6.4 – OSPFv2 Route Filtering

 In this part, you will learn about OSPF route filtering. Route filtering is a method for selectively identifying routes that are advertised or received from neighbor routers. Route filtering may be used to manipulate traffic flows, reduce memory utilization, or improve security.

Filtering of routes with vector-based routing protocols is straightforward. This is because the routes are filtered as routing updates and are advertised to downstream neighbors. However, with link-state routing protocols such as OSPF, every router in an area shares a complete copy of the link-state database. Therefore, filtering of routes generally occurs as routes enter the area on the ABR.

The following sections describe three techniques for filtering routes with OSPF.

• Filtering with Summarization – An easy router filtering method is to use the area area-id range network subnet-mask not-advertise router config command. However, it is limited in its ability to filter.
• Area Filtering – OSPF area filtering is accomplished by using the area area-id filter-list prefix prefix-list-name {in | out} router config command on the ABR.
• Local OSPF Filtering – To enable a route to exist in the OSPF LSDB and prevent it from being installed in the local routing table, use the distribute list feature.

Step 1: Filter with summarization.

a. As an example of filtering with summarization, we will remove the last route summarization command configured on R3.

   Open configuration window

b. On D1, verify that all of the 1010.16.0/24 through 10.10.23.0/24 networks are in the routing table.

   The D2 LANs are in the routing table of D1.

c. Now, on R3, filter the 10.10.18.0/24 network from being advertised to another area using the not-advertise keyword.

d. On D1, verify the routing table.

   Notice that the 10.10.18.0/24 prefix is no longer in the routing table of D1.

Step 2: Use area filtering.

On R1, filter the 10.10.2.0/24 network from being advertised into OSPF Area 0 by creating a prefix list and then referencing the list in the area area-id filter-list prefix prefix-list-name {in | out} command on R1. You will then filter the 10.10.3.0 network from being propagated into Area 2.

  Open configuration window

a. On R1, remove the route summarization command that was configured in Part 2.

b. Verify that the routing table of R2 has the 4 entries from Area 1.

c. Create the following prefix list on R1 to deny 10.10.2.0/24 but permit everything else.

d. Enter OSPF router configuration mode and assign the prefix filter incoming in Area 0.

e. Verify that 10.10.2.0 is not in the routing table of R2.

   Notice that the 10.10.2.0/24 prefix has been filtered from Area 0 is no longer in the R2 routing table.

f. Verify that D2 has a route entry for 10.10.3.0/24.

g. On R3, create the following prefix list to deny 10.10.3.0/24 but permit everything else.

h. On R3, enter OSPF router configuration mode and assign the prefix filter outgoing from Area 0.

i. Verify that 10.10.3.0 is not in the routing table of D2.

Step 3: Use local OSPF filtering.

A distribute list should not be used for filtering prefixes between areas. A distribute list is configured using the distribute-list {acl-number | acl-name | prefix prefix-list-name | route-map route-map-name} in router configuration command.

In this step, we will filter the 10.10.20.0/24 network from entering the R2 routing table.

Open configuration window

a. On R2, verify that 10.10.20.0 is in the routing table.

b. Next enter an ACL called OSPF-FILTER that denies 10.10.20.0/24 from entering the R2 routing table.

c. On R2, enter OSPF router configuration mode and assign the distribute list filter.

d. Verify that 10.10.20.0 prefix is not in the routing table of R2.

e. Verify that the 10.10.20.0 prefix is still being propagated in the area. Verify the routing table of R1.

The 10.10.20.0/24 prefix still appears in the routing table of R1. The distribute list only filtered the route from entering the routing table on R2 but is still in the LSDB for Area 0.