OSPF Topology Watcher

OSPF Topology Watcher is like a Git for developers - it helps to track OSPF topology changes and shows it on the history diagram. Changes are exported by Logstash to Elastic Stack (ELK). Components of the solution are wrapped into containers, so it can be increadebly fast to start it. The only thing is needed to configure manually - is GRE tunnel setup on the Linux host.
Logged topology changes:

• OSPF neighbor adjacency Up/Down
• OSPF link cost changes
• OSPF networks appeared/disappeared from the topology

Architecture

The Quagga container has network_mode=host so it sees the GRE tunnel, which is configured by Admin on the Linux Host.

Functional Role

Demo

Click on the image in order zoom it.

Discovering OSPF logs in Kibana. Examples

OSPF cost changes on links

Logs if OSPF adjacency was Up/Down or any networks appeared/disappeared.

How to setup

1. Choose a Linux host with Docker installed
2. Setup Topolograph:

• launch your own Topolograph on docker using topolograph-docker
• or make sure you have a connection to the public https://topolograph.com
  ** Remember TOPOLOGRAPH_HOST, TOPOLOGRAPH_PORT variables
  2.2. Create a user for API authentication using Local Registration form
  ** Remember TOPOLOGRAPH_USER_LOGIN, TOPOLOGRAPH_USER_PASS variables
  2.3. Add your IP address in API/Authorised source IP ranges

3. Setup ELK

• if you already have ELK instance running, so just remember variables below
• if not - boot up a new ELK from docker-elk compose
• Remember ELASTIC_URL, ELASTIC_USER_LOGIN, ELASTIC_USER_PASS

4. Setup GRE tunnel from the host to a network device

sudo modprobe ip_gre
sudo ip tunnel add tun0 mode gre remote <router-ip> local <host-ip> dev eth0 ttl 255
sudo ip address add <GRE tunnel ip address> dev tun0
sudo ip link set tun0 up

5. Setup GRE tunnel from the network device to the host. An example for Cisco

interface gigabitether0/1
ip address <GRE tunnel ip address>
tunnel mode gre
tunnel source <router-ip>
tunnel destination <host-ip>
ip ospf network type point-to-point

Set GRE tunnel network where is placed to quagga/config/ospfd.conf
Set ELASTIC IP in logstash/pipeline/logstash.conf file which is in charge of setting config for exporting logs.

How to start

git clone https://github.com/Vadims06/ospfwatcher.git
cd ospfwatcher

• Fill environment variables in docker-compose.yml file
• Start docker-compose

docker-compose up -d

Kibana settings

Index Templates have already been created. It's needed to check that logs are received by ELK via Kibana/Stack Management/Index Management. watcher-costs-changes and watcher-updown-events should be in a list. Then create Index Pattern Kibana/Stack Management/Index Pattern -> Create index pattern, specify watcher-costs-changes as Index pattern name -> Next -> choose watcher_time as timestamp. Because the connection between Watcher (with Logstash) can be lost, but watcher continues to log all topology changes with the correct time. When the connection is repaired, all logs will be added to ELK and you can check the time of the incident. If you choose @timestamp - the time of all logs will be the time of their addition to ELK.

License

The functionality was tested using Basic ELK license.