In previous lessons I explained how you can filter routes within the OSPF area and how you can filter type 3 LSAs. This time we’ll take a look how you can filter type 5 LSAs using three different methods.
Here’s the topology we will use for this:
Above we have three routers in two different areas. R1 has some loopback interfaces that we will redistribute into OSPF. We’ll use these to play with some of the filtering techniques.
Configuration
Here’s the OSPF configuration of all routers:
R1#show running-config | section ospf
router ospf 1
redistribute connected subnets
network 192.168.12.0 0.0.0.255 area 0R2#show running-config | section ospf
router ospf 1
network 192.168.12.0 0.0.0.255 area 0
network 192.168.23.0 0.0.0.255 area 1R3#show running-config | section ospf
router ospf 1
network 192.168.23.0 0.0.0.255 area 1R1 is using the redistribute connected subnets command to get the networks on the loopback interfaces in OSPF. Let’s see if R2 and R3 have these networks in their routing table:
R2#show ip route ospf
172.16.0.0/32 is subnetted, 4 subnets
O E2 172.16.0.1 [110/20] via 192.168.12.1, 00:00:03, FastEthernet0/0
O E2 172.16.1.1 [110/20] via 192.168.12.1, 00:00:03, FastEthernet0/0
O E2 172.16.2.1 [110/20] via 192.168.12.1, 00:00:03, FastEthernet0/0
O E2 172.16.3.1 [110/20] via 192.168.12.1, 00:00:03, FastEthernet0/0R3#show ip route ospf
172.16.0.0/32 is subnetted, 4 subnets
O E2 172.16.0.1 [110/20] via 192.168.23.2, 00:00:07, FastEthernet0/0
O E2 172.16.1.1 [110/20] via 192.168.23.2, 00:00:07, FastEthernet0/0
O E2 172.16.2.1 [110/20] via 192.168.23.2, 00:00:07, FastEthernet0/0
O E2 172.16.3.1 [110/20] via 192.168.23.2, 00:00:07, FastEthernet0/0
O IA 192.168.12.0/24 [110/2] via 192.168.23.2, 00:04:25, FastEthernet0/0Everything is there. Now let’s see if we can filter these…
Distribute-list Filtering
The first method is the distribute-list. We can use this on the ASBR to filter certain networks from entering the area. Let’s configure one to get rid of 172.16.0.1 /32:
R1(config)#ip access-list standard R1_L0
R1(config-std-nacl)#deny host 172.16.0.1
R1(config-std-nacl)#permit any
R1(config)#router ospf 1
R1(config-router)#distribute-list R1_L0 outWe will use an outbound distribute-list with an access-list that matches the network (host route). Let’s see if it works:
R2#show ip route ospf
172.16.0.0/32 is subnetted, 3 subnets
O E2 172.16.1.1 [110/20] via 192.168.12.1, 00:10:12, FastEthernet0/0
O E2 172.16.2.1 [110/20] via 192.168.12.1, 00:10:12, FastEthernet0/0
O E2 172.16.3.1 [110/20] via 192.168.12.1, 00:10:12, FastEthernet0/0R3#show ip route ospf
172.16.0.0/32 is subnetted, 3 subnets
O E2 172.16.1.1 [110/20] via 192.168.23.2, 00:10:12, FastEthernet0/0
O E2 172.16.2.1 [110/20] via 192.168.23.2, 00:10:12, FastEthernet0/0
O E2 172.16.3.1 [110/20] via 192.168.23.2, 00:10:12, FastEthernet0/0
O IA 192.168.12.0/24 [110/2] via 192.168.23.2, 00:14:30, FastEthernet0/0The entry has dissapeared from the routing tables of R2 and R3.
Redistribution with Route-Map
The previous example works but there’s a better solution. Why not prevent certain routes from being redistributed in the first place? Technically this isn’t “filtering” but it works very well.
Let’s see what the current redistribute command looks like now:
R1#show running-config | include redistribute
redistribute connected subnetsWe’ll create a route-map that denies 172.16.1.1 /32 from being redistributed while we allow everything else. When it’s finished we’ll attach it to the redistribute command above:
R1(config)#ip access-list standard R1_L1
R1(config-std-nacl)#permit host 172.16.1.1
R1(config)#route-map CONNECTED_TO_OSPF deny 10
R1(config-route-map)#match ip address R1_L1
R1(config)#route-map CONNECTED_TO_OSPF permit 20
R1(config)#router ospf 1
R1(config-router)#redistribute connected subnets route-map CONNECTED_TO_OSPFThe route-map above will deny 172.16.1.1 /32 and permits everything else. After attaching it to the redistribute command you’ll see this on R2 and R3:
R2#show ip route ospf
172.16.0.0/32 is subnetted, 2 subnets
O E2 172.16.2.1 [110/20] via 192.168.12.1, 00:00:03, FastEthernet0/0
O E2 172.16.3.1 [110/20] via 192.168.12.1, 00:00:03, FastEthernet0/0R3#show ip route ospf
172.16.0.0/32 is subnetted, 2 subnets
O E2 172.16.2.1 [110/20] via 192.168.23.2, 00:00:07, FastEthernet0/0
O E2 172.16.3.1 [110/20] via 192.168.23.2, 00:00:07, FastEthernet0/0
O IA 192.168.12.0/24 [110/2] via 192.168.23.2, 00:20:34, FastEthernet0/0It’s gone from the routing table…mission accomplished! Let’s take a look at the final method…
Hello Pradeep!
In order to filter type 5 LSAs we must use the “out” keyword when implementing a distribute-list. The “out” keyword indicates that we are filtering LSA type 5, and thus we are filtering routes that are redistributed from external sources. Whereas the “in” keyword is used when we want to remove a route from from the routing table.
I hope this was helpful!
Laz
Distribute-list Filtering example does not work with IOS 15.
I have tried a different format of the access-list and cleared ospf processes. still no joy.
Does anyone have any advice on this?
Hi Elliot,
Just in case I checked it but it’s working fine for me.
I added my configurations to the lesson (at the bottom) in case you want to double check.
Rene
Hello Aniket
As far as I know, GNS3 has no limitations on Type-5 filtering. It should function correctly. Take a look at this Cisco support thread to see if you have any issues similar to this:
... Continue reading in our forumHello Billing
If we applied this route map as you have it here, the following would happen:
You have an access list that denies host 172.16.1.1 and permits everything else. This means that this access list, within a route map will match EVERYTHING except for that specific IP.
When you add it to the route map, with a permit statement, then every time a packet with an IP address other than 172.16.1.1, it will be permitted. Because of the implicit deny at the end of the route map, everything else, which is essentially 172.16.1.1 alone, will be denied.
So a match
... Continue reading in our forum