OSPF LSA Type 5 Filtering on Cisco IOS

In previous lessons I explained how you can filter routes within the OSPF area and how you can filter type 3 LSAs. This time we’ll take a look how you can filter type 5 LSAs using three different methods.

Here’s the topology we will use for this:

OSPF LSA Type 5 filtering topology

Above we have three routers in two different areas. R1 has some loopback interfaces that we will redistribute into OSPF. We’ll use these to play with some of the filtering techniques.

Configuration

Here’s the OSPF configuration of all routers:

R1#show running-config | section ospf
router ospf 1
 redistribute connected subnets
 network 192.168.12.0 0.0.0.255 area 0
R2#show running-config | section ospf
router ospf 1
 network 192.168.12.0 0.0.0.255 area 0
 network 192.168.23.0 0.0.0.255 area 1
R3#show running-config | section ospf
router ospf 1
 network 192.168.23.0 0.0.0.255 area 1

R1 is using the redistribute connected subnets command to get the networks on the loopback interfaces in OSPF. Let’s see if R2 and R3 have these networks in their routing table:

R2#show ip route ospf 

      172.16.0.0/32 is subnetted, 4 subnets
O E2     172.16.0.1 [110/20] via 192.168.12.1, 00:00:03, FastEthernet0/0
O E2     172.16.1.1 [110/20] via 192.168.12.1, 00:00:03, FastEthernet0/0
O E2     172.16.2.1 [110/20] via 192.168.12.1, 00:00:03, FastEthernet0/0
O E2     172.16.3.1 [110/20] via 192.168.12.1, 00:00:03, FastEthernet0/0
R3#show ip route ospf 

      172.16.0.0/32 is subnetted, 4 subnets
O E2     172.16.0.1 [110/20] via 192.168.23.2, 00:00:07, FastEthernet0/0
O E2     172.16.1.1 [110/20] via 192.168.23.2, 00:00:07, FastEthernet0/0
O E2     172.16.2.1 [110/20] via 192.168.23.2, 00:00:07, FastEthernet0/0
O E2     172.16.3.1 [110/20] via 192.168.23.2, 00:00:07, FastEthernet0/0
O IA  192.168.12.0/24 [110/2] via 192.168.23.2, 00:04:25, FastEthernet0/0

Everything is there. Now let’s see if we can filter these…

Distribute-list Filtering

The first method is the distribute-list. We can use this on the ASBR to filter certain networks from entering the area. Let’s configure one to get rid of 172.16.0.1 /32:

R1(config)#ip access-list standard R1_L0
R1(config-std-nacl)#deny host 172.16.0.1
R1(config-std-nacl)#permit any

R1(config)#router ospf 1
R1(config-router)#distribute-list R1_L0 out

We will use an outbound distribute-list with an access-list that matches the network (host route). Let’s see if it works:

R2#show ip route ospf 

      172.16.0.0/32 is subnetted, 3 subnets
O E2     172.16.1.1 [110/20] via 192.168.12.1, 00:10:12, FastEthernet0/0
O E2     172.16.2.1 [110/20] via 192.168.12.1, 00:10:12, FastEthernet0/0
O E2     172.16.3.1 [110/20] via 192.168.12.1, 00:10:12, FastEthernet0/0
R3#show ip route ospf

      172.16.0.0/32 is subnetted, 3 subnets
O E2     172.16.1.1 [110/20] via 192.168.23.2, 00:10:12, FastEthernet0/0
O E2     172.16.2.1 [110/20] via 192.168.23.2, 00:10:12, FastEthernet0/0
O E2     172.16.3.1 [110/20] via 192.168.23.2, 00:10:12, FastEthernet0/0
O IA  192.168.12.0/24 [110/2] via 192.168.23.2, 00:14:30, FastEthernet0/0

The entry has dissapeared from the routing tables of R2 and R3.

Redistribution with Route-Map

The previous example works but there’s a better solution. Why not prevent certain routes from being redistributed in the first place? Technically this isn’t “filtering” but it works very well.

