Route map doesn't filter OSPF routes

OSPF doesn't filter route within an area. You need to use BGP instead.
If you search "OSFP by definition doesn't filter specific routes within the area" at Google search, it would give you below AI answer:
This statement is correct; OSPF (Open Shortest Path First) does not inherently filter specific routes within an area because it operates as a link-state protocol, where all routers within an area must maintain the same Link-State Database (LSDB), meaning you cannot selectively filter routes within that area without affecting the consistency of the database across all devices.

Toshi

Thanks for your help Toshi ¡¡

It makes sense that as it is a common database you cannot filter routes, but I have tryed using a prefix-list and it works perfectly, not applyed at source.

config router prefix-list
edit "PREFIX"
config rule
edit 1
set action deny
set prefix 192.168.116.0 255.255.255.0
unset ge
unset le
next
edit 2
set prefix any
unset ge
unset le
next

config router ospf
set router-id 1.1.1.1
set distribute-list-in "PREFIX"

Curiously it works.

Hi @fortimaster ,

As the KB explained:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-OSPF-distribute-list-in-example-to/ta-p/192864

It does not filter routes. It only controls routes injected into the routing table.

And as you tested, for OSPF, it's better to use a Prefix list instead of an Access list.

Thanks for your help, you are right. The route is filtered before it enters in the RIB. For me is a good option cause I need to filter it to avoid routing problems. There is no problem if the route is on the OSPF data base. We are talking about 192.168.116.0 in my test lab:

-FortiGate-VM64-KVM # get router info routing-table ospf
Routing table for VRF=0
O 10.127.0.0/30 [110/2] via 192.168.204.1, port3, 00:08:32

FortiGate-VM64-KVM # get router info ospf route

E2 192.168.116.0/24 [1/10] via 192.168.204.1, port3

The only thing I have to think about if I should create a new area between these 2 firewalls, just for security reasons and to bypass less information, cause the firewall (internal) that sends the routes to the other (External FW), is connected to area 0 with a lot of routers. In any case, we are talking about firewalls and no one will be able to use that OSPF information if I keep everything connected to area 0.

Thanks ¡¡¡

No. That idea wouldn't work only with two routers/neighbors. If a third router is inbetween, you can split the area at the 3rd one/ABR to bridge between two areas. The nighbors can directly talk each other only in the same area.

With your concern, as I said originally, you can filter out those unwanted routes from advertisement on the source side before entering OSPF domain so that the source router/FGT won't be able to advertise those to the other end over OSPF.
You can use the same route-map on the source FGT as well like below:

config router ospf
  config redistribute connected (or static)
    set status enable
    set routemap <filtering-routemap>
  end
end

Toshi