Create OSPFv3 Routing Profiles
Table of Contents
Expand all | Collapse all
-
- Tap Interfaces
-
- Layer 2 and Layer 3 Packets over a Virtual Wire
- Port Speeds of Virtual Wire Interfaces
- LLDP over a Virtual Wire
- Aggregated Interfaces for a Virtual Wire
- Virtual Wire Support of High Availability
- Zone Protection for a Virtual Wire Interface
- VLAN-Tagged Traffic
- Virtual Wire Subinterfaces
- Configure Virtual Wires
- Configure an Aggregate Interface Group
- Configure Bonjour Reflector for Network Segmentation
- Use Interface Management Profiles to Restrict Access
-
- DNS Overview
- DNS Proxy Object
- DNS Server Profile
- Multi-Tenant DNS Deployments
- Configure a DNS Proxy Object
- Configure a DNS Server Profile
- Use Case 1: Firewall Requires DNS Resolution
- Use Case 2: ISP Tenant Uses DNS Proxy to Handle DNS Resolution for Security Policies, Reporting, and Services within its Virtual System
- Use Case 3: Firewall Acts as DNS Proxy Between Client and Server
- DNS Proxy Rule and FQDN Matching
-
- NAT Rule Capacities
- Dynamic IP and Port NAT Oversubscription
- Dataplane NAT Memory Statistics
-
- Translate Internal Client IP Addresses to Your Public IP Address (Source DIPP NAT)
- Enable Clients on the Internal Network to Access your Public Servers (Destination U-Turn NAT)
- Enable Bi-Directional Address Translation for Your Public-Facing Servers (Static Source NAT)
- Configure Destination NAT with DNS Rewrite
- Configure Destination NAT Using Dynamic IP Addresses
- Modify the Oversubscription Rate for DIPP NAT
- Reserve Dynamic IP NAT Addresses
- Disable NAT for a Specific Host or Interface
-
- Network Packet Broker Overview
- How Network Packet Broker Works
- Prepare to Deploy Network Packet Broker
- Configure Transparent Bridge Security Chains
- Configure Routed Layer 3 Security Chains
- Network Packet Broker HA Support
- User Interface Changes for Network Packet Broker
- Limitations of Network Packet Broker
- Troubleshoot Network Packet Broker
-
- Enable Advanced Routing
- Logical Router Overview
- Configure a Logical Router
- Create a Static Route
- Configure BGP on an Advanced Routing Engine
- Create BGP Routing Profiles
- Create Filters for the Advanced Routing Engine
- Configure OSPFv2 on an Advanced Routing Engine
- Create OSPF Routing Profiles
- Configure OSPFv3 on an Advanced Routing Engine
- Create OSPFv3 Routing Profiles
- Configure RIPv2 on an Advanced Routing Engine
- Create RIPv2 Routing Profiles
- Create BFD Profiles
- Configure IPv4 Multicast
- Create Multicast Routing Profiles
- Create an IPv4 MRoute
Create OSPFv3 Routing Profiles
Create routing profiles for OSPFv3 authentication, global
timers, interface timers, and redistribution on an Advanced Routing
Engine.
The Advanced Routing Engine supports OSPFv3;
create OSPFv3 global timer profiles, authentication profiles, interface
timer profiles, and redistribution profiles to apply to OSPFv3.
This topic describes the profiles and how to create them. Reference
them when you Configure OSPFv3 on an Advanced Routing Engine.
- OSPFv3 Global Timer Profiles—Specify the timers for the link-state advertisement (LSA) interval, SPF calculation delay, initial hold time, and maximum hold time that apply all OSPFv3 areas. SPF Throttle settings allow the protocol to slow the sending of LSA updates while a network is unstable (undergoing topology changes). Apply the profile in the general OSPFv3 configuration. The profile is global for OSPFv3 on the logical router; you can create more than one to easily change global timers.
