Virtual Links With Partitioned Backbone - D-Link DFL-260E User Manual

4.5.2. OSPF Concepts
Chapter 4. Routing
Figure 4.11. Virtual Links with Partitioned Backbone
The virtual link is configured between fw1 and fw2 on Area 1 as it is used as the transit area. In the
configuration, only the Router ID has to be configured, as in the example above show fw2 need to
have a virtual link to fw1 with the Router ID 192.168.1.1 and vice versa. These virtual links need to
be configured in Area 1.
To set this feature up in NetDefendOS, see Section 4.5.3.6, "OSPF VLinks".
OSPF High Availability Support
There are some limitations in High Availability support for OSPF that should be noted:
Both the active and the inactive part of an HA cluster will run separate OSPF processes, although
the inactive part will make sure that it is not the preferred choice for routing. The HA master and
slave will not form adjacency with each other and are not allowed to become DR/BDR on broadcast
networks. This is done by forcing the router priority to 0.
For OSPF HA support to work correctly, the NetDefend Firewall needs to have a broadcast interface
with at least ONE neighbor for ALL areas that the firewall is attached to. In essence, the inactive
part of the cluster needs a neighbor to get the link state database from.
It should also be noted that is not possible to put an HA cluster on the same broadcast network
without any other neighbors (they will not form adjacency with each other because of the router
priority 0). However, it may be possible, depending on the scenario, to setup a point to point link
between them instead. Special care must also be taken when setting up a virtual link to an firewall in
an HA cluster. The endpoint setting up a link to the HA firewall must setup 3 separate links: one to
the shared, one to the master and one to the slave router id of the firewall.
Using OSPF with NetDefendOS
When using OSPF with NetDefendOS, the scenario will be that we have two or more NetDefend
Firewalls connected together in some way. OSPF allows any of these firewall to be able to correctly
route traffic to a destination network connected to another firewall without having a route in its
routing tables for the destination.
183