Skip to main content
Ozz
Ozz
New Member
December 15, 2020
Question

Stop sending advertisement for specific network in ospf Area 0 to the other VPN tunnel

  • December 15, 2020
  • 2 replies
  • 12047 views

Hello,

I have stucked in one subject . I have environmement which has routing protocol is "OSPF"  . HQ-test : 60.60.60.0/24

BCN-Test:70.70.70.0/24. Test-Branc:66.66.66.0/24.

HQ-Test & BCN-Test is connected via VPN  

Hq-Test & Test-Branch is connected via VPN. 

I dont want to advertise Test-Branch Ip block to Bcn-Test , I have tried access-list & prefix list. It has not worked.  I add also routing tables from all sites 

Could you have any idea for the solution?

[style="background-color: #ff0000;"]HQ-TEST routing table:[/style]

HQ-TEST (VPN-VDOM) # get router info routing-table all

S*      0.0.0.0/0 [5/0] via X.X.X.129, internal7

C       1.20.255.19/32 is directly connected, VPN-Tst-BCN_0

C       1.20.255.20/32 is directly connected, VPN-Tst-BCN_0

O       1.20.255.40/30 [110/300] via 1.20.255.20, VPN-Tst-BCN_0, 2d18h39m

O       1.20.255.44/30 [110/200] via 1.20.255.20, VPN-Tst-BCN_0, 2d18h39m

C       1.20.255.59/32 is directly connected, VPN_Bnch2_Dp

                       is directly connected, VPN_Bnch2_Dp_0

C       1.20.255.60/32 is directly connected, VPN_Bnch2_Dp

                       is directly connected, VPN_Bnch2_Dp_0

C       1.20.255.248/30 is directly connected, root2VPN1

O       1.20.255.252/30 [110/200] via 1.20.255.249, root2VPN1, 01w4d19h

O       60.60.60.0/26 [110/101] via 1.20.255.249, root2VPN1, 2d20h28m

O       60.60.60.128/26 [110/101] via 1.20.255.249, root2VPN1, 2d20h28m

O       60.60.60.208/28 [110/101] via 1.20.255.249, root2VPN1, 2d20h28m

O       60.60.60.224/28 [110/101] via 1.20.255.249, root2VPN1, 2d20h28m

O       60.60.60.248/29 [110/101] via 1.20.255.249, root2VPN1, 2d20h28m

C       62.96.202.128/27 is directly connected, internal7

S       66.66.66.0/24 [15/0] via 95.91.224.231, VPN_Bnch2_Dp_0

O       66.66.66.64/26 [110/101] via 1.20.255.60, VPN_Bnch2_Dp_0, 02:26:48

O       66.66.66.128/26 [110/101] via 1.20.255.60, VPN_Bnch2_Dp_0, 02:26:48

O       66.66.66.224/28 [110/101] via 1.20.255.60, VPN_Bnch2_Dp_0, 02:26:48

O       66.66.66.240/29 [110/101] via 1.20.255.60, VPN_Bnch2_Dp_0, 02:26:48

O       70.70.70.64/26 [110/201] via 1.20.255.20, VPN-Tst-BCN_0, 2d18h39m

O       70.70.70.128/26 [110/201] via 1.20.255.20, VPN-Tst-BCN_0, 2d18h39m

O       70.70.70.208/28 [110/201] via 1.20.255.20, VPN-Tst-BCN_0, 2d18h39m

O       70.70.70.224/28 [110/201] via 1.20.255.20, VPN-Tst-BCN_0, 2d18h39m

O       70.70.70.248/29 [110/201] via 1.20.255.20, VPN-Tst-BCN_0, 2d18h39m

C       169.253.0.1/32 is directly connected, OSPF_Loopback

O       169.253.0.2/32 [110/400] via 1.20.255.20, VPN-Tst-BCN_0, 2d18h39m

O       169.253.0.3/32 [110/200] via 1.20.255.249, root2VPN1, 01w4d19h

O       169.253.0.5/32 [110/300] via 1.20.255.249, root2VPN1, 01w4d19h

O       169.253.0.7/32 [110/200] via 1.20.255.20, VPN-Tst-BCN_0, 2d18h39m

O       169.253.0.10/32 [110/300] via 1.20.255.20, VPN-Tst-BCN_0, 2d18h39m

O       169.253.0.66/32 [110/200] via 1.20.255.60, VPN_Bnch2_Dp_0, 02:26:48

 

