Filter on Area do not work

Schwierzeck · ‎02-09-2015

Hi there, I want to filter route information about the network 172.28.0.0/16 propagated from a peer in area 0.0.0.2. But it seams that this is not working properly. I get routing information form peer 10.9.9.2 in area 0.0.0.2 for the network 172.28.50.0/24. I can not exclude the network completely because it is used on the internal network. fw-01 # get router info routing-table ospf O E2 10.9.19.0/24 [110/0] via 10.9.9.2, port6, 00:17:16 O E2 172.28.50.0/24 [110/0] via 10.9.9.2, port6, 00:00:17 O E1 172.28.51.0/24 [110/11] via 10.2.2.10, port1, 00:05:48 Here is the configuration. config router access-list edit "Internal_Nets" config rule edit 1 set action deny set prefix 172.28.0.0 255.255.0.0 set exact-match disable next end next end config router ospf set router-id 10.5.7.3 config area edit 0.0.0.0 next edit 0.0.0.2 config filter-list edit 1 set list "Internal_Nets" set direction in next end next end config ospf-interface edit "ethernet1" set interface "port1" set dead-interval 40 set hello-interval 10 next edit "ethernet2" set interface "port2" set dead-interval 40 set hello-interval 10 next edit "ethernet6" set interface "port6" set dead-interval 40 set hello-interval 10 next end config network edit 1 set prefix 10.1.1.0 255.255.255.0 next edit 2 set prefix 10.2.2.0 255.255.255.0 next edit 3 set prefix 10.9.9.0 255.255.255.0 set area 0.0.0.2 next end config redistribute "connected" set status enable end config redistribute "static" set status enable end end

ashukla_FTNT · ‎02-10-2015

config router ospf set router-id 10.5.7.3 config area edit 0.0.0.0 next edit 0.0.0.2 config filter-list edit 1 set list "Internal_Nets" set direction in next end next end

Can you try direction as out

Schwierzeck · ‎02-10-2015

Hi there,

here is the current config:


fw-01 # show router ospf
config router ospf
    set distance-external 60
    set distance-inter-area 60
    set distance-intra-area 60
    set router-id 10.2.5.3
    set restart-mode graceful-restart
    set restart-period 30
        config area
            edit 0.0.0.0
                    config filter-list
                        edit 1
                            set list "1_Out_0.0.0.0"
                        next
                    end
            next
            edit 0.0.0.2
                    config filter-list
                        edit 1
                            set list "10_In_0.0.0.2"
                            set direction in
                        next
                        edit 2
                            set list "30_Out_0.0.0.2"
                        next
                    end
            next
        end
        config ospf-interface
            edit "ethernet1"
                set interface "internal1"
                set dead-interval 40
                set hello-interval 10
            next
            edit "ethernet2"
                set interface "internal2"
                set dead-interval 40
                set hello-interval 10
            next
            edit "ethernet6"
                set interface "internal6"
                set dead-interval 40
                set hello-interval 10
            next
        end
        config network
            edit 1
                set prefix 10.2.2.0 255.255.255.0
            next
            edit 2
                set prefix 10.2.3.0 255.255.255.0
            next
            edit 3
                set prefix 10.9.9.64 255.255.255.192
                set area 0.0.0.2
            next
        end
        config redistribute "connected"
            set status enable
        end
        config redistribute "static"
            set status enable
        end
        config redistribute "rip"
        end
        config redistribute "bgp"
        end
        config redistribute "isis"
        end
end