- OSPFv3 Interface Authentication Profiles—OSPFv3 does not have its own authentication capabilities; it relies on IPSec to secure OSPFv3 messages between neighbors. Apply the profile in thetab.OSPFv3 AreaType
- OSPFv3 Interface Timer Profiles—Specify timers related to interface operations, such as OSPFv3 hello and graceful restart. Apply the profile in the general OSPFv3 configuration.
- OSPFv3 Redistribution Profiles—Redistribute IPv6 static, connected, or IPv6 BGP routes or the IPv6 default route into OSPFv3. Apply the profile in the general OSPFv3 configuration.
- Create an OSPFv3 Global Timer Profile.
- Select.NetworkRoutingRouting ProfilesOSPFv3
- AddanOSPFv3 Global Timer ProfilebyName(a maximum of 63 characters). The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is allowed.
- Enter theLSA min-arrival(in seconds), which is the smallest interval at which the firewall recalculates the SPF tree; range is 1 to 10; default is 5. The firewall would recalculate at a larger interval (less frequently than the setting).
- In the SPF Throttle area, enter theInitial delay(in seconds) from when the logical router receives a topology change until it performs the Shortest Path First (SPF) calculation; range is 0 to 600; default is 5.
- Enter theInitial hold time(in seconds) between the first two consecutive SPF calculations; range is 0 to 600; default is 5. Each subsequent hold time is twice as long as the prior hold time until the hold time reaches the maximum hold time.
- Enter theMaximum hold time(in seconds), which is the largest value that the hold time increases to until it remains steady; range is 0 to 600; default is 5.
- ClickOK.
- Create an OSPFv3 Interface Authentication Profile.
- Select.NetworkRoutingRouting ProfilesOSPFv3
- AddanOSPFv3 Auth ProfilebyName(a maximum of 63 characters). The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is allowed.
- Enter theSPI(Security Policy Index), which must match between both ends of the OSPFv3 adjacency.
- Select theProtocol:ESP(Encapsulating Security Payload) (recommended) orAH(Authentication Header).
- Select theTypeof authentication:
- SHA1(default) Secure Hash Algorithm 1
- SHA256
- SHA384
- SHA512
- MD5
- None
- Enter the authenticationKeyusing 5 hexadecimal sections of 8 hexadecimal characters for a total of 40 hexadecimal characters (for example, A5DEC4DD155A695A8B983AACEAA5A97C6AECB6D1).
- Confirm Keyby entering the same key.
- (ESP only) Select the encryptionAlgorithm:
- 3des(default)
- aes-128-cbc
- aes-192-cbc
- aes-256-cbc
- null
- Enter the encryptionKeyin hexadecimal format; use the correct number of sections based on the type of ESP encryption:
- 3des—Use a total of 6 hexadecimal sections in the key.
- aes-128-cbc—Use a total of 4 hexadecimal sections in the key.
- aes-192-cbc—Use a total of 6 hexadecimal sections in the key.
- aes-256-cbc—Use a total of 8 hexadecimal sections in the key.
- Confirm Keyby entering the same key.
- ClickOK.
- Create an OSPFv3 Interface Timer Profile.
- Select.NetworkRoutingRouting ProfilesOSPFv3
- AddanOSPFv3 Interface Timer ProfilebyName(a maximum of 63 characters). The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is allowed.
- Enter theHello Interval, the interval (in seconds) at which OSPFv3 sends Hello packets; range is 1 to 3,600; default is 10.
- Enter theDead Count, the number of times the Hello Interval can occur from a neighbor without OSPFv3 receiving a Hello packet from the neighbor, before OSPFv3 considers that neighbor down; range is 3 to 20; default is 4.
- Enter theRetransmit Interval, the number of seconds that OSPFv3 waits to receive an ACK for an LSA from a neighbor before OSPFv3 retransmits the LSA; range is 1 to 1,800; default is 5.
- Enter theTransmit Delay, the number of seconds that OSPFv3 delays transmitting an LSA before sending the LSA out an interface; range is 1 to 1,800; default is 1.
