OpenVPN + OSPF + Multi WAN (EXSTA state)



  • Hi All,

    I have a set-up where my main site has 2 WAN connections, where I also use a separate OpenVPN Server on each WAN interface.
    For my site-2-site setup I have 2 remote sites which are connected to both WAN interfaces with an OpenVPN tunnel (so far so good)

    Now that I have my 2 remote sites connected to my main site over the 2 tunnels, I want do use OSPF to handle the routing for my IP ranges.

    I connect my first remote site to my main site and everything is working smoothly. I do some tests with connection dropping and the route is changing, so I'm still a happy person.

    However when I connect my second remote site, it goes wrong and the state for both is changing to EXSTA/P2P. I don't have a clue why and both remote sites are working fine when they are the only one connected to the main site…

    Some diagnostics:
    root(4): ospfctl show neighbor
    ID              Pri State        DeadTime Address        Iface    Uptime
    0.0.0.4        1  EXSTA/P2P    00:00:35 10.0.20.138    ovpns3    -
    0.0.0.3        1  EXSTA/P2P    00:00:35 10.0.20.134    ovpns3    -
    0.0.0.4        1  EXSTA/P2P    00:00:35 10.0.20.86      ovpns2    -
    0.0.0.3        1  EXSTA/P2P    00:00:35 10.0.20.82      ovpns2    -

    root(8): ospfctl show interface
    Interface  Address            State  HelloTimer Linkstate  Uptime    nc  ac
    lagg0_vlan4 10.0.1.194/26      DOWN  -          unknown    00:00:00  0  0
    lagg0_vlan3 10.0.1.130/26      DOWN  -          unknown    00:00:00  0  0
    lagg0_vlan10 10.0.10.61/26      DOWN  -          unknown    00:00:00  0  0
    ovpns3      10.0.20.129/32    P2P    00:00:03  active    10:19:45  2  2
    ovpns2      10.0.20.65/32      P2P    00:00:00  active    10:16:28  2  2

    root(10): cat ospfd.conf

    This file was created by the pfSense package manager.  Do not edit!

    router-id 0.0.0.1
    no redistribute 10.0.20.0/24
    no redistribute 10.0.0.0/20
    area 0.0.0.0 {
    interface ovpns2 {
    metric 10

    }
    interface ovpns3 {
    metric 100

    }
    interface lagg0_vlan10 {
    passive

    }
    interface lagg0_vlan3 {
    passive

    }
    interface lagg0_vlan4 {
    passive

    }
    }

    Thanks in advance for any tips !


Locked