fw-01 # show router prefix-list
config router prefix-list
    edit "1_Out_0.0.0.0"
            config rule
                edit 10
                    set prefix 10.3.3.0 255.255.255.0
                    unset ge
                    unset le
                next
                edit 12
                    set prefix 10.1.24.24 255.255.255.255
                    unset ge
                    unset le
                next
                edit 24
                    set prefix 10.1.44.38 255.255.255.255
                    unset ge
                    unset le
                next
                edit 30
                    set prefix 10.198.63.21 255.255.255.255
                    unset ge
                    unset le
                next
                edit 40
                    set prefix 10.198.170.21 255.255.255.255
                    unset ge
                    unset le
                next
                edit 50
                    set prefix 1.4.4.1 255.255.255.255
                    unset ge
                    unset le
                next
                edit 55
                    set prefix 1.4.4.2 255.255.255.255
                    unset ge
                    unset le
                next
                edit 60
                    set prefix 1.4.4.3 255.255.255.255
                    unset ge
                    unset le
                next
                edit 80
                    set prefix 10.2.96.0 255.255.255.0
                    unset ge
                    unset le
                next
                edit 120
                    set prefix 10.2.98.0 255.255.255.0
                    unset ge
                    unset le
                next
                edit 130
                    set prefix 10.5.5.0 255.255.255.0
                    unset ge
                    unset le
                next
                edit 140
                    set prefix 10.2.5.0 255.255.255.0
                    unset ge
                    unset le
                next
                edit 150
                    set prefix 10.9.0.0 255.255.0.0
                    unset ge
                    unset le
                next
            end
    next
    edit "10_In_0.0.0.2"
            config rule
                edit 1
                    set prefix 10.9.0.0 255.255.0.0
                    unset ge
                    unset le
                next
                edit 2
                    set action deny
                    set prefix 0.0.0.0 0.0.0.0
                    unset ge
                    unset le
                next
            end
    next
    edit "30_Out_0.0.0.2"
            config rule
                edit 10
                    set prefix 172.28.0.0 255.255.0.0
                    unset ge
                    unset le
                next
                edit 20
                    set prefix 172.16.0.0 255.255.252.0
                    unset ge
                    unset le
                next
                edit 25
                    set prefix 10.9.0.0 255.255.0.0
                    unset ge
                    unset le
                next
                edit 30
                    set prefix 10.0.0.0 255.0.0.0
                    unset ge
                    unset le
                next
                edit 16
                    set action deny
                    set prefix 0.0.0.0 0.0.0.0
                    unset ge
                    unset le
                next
            end
    next
end

and current output:

fw-01 # get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default

S* 0.0.0.0/0 [5/0] via 10.82.128.1, wan1
C 10.2.2.0/24 is directly connected, internal1
C 10.2.3.0/24 is directly connected, internal2
O E2 10.9.9.0/26 [60/0] via 10.9.9.70, internal6, 00:12:49
C 10.9.9.64/26 is directly connected, internal6
C 10.82.128.0/24 is directly connected, wan1
O E2 172.28.50.0/24 [60/0] via 10.9.9.70, internal6, 00:12:49
O E2 172.28.51.0/24 [60/10] via 10.2.2.1, internal1, 00:11:15
O E2 172.28.52.0/24 [60/10] via 10.2.2.1, internal1, 00:11:15
O E2 198.18.0.0/24 [60/10] via 10.2.2.1, internal1, 00:11:15
O E2 198.18.1.0/24 [60/10] via 10.2.2.1, internal1, 00:11:15


fw-01 # get router info routing-table ospf
O E2 10.9.9.0/26 [60/0] via 10.9.9.70, internal6, 00:12:59
O E2 172.28.50.0/24 [60/0] via 10.9.9.70, internal6, 00:12:59
O E2 172.28.51.0/24 [60/10] via 10.2.2.1, internal1, 00:11:25
O E2 172.28.52.0/24 [60/10] via 10.2.2.1, internal1, 00:11:25
O E2 198.18.0.0/24 [60/10] via 10.2.2.1, internal1, 00:11:25
O E2 198.18.1.0/24 [60/10] via 10.2.2.1, internal1, 00:11:25


fw-01 # get router info ospf database brief

                Router Link States (Area 0.0.0.0)

Link ID ADV Router Age Seq# CkSum Flag Link count
10.2.2.1 10.2.2.1 729 80000003 c150 0002 1
10.2.5.3 10.2.5.3 729 80000005 3b9f 0021 2

                Net Link States (Area 0.0.0.0)

