How to use the ospf protocol advise default routing to control users?

Hello everyone,

This post highlights the process of how to use the ospf protocol advise default routing to control users. Please see more details below. 

Figure 1


 
Problem description

As per Figure 1:

• the ACC switch is the access device for the user access network;

• the AGG switch is the spine device for all the routing switches;

• two USGS are the border device for NAT and the Internet outport;

The problem phenomenon is as follows:

• Users cannot access the Internet;

• Asynchronous traffic exists in usg1 andusg2 when Internet traffic is returned;

• The Internet traffic can't auto change to another link quickly when one of the ISP broadband is not working.

Problem analysis

Here, the OSPF protocol is used to implement the interworking between USG and AGG.
Three-layer exchange between AGG and ACC.
ACC is the access device for users accessing to network.
 
UAG1 configuration is below:

ospf 1 router-id 10.10.y.1
 area0.0.0.0
 network 10.10.y.0 0.0.15.255
ip route-static 0.0.0.0 0.0.0.0 （telecom ISP gateway）
 
USG2 configurations are below:

ospf 1 router-id 10.10.y.2
 area0.0.0.0
 network 10.10.y.0 0.0.15.255
 
AGG configurations are below:

ospf 1 router-id 10.10.y.3
 area0.0.0.0
 network 10.10.y.0 0.0.15.255
ip route-static 0.0.0.0 0.0.0.0 (UNIcom ISP gateway)
 
Root cause

There is no default routing in the AGG switch.
There is no tracking of IP-link and no closing firewall link status checking of TCP in the USG Firewall.
 
Solution

Use OSPF to send a default route from USG to AGG.

Add configuration to usg1 and usg2 as follows:

USG1:
ip-link check enable
ip-link 1destination 114.114.114.114 interface g1/0/1 mode icmp next-hop xxxx
iproute-static 0.0.0.0 0.0.0.0 （xxx ISP gateway1） track ip-link 1
ospf 1
default-route-advertisecost 50
undofirewall session link-state check tcp

USG2:

iproute-static 0.0.0.0 0.0.0.0 （xxx ISP gateway2）preference 100
ospf 1
default-route-advertisecost 100
undofirewall session link-state check tcp

That is all I want to share with you! Thank you!