Skip to main content
RumSpringaHQ
New Member
December 11, 2021
Question

OSPF Outbound Filter - Doing it wrong?

  • December 11, 2021
  • 1 reply
  • 6341 views

So I feel quite silly that I can't get this working, I haven't done many filters but they were never on a fortigate so I apologize for any ignorance in this post.

 

So we have a fair bit of individual subnets hanging off of the 10.24.0.0/16 space. I specifically want to filter out every /27 that's hung under 10.24.x.x. So currently I have this as my OSPF and prefix list configuration.

 

 

config router prefix-list     edit "Block_External-MGMT"         config rule             edit 1                 set action deny                 set prefix 10.43.0.0 255.255.0.0                 unset ge                 unset le             next         end     next end config router ospf     set router-id 10.10.30.1     config area         edit 6.6.6.6             set type stub             config filter-list                 edit 1                     set list "Block_External-MGMT"                     // using the default outbound since this is the origin of redistributed                 next             end         next     end     config redistribute "static"         set status enable         set routemap "static-to-ospf-filter"         set metric-type 1     end end

 

The redistribution is a working filter list allowing 2 specific static routes be advertised to a separate area I did not list in this config.

 

To be specific I am trying to keep only the networks I've added into area 6 stay in area 6 and not be impacted by the redis going on at this specific firewall. The other sites on this area get a bunch of subnets redistributed from another area that's working with completely different firewall's.

1 reply

akristof
Staff
Staff
January 4, 2022

Hello,

 

Thank you for your question. With OSPF route filtering is not so easy as it looks. With OSPF, route filtering can be applied only on ABR. So for example if FortiGate has interfaces in 2 areas, you can filter routes to be distributed from areaX to areaY. Based on your config, your device is only in one area, so filtering will not work. In that case only option is to block/allow routes via redistribution.

 

More info on filter-list:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-OSPF-to-filter-Inter-Area-routes-using/ta-p/197747?externalID=FD33624

 

Have a nice day.

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!