[style="background-color: #ff0000;"]BCN-TST routing table:[/style]

BCN-TEST (VPN-VDOM) # get router info routing-table all

 

S*      0.0.0.0/0 [5/0] via Y.Y.Y.1, wan2

C       1.20.255.19/32 is directly connected, VPN-HQ-Tst

C       1.20.255.20/32 is directly connected, VPN-HQ-Tst

O       1.20.255.40/30 [110/200] via 1.20.255.45, root2VPN1, 01w4d00h

C       1.20.255.44/30 is directly connected, root2VPN1

O       1.20.255.59/32 [110/100] via 1.20.255.19, VPN-HQ-Tst, 2d18h40m

O       1.20.255.60/32 [110/200] via 1.20.255.19, VPN-HQ-Tst, 2d18h40m

O       1.20.255.248/30 [110/200] via 1.20.255.19, VPN-HQ-Tst, 2d18h40m

O       1.20.255.252/30 [110/300] via 1.20.255.19, VPN-HQ-Tst, 2d18h40m

O       60.60.60.0/26 [110/201] via 1.20.255.19, VPN-HQ-Tst, 2d18h40m

O       60.60.60.128/26 [110/201] via 1.20.255.19, VPN-HQ-Tst, 2d18h40m

O       60.60.60.208/28 [110/201] via 1.20.255.19, VPN-HQ-Tst, 2d18h40m

O       60.60.60.224/28 [110/201] via 1.20.255.19, VPN-HQ-Tst, 2d18h40m

O       60.60.60.248/29 [110/201] via 1.20.255.19, VPN-HQ-Tst, 2d18h40m

O       66.66.66.64/26 [110/201] via 1.20.255.19, VPN-HQ-Tst, 02:27:20

O       66.66.66.128/26 [110/201] via 1.20.255.19, VPN-HQ-Tst, 02:27:20

O       66.66.66.224/28 [110/201] via 1.20.255.19, VPN-HQ-Tst, 02:27:20

O       66.66.66.240/29 [110/201] via 1.20.255.19, VPN-HQ-Tst, 02:27:20

O       70.70.70.64/26 [110/101] via 1.20.255.45, root2VPN1, 2d20h30m

O       70.70.70.128/26 [110/101] via 1.20.255.45, root2VPN1, 2d20h30m

O       70.70.70.208/28 [110/101] via 1.20.255.45, root2VPN1, 2d20h30m

O       70.70.70.224/28 [110/101] via 1.20.255.45, root2VPN1, 2d20h30m

O       70.70.70.248/29 [110/101] via 1.20.255.45, root2VPN1, 2d20h30m

O       169.253.0.1/32 [110/200] via 1.20.255.19, VPN-HQ-Tst, 2d18h40m

O       169.253.0.2/32 [110/300] via 1.20.255.45, root2VPN1, 01w4d00h

O       169.253.0.3/32 [110/300] via 1.20.255.19, VPN-HQ-Tst, 2d18h40m

O       169.253.0.5/32 [110/400] via 1.20.255.19, VPN-HQ-Tst, 2d18h40m

C       169.253.0.7/32 is directly connected, OSPF-VPN

O       169.253.0.10/32 [110/200] via 1.20.255.45, root2VPN1, 01w4d18h

O       169.253.0.66/32 [110/300] via 1.20.255.19, VPN-HQ-Tst, 02:27:20

 

 

 

 

 

 

 

    2 replies

    Benoit_Rech_FTNT
    Staff
    Benoit_Rech_FTNT
    Staff
    December 15, 2020

    Hello, by definition, with OSPF, you should have the same OSPF database in all routers in a specific area. If you want to filter, you need to use different area, or use distribute-list-in on your test branch.

