Introduction to Firewalls

Hello Surendra

If an interface goes down on a router running OSPF, and the network on that interface was being advertised using OSPF, then yes, OSPF must reconverge. This is because:

  1. The network on that interface is removed from the OSPF database within the local router
  2. Advertising updates are sent to all neighboring routers stating that this network is no longer reachable
  3. In addition, any networks that were reachable via that interface are also removed, and update requests are sent to other neighboring OSPF routers to find alternative paths to those destinations.

Now, by default route summarization between OSPF areas on ABRs is not employed. If that is the case then each prefix within an OSPF area will have an LSA reach the ABR and be advertised into the neighboring area. This means that any changes to the OSPF area that take place will also update routing information in neighboring areas. If route summarization is employed at the ABR, then such updates into other areas can be avoided, thus reducing OSPF convergence time. For more info about OSPF summarization, take a look at this lesson:

What effect will this have on a firewall configuration? Well, to be honest, not much. If a firewall is participating in OSPF, it is subject to the same rules as a router would be in the same situation. There are no direct security implications for firewalls that I can think of that arise from such a scenario.

I hope this has been helpful!

Laz