Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VTI Palo --> Pfsense dynamic routing (OSPF)

    Scheduled Pinned Locked Moved IPsec
    17 Posts 3 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      heinola @pete35
      last edited by

      @pete35

      Have done same results odd

      1 Reply Last reply Reply Quote 0
      • M
        michmoor LAYER 8 Rebel Alliance
        last edited by

        well lets start with basics. Is OSPF enabled on the VTI interfaces and not set to passive?
        Have you done a packet capture and can you see OSPF hello packets going transmitted or received?
        I currently am doing BGP across a site and although not the same , protocol speaking, dynamic routing does work. The other end is a Cisco appliance.

        Firewall: NetGate,Palo Alto-VM,Juniper SRX
        Routing: Juniper, Arista, Cisco
        Switching: Juniper, Arista, Cisco
        Wireless: Unifi, Aruba IAP
        JNCIP,CCNP Enterprise

        H 1 Reply Last reply Reply Quote 0
        • H
          heinola @michmoor
          last edited by heinola

          @michmoor

          IPSEC_VTI:
          broadcast
          Ignore MTU

          Sending OSPF (is this sending & receiving?) :
          05:24:45.597232 IP 172.27.67.250 > 224.0.0.5: OSPFv2, Hello, length 44
          05:24:45.597514 IP 172.27.67.249 > 224.0.0.5: OSPFv2, Hello, length 44
          05:24:55.597913 IP 172.27.67.250 > 224.0.0.5: OSPFv2, Hello, length 44
          05:24:55.598318 IP 172.27.67.249 > 224.0.0.5: OSPFv2, Hello, length 44
          05:25:05.598269 IP 172.27.67.250 > 224.0.0.5: OSPFv2, Hello, length 44
          05:25:05.598738 IP 172.27.67.249 > 224.0.0.5: OSPFv2, Hello, length 44

          Firewall rule Pfsense:
          Ipsec --> allow any TCP any PROT from any

          H 1 Reply Last reply Reply Quote 0
          • H
            heinola @heinola
            last edited by

            @heinola
            The Palo might be blocking it somewhere:

            05:57:44.090924 IP 172.27.67.249 > 172.27.67.250: ICMP echo request, id 61461, seq 1829, length 9
            05:57:44.599679 IP 172.27.67.249 > 172.27.67.250: ICMP echo request, id 61461, seq 1830, length 9
            05:57:45.131932 IP 172.27.67.249 > 172.27.67.250: ICMP echo request, id 61461, seq 1831, length 9
            05:57:45.664170 IP 172.27.67.249 > 172.27.67.250: ICMP echo request, id 61461, seq 1832, length 9
            05:57:45.671085 IP 172.27.67.250 > 224.0.0.5: OSPFv2, Hello, length 44
            05:57:46.186924 IP 172.27.67.249 > 172.27.67.250: ICMP echo request, id 61461, seq 1833, length 9
            05:57:46.719164 IP 172.27.67.249 > 172.27.67.250: ICMP echo request, id 61461, seq 1834, length 9
            05:57:47.246912 IP 172.27.67.249 > 172.27.67.250: ICMP echo request, id 61461, seq 1835, length 9
            05:57:47.763203 IP 172.27.67.249 > 172.27.67.250: ICMP echo request, id 61461, seq 1836, length 9
            05:57:47.919920 IP 172.27.67.249 > 224.0.0.5: OSPFv2, Hello, length 44
            05:57:48.274724 IP 172.27.67.249 > 172.27.67.250: ICMP echo request, id 61461, seq 1837, length 9
            05:57:48.798857 IP 172.27.67.249 > 172.27.67.250: ICMP echo request, id 61461, seq 1838, length 9

            H 1 Reply Last reply Reply Quote 0
            • H
              heinola @heinola
              last edited by

              @heinola

              Getting closer but in INIT state:

              OSPF Neighbors
              /usr/local/lib/libfrr.so.0: Unable to relocate undefined weak TLS variable

              Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL
              192.168.20.2 1 Init/DROther 38.764s 172.27.67.250 ipsec1:172.27.67.249 0 0 0

              M 1 Reply Last reply Reply Quote 0
              • M
                michmoor LAYER 8 Rebel Alliance @heinola
                last edited by

                @heinola check the Palo Logs
                Monitor - Traffic.
                Should be rather easy to see if the packets are coming in.

                Also I’m assuming you have open rules on each side for testing? Permit any any?

                Not understanding this rule.
                Ipsec --> allow any TCP any PROT from any

                OSPF doesn’t use TCP.

