O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

20.11. Manage RPF Information with Redundant Routers

Problem

You need to ensure valid RPF information with the Virtual Redundancy Router Protocol (VRRP) running on the upstream routers.

Solution

Run a dynamic routing protocol for a successful RPF check:

	FIREWALL-A(trust-vr)-> set protocol ospf
	FIREWALL-A(trust-vr/ospf)-> set enable
	FIREWALL-A(trust-vr/ospf)-> end
	FIREWALL-A-> set interface bgroup0 protocol ospf area 0.0.0.0
	FIREWALL-A-> set interface bgroup0 protocol ospf enable
	FIREWALL-A-> set interface ethernet0/0 protocol ospf area 0.0.0.0
	FIREWALL-A->set interface ethernet0/0 protocol ospf enable

Discussion

In a scenario with a single next hop to an RP or source, static routes in the firewall will work just fine. But, to handle the issue of gateway redundancy, VRRP is often used to provide a virtual gateway. You can see this topology in Figure 20-9.

Figure 20-9 shows a firewall connected to a set of multicast listeners. The routers upstream are running VRRP, and the firewall points a static default route to the virtual IP (VIP) address to ensure that connectivity is maintained in the event of a failure. The problem with this scenario is that PIM requires the RPF to the RP or source to point to the PIM neighbor address. In this scenario, the PIM neighbors of the firewall are at 10.5.5.253 and 10.5.5.252. Because the default route points to 10.5.5.254, the RPF check will fail, and PIM will not be able to perform RP mapping or join/prunes to any interested groups. To accommodate this, ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required