interbranch eBGP"
set bgp external remote-as 65000 peer 192.168.100.6 on
set bgp external remote-as 65000 peer 192.168.100.6 route-refresh on
set bgp external remote-as 65000 peer 192.168.100.6 import-routemap "bgp-inbound" preference 1 on
set route-redistribution to bgp-as 65000 from interface all on
set route-redistribution to bgp-as 65000 from static-route all-ipv4-routes on
set route-redistribution to bgp-as 65000 from ospf2 instance default all-ipv4-routes on
set route-redistribution to bgp-as 65000 from ospf2ase instance default all-ipv4-routes on
set routemap bgp-inbound id 1 on
set routemap bgp-inbound id 1 allow
set ospf instance default area backbone on
set ospf instance default interface vpnt3 area backbone on
set ospf instance default interface vpnt3 hello-interval 1
set ospf instance default interface vpnt3 dead-interval 10
set ospf instance default interface vpnt3 cost 10
set ospf instance default interface vpnt3 priority 1
set ospf instance default interface vpnt3 authtype cryptographic key 1 algorithm md5 secret already_scrambled_xxxxxxxxxxxxxxxxxxxxxx==_00000000000000000000000000000000000000
set ospf instance default area backbone range 192.168.254.1/32 restrict on
set route-redistribution to ospf2 instance default from interface all on
set route-redistribution to ospf2 instance default from static-route all-ipv4-routes on
set route-redistribution to ospf2 instance default from bgp-as-number 65000 all-ipv4-routes on
set inbound-route-filter ospf2 instance default restrict-all-ipv4
set inbound-route-filter ospf2 instance default route 10.0.0.0/8 between 8 and 31 on
set inbound-route-filter ospf2 instance default route 172.16.0.0/12 between 12 and 31 on
set inbound-route-filter ospf2 instance default route 192.168.0.0/16 between 16 and 31 on
Regards
David Herselman
