Routing

Hi Experts

 

I have one SRX cluster A/P, connected to two core switches in router on the stick fasion.

 

SRX1 (Active) ----------Core SW1 --------Core SW2-----------SRX2 (Passive)

 

I want to run OSPF with SRX to two core switches. Can any one routing expert tell me what is the best desing out of below two.

 

1- I will create point to point two subnet with /30 mask. One subnet is between SRX cluster and Core SW1 and other subnet is between SRX cluster and Core SW2 and make point to point OSPF neigbhour between SRX cluster and Core SW1 and similarly point to point OSPF neigbhour between SRX cluster and Core SW2

 

2- I will create single subnet between SRX cluster and two core switches for OSPF routing. SRX cluster will be the point to multipoint neighbour with both core switches. But I believe in this case both core switches will also be OSPF neighbour of each other.

 

Appreciated the feedback from the routing experts.

 

Thanks

Two options seem fine. Personally I prefer option 2 more as it will have only 1 ospf area which should be more easy to manage 🙂

Either way will work fine.

 

I prefer setting OSPF links to P2P whenever possible since it speeds convergence time as there is no DR/BDR election.  Just my preference.

 

@jackycheung -- the proposed solution here is not to create separate OSPF areas, just two /30 P2P links within the same area.

 

If your core-facing interfaces aren't members of a reth interface then you run the chance of ending up with an active-active cluster. I've run into issues with some traffic (most noticeably ICMP echos) not working well when asymmetrically routed through an SRX (primarily in a cluster but I think I've seen it in standalone configurations too). The echo egress one interface and the echo replies get discarded when they ingress the other node. Two separate /30 networks allows you to set the OSPF cost for both sides of the link between your 2nd core and 2nd node to a high enough value that it will not be used unless the adjacency on the other link is down. Putting all of the links in a single subnet makes it so you can only control the flow in one direction (SRX->core). Putting the interfaces in a reth solves this since the reth is seen as the ingress/egress interface, but of course it creates other potential design concerns (if you aren't bridging between your cores, for instance). :w

Thanks for the input guys !