-2

assume that I have 4 buildings which all connected to main building and in each building I have privileged subnet ( red circles ). privileged subnet must be able to connect each other, and rest of the subnet connect together. Can someone explain how can I do this using OSPF ? Thanks

http://s22.postimg.org/5ctmeb9ip/Screen_Shot_2013_04_17_at_1_06_05_AM.png

Soheil
  • 109
  • 1
  • 4
  • I'm sorry, but I can't understand what you're trying to accomplish here. Are you wanting to add OSPF to the existing network? Or are you trying to do some sort of "private" OSPF setup? Please explain further your design goals on this one. – Keller G Apr 16 '13 at 19:18
  • Thanks for reply. I would like to isolate one subnet from each building. I tried to add two ospf id in each router in order to isolate one subnet from others but it doesn't work. All pc can ping. – Soheil Apr 16 '13 at 19:28

1 Answers1

1

I think you might be going about this the wrong way. If you're wanting to prevent certain subnets from communicating with other subnets, you need a firewall, not separate OSPF instances. The 'OSPF ID' in Cisco devices is not like an AS number in EIGRP. The ID is locally-significant and 'router ospf 1' and 'router ospf 999' will happily form neighborships and work fine.

You can use a dedicated firewall device (probably near your edge routers) or just plain ACLs to restrict access between subnets. For instance, on R4 you might do this...

! from the 192.168.6.0/24 into the router interface and towards other private subnets
ip access-list extended acl-private-subnet-in
permit ip 192.168.6.0 0.0.0.255 192.168.3.0 0.0.0.255
permit ip 192.168.6.0 0.0.0.255 192.168.4.0 0.0.0.255

! from other private subnets and out of the router interface and towards 192.168.6.0/24
ip access-list extended acl-private-subnet-out
permit ip 192.168.3.0 0.0.0.255 192.168.6.0 0.0.0.255
permit ip 192.168.4.0 0.0.0.255 192.168.6.0 0.0.0.255

interface <interface towards switch6>
ip access-group acl-private-subnet-in in
ip access-group acl-private-subnet-out out

If you really wanted to go to crazy town, you could also create a separate vrf for your "private" subnets, run MPLS in your core, enable MP-BGP to exchange labels, and treat the whole network as a L3VPN. But I'm betting that's a little more than what you're needing here. =)

Hope this helps,

-Keller

Keller G
  • 644
  • 3
  • 6
  • For complete blocking ACL's should be plenty, or just specify what subnets OSPF should advertise instead of using 192.168.0.0. This really looks like a homework question though. – cpt_fink Apr 18 '13 at 04:33