                Firewall: NetGate,Palo Alto-VM,Juniper SRX
                Routing: Juniper, Arista, Cisco
                Switching: Juniper, Arista, Cisco
                Wireless: Unifi, Aruba IAP
                JNCIP,CCNP Enterprise

                H 1 Reply Last reply Reply Quote 0
                • H
                  heinola @michmoor
                  last edited by heinola

                  @michmoor

                  sry I ment this:

                  122ddba1-fda6-4f54-8f35-7be84f8e2d27-image.png

                  One the PA the tunnel interface is in the trusted zone

                  M 1 Reply Last reply Reply Quote 0
                  • M
                    michmoor LAYER 8 Rebel Alliance @heinola
                    last edited by

                    @heinola you didn’t tell me what the firewall logs look like on the PA. Every zone needs firewall rules

                    Firewall: NetGate,Palo Alto-VM,Juniper SRX
                    Routing: Juniper, Arista, Cisco
                    Switching: Juniper, Arista, Cisco
                    Wireless: Unifi, Aruba IAP
                    JNCIP,CCNP Enterprise

                    H 1 Reply Last reply Reply Quote 0
                    • H
                      heinola @michmoor
                      last edited by heinola

                      @michmoor
                      Made Palo side of VTI IP able to be pinged but not visa versa: VTI Gateway status is good
                      4d40d955-858d-45ab-b50a-2e612d1bc0ae-image.png
                      c434f29a-0027-441f-9b64-6005d0690da5-image.png

                      I see the neighbor has been seen but not fully:
                      b06546b7-2672-45e7-ab9d-5f379bd0b86e-image.png

                      Only traffic I see on that Palo is the gateway ping alive gateway from the Pfsense:

                      Palo tunnel interface is part of trusted zone that uses intrazone default rule only. ( this is what the other Palo's are using for there ipsec VPN's as well. So it has to be something with ospf not fully forming to add routed needed on both side. But it is getting closer. I will keep playing around with it.

                      M 1 Reply Last reply Reply Quote 0
                      • M
                        michmoor LAYER 8 Rebel Alliance @heinola
                        last edited by

                        @heinola I’m pretty sure the problem is on the PA side as you are seeing the Init state which means you are receiving hello packets/
                        As you haven’t shown your traffic logs on the PA I can assume you don’t have access to that firewall. Have who ever manages it see if drops are being seen. You need a rule for this.

                        Firewall: NetGate,Palo Alto-VM,Juniper SRX
                        Routing: Juniper, Arista, Cisco
                        Switching: Juniper, Arista, Cisco
                        Wireless: Unifi, Aruba IAP
                        JNCIP,CCNP Enterprise

                        H 1 Reply Last reply Reply Quote 0
                        • H
                          heinola @michmoor
                          last edited by

                          @michmoor

                          **Figured it out:

                          It didn't like the multicast so much. So i did the P2P**

                          c2cbca94-6731-4edf-b2ad-5365ef2a4d12-image.png

                          098394b0-2b6c-4d5f-95e3-c60d53d445c6-image.png

                          M 1 Reply Last reply Reply Quote 0
                          • M
                            michmoor LAYER 8 Rebel Alliance @heinola
                            last edited by

                            @heinola glad it's resolved. The explantation by Palo about what P2P does is a bit confusing

                            50b271b9-526a-4228-a7cf-af3c8b26d9c4-image.png

                            p2p automatically discovers neighbors but it doesnt state how...i would assume multicast as thats done on Cisco or Arista

                            But Broadcast also automatically discovers neighbors but it states through multicast.

                            So whats the difference?

                            The only option there that would make sense is p2mp where you use Unicast but thats not what you selected.

                            Firewall: NetGate,Palo Alto-VM,Juniper SRX
                            Routing: Juniper, Arista, Cisco
                            Switching: Juniper, Arista, Cisco
                            Wireless: Unifi, Aruba IAP
                            JNCIP,CCNP Enterprise

                            H 1 Reply Last reply Reply Quote 0
                            • H
                              heinola @michmoor
                              last edited by

                              @michmoor

                              You got me there.. it should of worked the other way that is was.

                              It has to be something with the numbered tunnel interface and how it Nat's maybe?

                              remote subnet >> PF virtual tunnel ip >> tunnel ------- tunnel >> pa virtual tunnel ip >> local subnet.

                              Looks like all our tunnels are part of the trusted zone ( same as internal network). No rules applied here would work.

                              Has to be NAT PAT thing on the virtual tunnel ip thats all i got..

                              Hope this help someone else out a bit ty michmoor

                              H 1 Reply Last reply Reply Quote 0
                              • H
                                heinola @heinola
                                last edited by

                                @heinola

                                Think its like:

                                broadcast = hey everyone ( please sir can i have some more )
                                p2p = hey you xxx.xxx.xxx.xxx ( give me what i want )

                                or am i way way off

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.