Link ID ADV Router Age Seq# CkSum Flag
10.2.2.2 10.2.5.3 729 80000001 6da5 0021

                ASBR-Summary Link States (Area 0.0.0.0)

Link ID ADV Router Age Seq# CkSum Flag
10.9.9.70 10.2.5.3 808 80000001 11ca 0021

                Router Link States (Area 0.0.0.2)

Link ID ADV Router Age Seq# CkSum Flag Link count
10.2.5.3 10.2.5.3 814 80000006 5efc 0021 1
10.5.7.3 10.5.7.3 2517 80000006 372c 0002 1
10.9.0.70 10.9.0.70 2113 80000011 8724 0002 1
10.9.9.70 10.9.9.70 815 80000004 fea7 0002 1

                Net Link States (Area 0.0.0.2)

Link ID ADV Router Age Seq# CkSum Flag
10.9.9.67 10.2.5.3 814 80000001 3d72 0021

                ASBR-Summary Link States (Area 0.0.0.2)

Link ID ADV Router Age Seq# CkSum Flag
10.2.2.1 10.2.5.3 714 80000001 0d2b 0021

                AS External Link States

Link ID ADV Router Age Seq# CkSum Flag Route Tag
10.9.9.0 10.9.0.70 2118 80000001 ea91 0002 E2 10.9.9.0/26 0
10.9.9.0 10.9.9.70 248 80000002 a9c8 0012 E2 10.9.9.0/26 0
10.82.128.0 10.2.5.3 579 80000002 c115 0031 E2 10.82.128.0/24 0
10.82.128.0 10.5.7.3 2797 80000003 9937 0002 E2 10.82.128.0/24 0
172.28.50.0 10.9.0.70 1464 80000006 70e8 0012 E2 172.28.50.0/24 0
172.28.50.0 10.9.9.70 824 80000001 3b1a 0002 E2 172.28.50.0/24 0
172.28.51.0 10.2.2.1 738 80000001 7f3e 0002 E2 172.28.51.0/24 0
172.28.52.0 10.2.2.1 738 80000001 7448 0002 E2 172.28.52.0/24 0
198.18.0.0 10.2.2.1 738 80000001 d709 0002 E2 198.18.0.0/24 0
198.18.1.0 10.2.2.1 738 80000001 cc13 0002 E2 198.18.1.0/24 0

emnoc · ‎02-10-2015

Unless my eyes gone bad, i don't see you applied the filter list inbound.

Are you trying to filter the " 172.28.50.0/24" or "172.28.0.0/16" I was under the impress the former. if I'm seeing your prefix-list correctly;

Should this be ;

 edit "10_In_0.0.0.2"
            config rule
                edit 1
                    set prefix 172.16.50.0 255.255.255.0
                    unset ge
                    unset le
                    set action deny
                next
                edit 2
                    set action deny
                    set prefix 0.0.0.0 0.0.0.0
                    unset ge
                    unset le
                next
            end
    next

vrs

 edit "10_In_0.0.0.2"
            config rule
                edit 1
                    set prefix 10.9.0.0 255.255.0.0
                    unset ge
                    unset le
                next
                edit 2
                    set action deny
                    set prefix 0.0.0.0 0.0.0.0
                    unset ge
                    unset le
                next
            end
    next


And then your External LSA will be squashed for "172.28.50.0 10.9.9.70 824 80000001 3b1a 0002 E2 172.28.50.0/24 0"

PCNSE

NSE

StrongSwan

Schwierzeck · ‎02-10-2015

Hi emnoc,

in list "10_In_0.0.0.2" I explicit allow incoming route for 10.9.0.0/16 and deny anything.

