OSPF - PepVPN Routing fail-over

[JB_North]

Hi,

I’m attempting to use a FusionHub and BR1 to provide cellular fail-over of a public address for a client of ours. This is an overview of what I initially setup for testing

The thinking here was that the BR1 would advertise is LAN subnet (1.1.1.240/30) via OSPF to the network, additionally there is a static route for 1.1.1.240/30 to the FusionHub. The OSPF route takes precedence due to the higher metric and the network routes the client address (1.1.1.242) through IP forwarding to the BR1, then if the BR1 looses it’s WAN connection the cellular connection and PepVPN become active and the traffic is routed through the FusionHub.

I have setup an Oubound Policy

In order to use the WAN uplink, while available then fail-over to the FusionHub in the event of a WAN outage.

Here’s the OSPF status

What I have run into is when the network forwards packets to 1.1.1.242 to the BR1 WAN, the BR1 sends them back to the OSPF learned default gateway instead of forwarding them into the LAN interface. I can ping the BR1’s LAN IP (1.1.1.241) but anything other address in the LAN subnet is forwarded back out the WAN. I can packet dump off my upstream router and watch it try to send packets to the BR1 only to get them back, then resend, and get them back, until the TTL expires and the packets are dropped.

It seems as though the OSPF learned default route is taking precedence over the connected interface routes somehow?

Any thoughts would be appreciated.

[JB_North]

I should add the reason that I haven’t just put the routing into the PepVPN and run it over both WAN and Cellular connections is that I was trying to avoid turning the FusionHub into a single point of failure.

[JB_North]

So further testing…

I loaded up 7.1.1-RC3 into my test BR1 and tried the same setup with BGP. Same results, if the BR1 receives a default route (0.0.0.0/0) via BGP, the LAN subnet becomes unreachable do to a forwarding loop. Same behavior the BR1 forwards packets addressed to LAN clients back out the WAN interface.

However (yay BGP!) if I setup a route-map on the BR1’s BGP peer and deny all so that the the BR1 is advertising it’s LAN network via BGP, but not receiving any routes, then the setup works. The BR1 behaves as intended as long as no match all route is learned via dynamic process.

[Kenny]

Hi, yes, dynamic route learnt from WAN has higher priority. As long as the priority outbound policy rule exists, BR1 does not need to know WAN’s network in your case.