Octet

Two-point redistribution between OSPF and EIGRP without loops

Cisco IOSExpert

Tasks

  1. On R4, add a static route to the partner network and redistribute it into EIGRP.
  2. On R2 and R3, define with prefix lists which prefixes may cross in each direction. Do not redistribute the transit /30 links.
  3. On R2 and R3, tag routes as they enter each domain and refuse to send a route back into the domain it came from.
  4. Redistribute both ways on R2 and R3 with explicit seed metrics.
  5. Stop R2 and R3 from preferring an OSPF copy of a route that started in EIGRP.
  6. Verify tags, paths and the absence of feedback.

Solution

  1. 1Partner network into EIGRPR4
    R4 on Cisco IOS
    ip route 192.0.2.0 255.255.255.0 10.4.0.254
    !
    router eigrp 100
     redistribute static metric 1000000 1 255 1 1500

    The seed is 1 Gbps and a delay of 1 (tens of microseconds). R2 and R3 see 192.0.2.0/24 as D EX, AD 170.

  2. 2Prefix lists for each directionR2 and R3
    R2 and R3 on Cisco IOS
    ip prefix-list EIGRP-NETS seq 5 permit 10.4.0.0/16 le 24
    ip prefix-list EIGRP-NETS seq 10 permit 192.0.2.0/24
    !
    ip prefix-list OSPF-NETS seq 5 permit 10.1.0.0/16 le 24

    10.4.0.0/16 le 24 matches any route inside 10.4.0.0/16 from /16 to /24, so the 10.4.0.0/24 LAN passes. The 10.0.x.x/30 transit links match neither list and stay in their own domain.

  3. 3Route-maps that tag and block the way backR2 and R3
    R2 and R3 on Cisco IOS
    route-map EIGRP-TO-OSPF deny 10
     match tag 110
    route-map EIGRP-TO-OSPF permit 20
     match ip address prefix-list EIGRP-NETS
     set tag 90
    !
    route-map OSPF-TO-EIGRP deny 10
     match tag 90
    route-map OSPF-TO-EIGRP permit 20
     match ip address prefix-list OSPF-NETS
     set tag 110

    The deny entries come first. A route that entered OSPF from EIGRP (tag 90) can never be sent back into EIGRP, and the reverse for tag 110.

  4. 4Redistribution with seed metricsR2 and R3
    R2 and R3 on Cisco IOS
    router ospf 1
     redistribute eigrp 100 subnets route-map EIGRP-TO-OSPF
    !
    router eigrp 100
     redistribute ospf 1 metric 100000 10 255 1 1500 route-map OSPF-TO-EIGRP

    Into OSPF the default is E2 with metric 20. Into EIGRP nothing is advertised without a metric; this seed is 100 Mbps and 100 microseconds.

  5. 5Do not install EIGRP routes that come back through OSPFR2 and R3
    R2 and R3 on Cisco IOS
    route-map NO-EIGRP-ORIGIN deny 10
     match tag 90
    route-map NO-EIGRP-ORIGIN permit 20
    !
    router ospf 1
     distribute-list route-map NO-EIGRP-ORIGIN in

    OSPF (110) beats EIGRP external (170), so without this, whichever of R2 and R3 redistributes 192.0.2.0/24 second reaches it through R1 and the other redistributor. The filter only changes what each router puts in its own routing table; the LSAs still flood to R1. No mirror filter is needed in EIGRP, because OSPF routes (110) already beat their EIGRP external copies (170).

Verify

R1 output
R1# show ip route ospf | begin Gateway
Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 7 subnets, 3 masks
O E2     10.4.0.0/24 [110/20] via 10.0.13.2, 00:04:10, GigabitEthernet0/0/1
                     [110/20] via 10.0.12.2, 00:04:10, GigabitEthernet0/0/0
O E2  192.0.2.0/24 [110/20] via 10.0.13.2, 00:04:10, GigabitEthernet0/0/1
                   [110/20] via 10.0.12.2, 00:04:10, GigabitEthernet0/0/0

Both EIGRP-side prefixes arrive as E2 through both redistributors (same metric 20, same forward metric 1, so ECMP). No 10.0.24.0/30 or 10.0.34.0/30.

