In the last post we configured static routes so the vm web-1 172.168.10.10 could reach the external layer 3 router 192.168.100.1
Static routes are probably going to be exceptions, and most deployments will use a routing protocol.
In this post we are going to configure the following OSPF areas and mappings
If you haven’t be sure to remove the static routes created on the ESG – see nsx lab – add/remove static routes
First from an esx session run net-vdr -l –route <dLR Name>
and note the routes available
[root@esx01:~] net-vdr -l --route nsxlab+edge-2 VDR nsxlab+edge-2 Route Table Legend: [U: Up], [G: Gateway], [C: Connected], [I: Interface] Legend: [H: Host], [F: Soft Flush] [!: Reject] [E: ECMP] Destination GenMask Gateway Flags Ref Origin UpTime Interface ----------- ------- ------- ----- --- ------ ------ --------- 0.0.0.0 0.0.0.0 192.168.10.10 UG 2 AUTO 806 138800000002 172.16.10.0 255.255.255.0 0.0.0.0 UCI 1 MANUAL 286745 13880000000a 172.16.20.0 255.255.255.0 0.0.0.0 UCI 1 MANUAL 286745 13880000000b 172.16.30.0 255.255.255.0 0.0.0.0 UCI 1 MANUAL 286745 13880000000c 192.168.10.0 255.255.255.128 0.0.0.0 UCI 1 MANUAL 286746 138800000002
Set a router ID
Networking and Security > Edge Perimeter Gateway > Manage
Global Configuration and add a router id, all we are doing is using the uplink interface id as a unique name that OSPF can use to distinguish the device
Enable OSPF
Routing tab > OSPF > Edit and Enable OSPF
And Publish Changes
OSPF sub-divides networks, routers, and links into areas that are identified by a number, it’s a method of limiting route propagation, limiting the scope of route information distribution. In other words we avoid passing the route information for every devices to every device by sub-dividing the network.
First up OSPF always has an Area 0, or backbone Area, this will be the hub that all the other areas must connect to
Before we start creating a new area and Area to Interface mappings we need to decide where to place the backbone area
VMware KB2110603 recommends;
- Each non-backbone area must have at least one router connected to Area 0.
- An OSPF network can have only a single Backbone Area.
- At least one internal router (a router having all interfaces mapped to the same area) must have connectivity to an Area Border Router.
- When configuring NSX for vSphere Distributed Logical Router (DLR), if the uplink interface is not mapped to the Backbone Area, then VMware recommends connecting the uplink interface to an ABR.
In the last post the middle of our network was the ESG, that is where a static route had to be configured, the dLR didn’t need any route itself, so we will locate the area north of the dLR and consider the ESG as the internal router.
Configure ESG
Create Area 2
Next create area to interface mappings on the ESG (which is our area border router) one for each area mapping to the corresponding interfaces
Then configure OSPF to redistribute routes
Specify that connected and Static routes can be redistributed
Publish changes and now move down to the dLR
.3There is only 1 area to interface mapping
An additional IP is required specified as the Protocol Address – this is a type of proxy address
The forwarding address is the Transit-LIF address
Define the OSPF Area
Create an area to Interface mapping
And set the Route Redistribution
That should be all
from an esx session run net-vdr -l –route <dLR Name>
Now note the routes – a new route 192.168.100.0 is added automatically
[root@esx01:~] net-vdr -l --route nsxlab+edge-2
VDR nsxlab+edge-2 Route Table
Legend: [U: Up], [G: Gateway], [C: Connected], [I: Interface]
Legend: [H: Host], [F: Soft Flush] [!: Reject] [E: ECMP]
Destination GenMask Gateway Flags Ref Origin UpTime Interface
----------- ------- ------- ----- --- ------ ------ ---------
0.0.0.0 0.0.0.0 192.168.10.10 UG 1 AUTO 31 138800000002
172.16.10.0 255.255.255.0 0.0.0.0 UCI 2 MANUAL 286995 13880000000a
172.16.20.0 255.255.255.0 0.0.0.0 UCI 1 MANUAL 286995 13880000000b
172.16.30.0 255.255.255.0 0.0.0.0 UCI 1 MANUAL 286995 13880000000c
192.168.10.0 255.255.255.0 0.0.0.0 UCI 1 MANUAL 62 138800000002
192.168.100.0 255.255.255.0 192.168.10.10 UG 2 AUTO 23 138800000002
Ping the vyos router 192.168.100.1 from web-1 172.16.10.10 and it should now respond