- Enter theGraceful Restart Hello Delay (sec)in seconds; range is 1 to 10; default is 10. This setting applies to an OSPFv3 interface when Active/Passive HA is configured. Graceful Restart Hello Delay is the number of seconds during which the firewall sends Grace LSA packets at 1-second intervals. During this time, no Hello packets are sent from the restarting firewall. During the restart, the dead time (which is theHello Intervalmultiplied by theDead Count) is also counting down. If the dead timer is too short, the adjacency will go down during the graceful restart because of the hello delay. Therefore it is recommended that the dead timer be at least four times the value of the Graceful Restart Hello Delay. For example, aHello Intervalof 10 seconds and aDead Countof 4 yield a dead timer of 40 seconds. If theGraceful Restart Hello Delayis set to 10 seconds, that 10-second delay of hello packets is comfortably within the 40-second dead timer, so the adjacency will not time out during a graceful restart.
- ClickOK.
- Create an OSPFv3 Redistribution Profile to specify any combination of IPv6 static routes, connected routes, IPv6 BGP routes, and default IPv6 route to redistribute to OSPFv3.
- Select.NetworkRoutingRouting ProfilesOSPFv3
- AddanOSPFv3 Redistribution ProfilebyName(maximum of 63 characters). The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is allowed.
- SelectIPv6 Staticto allow configuration of this portion of the profile.
- Enablethe IPv6 static redistribution portion of the profile.
- Enter aMetricto apply to the IPv6 static routes redistributed to OSPFv3; range is 1 to 65,535.
- Select aMetric Type:Type 1orType 2.
- Select aRedistribute Route-Mapor create a new Redistribution Route Map whose Match criteria control the IPv6 static routes to redistribute into OSPFv3. Default isNone. If the route map Set configuration includes a Metric Action and Metric Value, they are applied to the redistributed route. Otherwise, the Metric configured on this redistribution profile is applied to the redistributed route. Likewise, the Metric Type in the route map Set configuration takes precedence over the Metric Type configured in this redistribution profile.
- SelectConnectedto allow configuration of this portion of the profile.
- Enablethe connected route redistribution portion of the profile.
- Enter aMetricto apply to the connected routes redistributed to OSPFv3; range is 1 to 65,535.
- Select aMetric Type:Type 1orType 2.
- Select aRedistribute Route-Mapor create a new Redistribution Route Map whose Match criteria control the connected routes to redistribute into OSPFv3. Default isNone. If the route map Set configuration includes a Metric Action and Metric Value, they are applied to the redistributed route. Otherwise, the Metric configured on this redistribution profile is applied to the redistributed route. Likewise, the Metric Type in the route map Set configuration takes precedence over the Metric Type configured in this redistribution profile.
- SelectBGP AFI IPv6to allow configuration of this portion of the profile.
- Enablethe BGP AFI IPv6 route redistribution portion of the profile.
- Enter aMetricto apply to the IPv6 BGP routes redistributed to OSPFv3; range is 0 to 4,294,967,295.
- Select aMetric Type:Type 1orType 2.
- Select aRedistribute Route-Mapor create a new Redistribution Route Map whose Match criteria control the IPv6 BGP routes to redistribute into OSPFv3. Default isNone. If the route map Set configuration includes a Metric Action and Metric Value, they are applied to the redistributed route. Otherwise, the Metric configured on this redistribution profile is applied to the redistributed route. Likewise, the Metric Type in the route map Set configuration takes precedence over the Metric Type configured in this redistribution profile.
- SelectIPv6 Default Routeto allow configuration of this portion of the profile.
- SelectAlwaysto always create and redistribute the default route to OSPFv3, even if there is no default route on the router; default is enabled. IfAlwaysis not set, when there is no default route on the ABR, the default route is not redistributed.
- Enablethe IPv6 Default Route redistribution portion the profile.
- Enter aMetricto apply to the IPv6 default route redistributed to OSPFv3; range is 0 to 4,294,967,295.
- Select aMetric Type:Type 1orType 2.
- ClickOK.
- Commit.