    Benoit

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    December 15, 2020

    Depending on your goal, if you don't want Branch to reach BCN, but still want to use OSPF area 0 for all locations, you should just NOT to set a policy/policies to allow the access.

    Yurisk
    SuperUser
    Yurisk
    SuperUser
    December 15, 2020

    Playing with OSPF filtering is painful regardless of the vendor as all databases have to be the same on all routers then you are only left with filtering what gets installed in RIB of a specific router, then you have to maintain this mess, but there are some good ideas here https://forum.fortinet.com/tm.aspx?m=146241 

     

    cchokbengboun
    cchokbengboun
    New Member
    December 21, 2020

    Dear Ozz,

    Please send us your ospf configuration and the ACLs.

    Thanks

    Ozz
    OzzAuthor
    New Member
    December 21, 2020
    config router access-list

        edit "ac_drop_66"

            config rule

                edit 1

                    set action deny

                    set prefix 66.66.66.0 255.255.255.0

                    set exact-match enable

                next

            end

        next

    end

     

     

    config router ospf

        set abr-type cisco

        set router-id 169.253.0.1

        set restart-mode graceful-restart

        config area

            edit 0.0.0.0

                set authentication md5

                config filter-list

                    edit 1

                        set list "ac_drop_66"

                    next

                end

            next

        end

        config ospf-interface

            edit "OSPF2root"

                set interface "root2VPN1"

                set authentication md5

                set dead-interval 40

                set hello-interval 10

                set network-type point-to-point

                config md5-keys

                    edit 1

                        set key-string ENC izQUWwhEeAXS0e7/3FbUXqeyvKT4a7MlCNK9g==

                    next

                end

            next

            edit "OSPF_Barcelona_2"

                set interface "VPN-Tst-BCN"

                set authentication md5

                set cost 220

                set priority 10

                set dead-interval 40

                set hello-interval 10

                set network-type point-to-point

                config md5-keys

                    edit 1

                        set key-string ENC kA0GugKhLdvfYZV3Q2wTaBoZZtRFoq8XHY1A6A==

                    next

                end

            next

            edit "OSPF-Branch"

                set interface "VPN_Bnch2_Dp"

                set authentication md5

                set dead-interval 40

                set hello-interval 10

                set network-type point-to-point

                config md5-keys

                    edit 1

                        set key-string ENC X04kxQACHw1N91M8Uxxx1cBNECk6b2CGVRpl/aG/qYw==

                    next

                end

            next

        end

        config network

            edit 1

                set prefix 169.253.0.1 255.255.255.255

            next

            edit 2

                set prefix 1.20.255.250 255.255.255.255

            next

            edit 3

                set prefix 10.60.6.10 255.255.255.255

            next

            edit 4

                set prefix 1.20.255.59 255.255.255.255

            next

            edit 5

                set prefix 1.20.255.19 255.255.255.255

            next

        end

        config redistribute "connected"

        end

        config redistribute "static"

            set status enable

        end

        config redistribute "rip"

        end

        config redistribute "bgp"

        end

        config redistribute "isis"

        end

    end

    cchokbengboun
    cchokbengboun
    New Member
    December 21, 2020

    Hi Ozz,

    If you apply a ACL into area configuration, It means that you want to filter between differents area. In your case you only have one area.

    I think you have to apply your ACL directly on the FGT BCN-test with the following configuration :

    config router access

         edit "ac_drop_66"         config rule

                edit 1                 set action deny                 set prefix 66.66.66.0 255.255.255.0                 set exact-match enable             next             edit 2                 set action permit                 set prefix any             next         end       next end

    config router ospf

    set distribute-list-in "ac_drop_66"

    end

     

    Thanks,

    CCH

    Terms & ConditionsAccessibility statement