Juniper Lab Environment - Part V - OSPF NSSA and Totally NSSA

This post is a continuation of my last post, which consisted of multiple OSPF areas, and specifically stub and totally stubby configuration. The fifth part in this series of blog posts will cover a topology that consists of seven vSRXs in my lab network, and a PA-200 that resides at the perimeter of my home network. The goal of this post is to explore the benefits of making area 56 a NSSA and then totally NSSA area. We will then verify connectivity and reach-ability out to the internet from SRX6.

First, let's make area 56 a NSSA area, which will make area 56 almost like a stub area. The main difference is that NSSA's allow redistribution of external routes from the same area.

SRX6 Configuration:

set routing-options static route 10.66.0.0/24 discard
set routing-options static route 10.66.1.0/24 discard
set routing-options static route 10.66.2.0/24 discard
set routing-options static route 10.66.3.0/24 discard
set policy-options policy-statement static term 1 from protocol static
set policy-options policy-statement static term 1 then accept
set protocols ospf export static
set protocols ospf area 0.0.0.56 nssa
set protocols ospf area 0.0.0.56 interface ge-0/0/0.0
set protocols ospf area 0.0.0.56 interface ge-0/0/1.0

Note that above we are adding some static routes and exporting them from the route table to OSPF so that we can simulate the need for configuring a NSSA.

SRX5 Configuration:

set protocols ospf area 0.0.0.56 nssa default-lsa default-metric 10
set protocols ospf area 0.0.0.56 interface ge-0/0/1.0

Here is how the database looks now:

root@6> show ospf database

    OSPF database, Area 0.0.0.56
 Type       ID               Adv Rtr           Seq      Age  Opt  Cksum  Len
Router   5.5.5.5          5.5.5.5          0x80000004   694  0x20 0x64fe  36
Router  *6.6.6.6          6.6.6.6          0x80000004   688  0x20 0x3cd   84
Network *10.10.56.6       6.6.6.6          0x80000001   693  0x20 0x2f76  32
Summary  10.7.0.0         5.5.5.5          0x80000002   274  0x20 0x6aa9  28
Summary  10.7.1.0         5.5.5.5          0x80000002   136  0x20 0x5fb3  28
Summary  10.7.2.0         5.5.5.5          0x80000001  1165  0x20 0x56bc  28
Summary  10.7.3.0         5.5.5.5          0x80000001  1165  0x20 0x4bc6  28
Summary  10.10.23.0       5.5.5.5          0x80000001  1165  0x20 0x36c6  28
Summary  10.10.27.0       5.5.5.5          0x80000001  1165  0x20 0x14e3  28
Summary  10.10.34.0       5.5.5.5          0x80000001  1165  0x20 0xb240  28
Summary  10.10.45.0       5.5.5.5          0x80000001  1165  0x20 0x2fb9  28
NSSA     0.0.0.0          5.5.5.5          0x80000003   413  0x20 0x49c9  36
NSSA    *10.66.0.0        6.6.6.6          0x80000003   115  0x28 0x4aa7  36
NSSA    *10.66.1.0        6.6.6.6          0x80000002   882  0x28 0x41b0  36
NSSA    *10.66.2.0        6.6.6.6          0x80000002   882  0x28 0x36ba  36
NSSA    *10.66.3.0        6.6.6.6          0x80000002   882  0x28 0x2bc4  36

Now let's take it one step further to make area 56 a totally NSSA, which will shrink the database even more by blocking external routes from other areas, as well as inter-area routes from other areas.

SRX5 Configuration:

set protocols ospf area 0.0.0.56 nssa no-summaries

Here is how the database looks now:

rroot@6> show ospf database

    OSPF database, Area 0.0.0.56
 Type       ID               Adv Rtr           Seq      Age  Opt  Cksum  Len
Router   5.5.5.5          5.5.5.5          0x80000008     3  0x20 0x5c03  36
Router  *6.6.6.6          6.6.6.6          0x8000000a     3  0x20 0xb36e  84
Network *10.10.56.6       6.6.6.6          0x80000007     3  0x20 0x237c  32
Summary  0.0.0.0          5.5.5.5          0x80000001    17  0x20 0x75ab  28
NSSA    *10.66.0.0        6.6.6.6          0x80000005     3  0x28 0x46a9  36
NSSA    *10.66.1.0        6.6.6.6          0x80000004     3  0x28 0x3db2  36
NSSA    *10.66.2.0        6.6.6.6          0x80000004     3  0x28 0x32bc  36
NSSA    *10.66.3.0        6.6.6.6          0x80000004     3  0x28 0x27c6  36

root@6> ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=50 time=26.088 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=50 time=15.279 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=50 time=10.849 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=50 time=10.458 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=50 time=13.091 ms
^C
--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 10.458/15.153/26.088/5.734 ms