R1 output
R1# show ip route 10.4.0.0
Routing entry for 10.4.0.0/24
  Known via "ospf 1", distance 110, metric 20
  Tag 90, type extern 2, forward metric 1
  Last update from 10.0.13.2 on GigabitEthernet0/0/1, 00:04:10 ago
  Routing Descriptor Blocks:
    10.0.13.2, from 10.255.0.3, 00:04:10 ago, via GigabitEthernet0/0/1
      Route metric is 20, traffic share count is 1
  * 10.0.12.2, from 10.255.0.2, 00:04:10 ago, via GigabitEthernet0/0/0
      Route metric is 20, traffic share count is 1

Tag 90 marks the route as EIGRP-originated. Forward metric 1 is the OSPF cost from R1 to each ASBR.

R1 output
R1# show ip ospf database external 10.4.0.0 | include Advertising|Tag
Advertising Router: 10.255.0.2
      External Route Tag: 90
Advertising Router: 10.255.0.3
      External Route Tag: 90

Both redistributors originate a type 5 LSA for the prefix, both with tag 90.

R4 output
R4# show ip route 10.1.0.0
Routing entry for 10.1.0.0/24
  Known via "eigrp 100", distance 170, metric 28416
  Tag 110, type external
  Redistributing via eigrp 100
  Last update from 10.0.34.1 on GigabitEthernet0/0/1, 00:04:10 ago
  Routing Descriptor Blocks:
    10.0.34.1, from 10.0.34.1, 00:04:10 ago, via GigabitEthernet0/0/1
      Route metric is 28416, traffic share count is 1
      Total delay is 110 microseconds, minimum bandwidth is 100000 Kbit
      Reliability 255/255, minimum MTU 1500 bytes
      Loading 1/255, Hops 1
  * 10.0.24.1, from 10.0.24.1, 00:04:10 ago, via GigabitEthernet0/0/0
      Route metric is 28416, traffic share count is 1
      Total delay is 110 microseconds, minimum bandwidth is 100000 Kbit
      Reliability 255/255, minimum MTU 1500 bytes
      Loading 1/255, Hops 1

Seed 100 Mbps gives 10^7 / 100,000 = 100. Seed delay 100 microseconds plus R4's own 10 is 110, which is 11 tens of microseconds. 256 x (100 + 11) = 28416, through both redistributors.

R3 output
R3# show ip route eigrp | include 192.0.2.0
D EX  192.0.2.0/24 [170/3072] via 10.0.34.2, 00:03:02, GigabitEthernet0/0/1

R3 reaches the partner network directly through R4. Before step 5, one of R2 or R3 showed it as O E2 through R1 instead.

Mistakes people make

  • Configuring the tags and route-maps on only one of the two redistributors. Feedback then happens through the other one.
  • Writing the prefix list as permit 10.4.0.0/16 without le 24, so the /24 LANs do not match and nothing is redistributed.
  • Leaving out the EIGRP seed metric. The OSPF routes are taken but never advertised.
  • Putting the permit entry before the tag deny in a route-map. First match wins, so the deny never runs.
  • Expecting an OSPF distribute-list in to stop LSAs. It only filters what that router installs in its own table.
  • Leaving out the empty permit 20 in NO-EIGRP-ORIGIN. A route-map ends with an implicit deny, so the distribute-list would keep every OSPF route out of the routing table.

On other platforms

Junos has no EIGRP, but the same tag pattern applies when exporting other routes into OSPF. from tag matches and then tag sets, inside an export policy.

Junos
set policy-options policy-statement TO-OSPF term no-feedback from tag 110
set policy-options policy-statement TO-OSPF term no-feedback then reject
set policy-options policy-statement TO-OSPF term partner from protocol static
set policy-options policy-statement TO-OSPF term partner from route-filter 192.0.2.0/24 exact
set policy-options policy-statement TO-OSPF term partner then tag 90
set policy-options policy-statement TO-OSPF term partner then accept
set protocols ospf export TO-OSPF

Say it in the interview

"Two redistribution points need three things. Prefix lists so only the intended prefixes cross. Tags on the way in, with a deny for the other domain's tag on the way out, on both routers, so nothing is fed back. And a fix for AD: OSPF's 110 beats EIGRP external's 170, so I stop each redistributor installing OSPF copies of routes that started in EIGRP. Then I verify the tags in the routing table and in the OSPF database."

Book 3.4 Routing