Let’s see what the current redistribute command looks like now:

R1#show running-config | include redistribute
 redistribute connected subnets

We’ll create a route-map that denies 172.16.1.1 /32 from being redistributed while we allow everything else. When it’s finished we’ll attach it to the redistribute command above:

R1(config)#ip access-list standard R1_L1
R1(config-std-nacl)#permit host 172.16.1.1

R1(config)#route-map CONNECTED_TO_OSPF deny 10
R1(config-route-map)#match ip address R1_L1

R1(config)#route-map CONNECTED_TO_OSPF permit 20

R1(config)#router ospf 1
R1(config-router)#redistribute connected subnets route-map CONNECTED_TO_OSPF

The route-map above will deny 172.16.1.1 /32 and permits everything else. After attaching it to the redistribute command you’ll see this on R2 and R3:

R2#show ip route ospf 

      172.16.0.0/32 is subnetted, 2 subnets
O E2     172.16.2.1 [110/20] via 192.168.12.1, 00:00:03, FastEthernet0/0
O E2     172.16.3.1 [110/20] via 192.168.12.1, 00:00:03, FastEthernet0/0
R3#show ip route ospf

      172.16.0.0/32 is subnetted, 2 subnets
O E2     172.16.2.1 [110/20] via 192.168.23.2, 00:00:07, FastEthernet0/0
O E2     172.16.3.1 [110/20] via 192.168.23.2, 00:00:07, FastEthernet0/0
O IA  192.168.12.0/24 [110/2] via 192.168.23.2, 00:20:34, FastEthernet0/0

It’s gone from the routing table…mission accomplished! Let’s take a look at the final method…

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career!
  • Full Access to our 662 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

501 Sign Ups in the last 30 days

satisfaction-guaranteed
100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Tags:


Forum Replies

  1. Hi Rene,

    Really enjoying the OSPF lessons! Just one query, the first output is what you had in the lesson and am just wondering why you chose the network statement for the loopback 0 as 1.1.1.0 0.0.0.255 area 0, instead of 1.1.1.1 0.0.0.0 area 0, as in the second output?

    R1#show running-config | section ospf
    router ospf 1
     <strong>network 1.1.1.0 0.0.0.255 area 0</strong>
     network 192.168.12.0 0.0.0.255 area 0
     
    R1#show running-config | section ospf
    router ospf 1
     network 1.1.1.1 0.0.0.0 area 0
     network 192.168.12.0 0.0.0.255 area 0
     network 192.168.12.0 0.0.0.
    ... Continue reading in our forum

  2. Hi Shannon,

    It doesn’t matter much which of the two you pick, both will work. The network command basically checks the IP addresses that you have on your interfaces and if it falls within the range of your network command, it will activate OSPF on it.

    If you use 1.1.1.0 0.0.0.255 as the network command then any interfaces that have IP address 1.1.1.X on it will run OSPF. If I have a loopback with IP address 1.1.1.1/32 then this will do the job. The problem is that a loopback with 1.1.1.2/32 will also be automatically advertised in OSPF since it matches the netw

    ... Continue reading in our forum

  3. Hello Rene,
    One quick question. I am trying to use distribute-list in OSPF in outbound direction, but the command is being rejected and the below error message is showing up. Would you please describe why? Thank you so much.

    R1(config-router)#distribute-list prefix cisco out gigabitEthernet 1/0
    **% Interface not allowed with OUT in case of OSPF**
    

    Best Regards,
    Azm

  4. Hello Rene,
    Thanks for your reply. However, I still have a confusion. How does distribute-list work? does it filter LSAs or it resists routes from being installed in the routing table? Let’s say we are looking at topology like below and they are running OSPF:

    Router A------------Router B-(inbound distribute-list)---------------Router C

    Let’s say, Router C has a loopback 1.1.1.1 and it is advertised in OSPF. So if I apply an inbound distribute-list to block 1.1.1.1 on Router B, it does not install 1.1.1.1 route in its routing table. However, it passes the 1.1.1.

    ... Continue reading in our forum

  5. Hello Azm

    Yes, you are correct. The filtering that takes place is filtering of routes from entering the routing table. The filtering does not occur at the interface, but at the mechanism of adding routes to the routing table. Rene mentions the following in the lesson:

    Since the LSDB within the area has to be the same we can’t filter LSAs within the area, we can however filter routes from entering the routing table. Filtering LSAs between areas on an ABR or ASBR is no problem.

    So it is a matter of the definition of the word filter. Filtering in this case

    ... Continue reading in our forum

15 more replies! Ask a question or join the discussion by visiting our Community Forum