Route redistribution, which was described in detail in the previous chapter, is another tool that can be used for path control. Path control can be implemented by redistributing the same or different routes with higher metrics at the ASBR, effectively ensuring that internal routers will prefer the path with the lowest metric to reach the external destination network.
When using different metrics during route redistribution, if only one protocol is configured to use different metrics, this will typically result in asymmetric routing as shown in Figure 4-3:
Fig. 4-3. Asymmetric Routing During Redistribution
Figure 4-3 shows a basic network running RIPv2 and OSPF. The RIPv2 domain is connected to R1 via a FastEthernet link and to R2 via an Ethernet link. Network administrators decide to ensure that the RIPv2 domain uses the path via R1 to reach subnets in the OSPF domain. The path through R2 will be used as a secondary path. In order to influence this path selection, the administrators configure RIPv2 to redistribute OSPF routes as follows on R1:
| R1(config)#router rip R1(config-router)#redistribute ospf 1 metric 1 R1(config-router)#exit |
RIPv2 is configured to redistribute OSPF routes on R2 as follows:
| R2(config)#router rip R2(config-router)#redistribute ospf 2 metric 2 R2(config-router)#exit |
Given the configuration above, RIP prefers the path to the OSPF domain via R1 because these routes have a lower metric (hop count). Because the OSPF domain is connected to R1 and R2 using FastEthernet links, administrators decide to simply redistribute RIP into OSPF using the default OSPF metrics. The redistribution configuration on R1 is implemented as follows:
| R1(config)#router ospf 1 R1(config-router)#redistribute rip subnets R1(config-router)#exit |
The same configuration is also applied to R2 as illustrated in the following output:
| R2(config)#router ospf 2 R2(config-router)#redistribute rip subnets R2(config-router)#exit |
Given this implementation, the RIPv2 domain has a single preferred path to the OSPF domain; however, the OSPF domain has two equal-cost paths to the RIPv2 domain, resulting in asymmetric routing. While typically not an issue in such a network, consideration should be given to implementing a symmetric routing solution when using stateful firewalls as is illustrated in the modified topology in Figure 4-4:
Fig. 4-4. Asymmetric Routing With Stateful Firewalls
Figure 4-4 shows the same basic network that is illustrated in Figure 4-3, with the addition of two stateful Firewalls, such as the Cisco ASA firewalls. Based on the configurations implemented on R1 and R2 in the previous section, traffic from the RIPv2 domain to the OSPF domain flows through the firewall connected to R1 en route to its destination.
Traffic from the OSPF domain has two valid equal cost paths through R1 and R2. The return packets from the OSPF domain to the RIPv2 domain are therefore sent using both paths. Referencing the arrows in Figure 4-4, the return traffic through R1 will be permitted by the stateful firewall because the traffic originated inside of the RIPv2 domain and the stateful firewall knows about this traffic. At this point, everything works well.
However, because no traffic from the RIPv2 domain was sent to the OSPF domain via router R2, the firewall between the RIPv2 domain does not know about any internally originated sessions and therefore denies the return traffic. Such a situation may cause intermittent connectivity issues between the RIPv2 and OSPF domains. The recommended solution would therefore be to implement a symmetric routing solution. For example, the configuration on R1 could be modified as follows to ensure that the path through R1 is the preferred path to the RIP domain:
| R1(config)#router ospf 1 R1(config-router)#redistribute rip subnets metric 10 R1(config-router)#exit |
An alternative solution would be to redistribute the routes into OSPF on R2 with a higher metric as illustrated in the following configuration:
| R2(config)#router ospf 2 R2(config-router)#redistribute rip subnets metric 30 R2(config-router)#exit |