The list is applied in area 0.0.0.2 in inbound direction.

config router ospf
        config area
            edit 0.0.0.2
                    config filter-list
                        edit 1
                            set list "10_In_0.0.0.2"
                            set direction in
                        next
                        edit 2
                            set list "30_Out_0.0.0.2"
                        next
                    end
            next
        end
end

Schwierzeck · ‎02-10-2015

I also attache a drawing.

emnoc · ‎02-11-2015

Than change rule #2 to be;

config rule edit 2 set action deny set prefix 0.0.0.0 0.0.0.0 unset ge set le 32 next end

PCNSE

NSE

StrongSwan

Schwierzeck · ‎02-11-2015

Hi emnoc,

no change, same behavior.

fw-01 (root) # show router prefix-list 10_In_0.0.0.2
config router prefix-list
    edit "10_In_0.0.0.2"
            config rule
                edit 1
                    set prefix 10.9.0.0 255.255.0.0
                    unset ge
                    unset le
                next
                edit 2
                    set action deny
                    set prefix 0.0.0.0 0.0.0.0
                    unset ge
                    set le 32
                next
            end
    next
end

fw-01 (root) # get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default

S* 0.0.0.0/0 [5/0] via 10.82.128.1, wan1
C 10.2.2.0/24 is directly connected, internal1
O E2 10.9.9.0/26 [60/0] via 10.9.9.70, internal6, 00:00:18
C 10.9.9.64/26 is directly connected, internal6
C 10.82.128.0/24 is directly connected, wan1
O E2 172.28.50.0/24 [60/0] via 10.9.9.70, internal6, 00:00:18
O E2 172.28.51.0/24 [60/10] via 10.2.2.1, internal1, 00:00:18
O E2 198.18.254.0/24 [60/10] via 10.2.2.1, internal1, 00:00:18
O E2 198.18.254.1/32 [60/10] via 10.2.2.1, internal1, 00:00:18

emnoc · ‎02-11-2015

OP,

The thing that bothers me in your cfg is this ( see the bold below)

config router ospf config area edit 0.0.0.2 config filter-list edit 1 set list "10_In_0.0.0.2" set direction in next edit 2 set list "30_Out_0.0.0.2" next end next end

Thoughts;

if there a reason for two list? or are you trying to filter both direction in/out ?

Could this list collide with the 1st on the final goal? ( once again why would we filter in about allow the same prefix range out or maybe I'm not fully understanding your goal )

Can you combine the two list into let's say one? And drop what your receiving from EXTERNAL_provider only by only placing the networks you want? Just add rules to covered what you need allowed inbound. You say some routes in 172.28.0.0/16 and from 10.9.0.0/16

edit "10_In_0.0.0.2" config rule edit 1 set prefix 10.9.0.0 255.255.0.0 unset ge unset le next edit 2 set action permit set prefix {x.x.x.x} insert what else you need unset ge unset le 32 next

edit 100

set action deny

set prefix 0.0.0.0 0.0.0.0

set ge 0

set le 32

edit "10_In_0.0.0.2" config rule edit 1 set prefix 10.9.0.0 255.255.0.0 unset ge unset le next edit 2 set action deny set prefix 0.0.0.0 0.0.0.0 unset ge unset le 32 next end next edit "30_Out_0.0.0.2" config rule edit 10 set prefix 172.28.0.0 255.255.0.0 unset ge unset le next edit 20 set prefix 172.16.0.0 255.255.252.0 unset ge unset le next edit 25 set prefix 10.9.0.0 255.255.0.0 unset ge unset le next

Are you actually wanting to push routes from 172.16.* into area 0.2?

I think you can combine the two and just apply filters to allow what you want and drop the rest, make sure the rules are sequenced correctly. Also one bad thing about the behavior with FortiOS appending a new rule is added to the bottom of the list.

e.g

If you create rule 1, 2, 1000 and then 100, the 100 is not insert at least inbetween the cfg between 2--1000.

So if you goal is only to drop the other unwanted prefixes from within area2 apply the permit statements for the exact matches and the final deny all at the tail-end

edit 100 set action deny set prefix 0.0.0.0 0.0.0.0 set ge 0 set le 32 next

Try that and think about my suggestions.

PCNSE

NSE

StrongSwan

Schwierzeck · ‎02-12-2015

Hi all,

I opend a case at FortiNet Support and I got this reply.

Dear customer, My name is Nicolas, I will assist you with this case. According to the outputs, 172.28.0.0/16 subnets are LSA type 5 (external) : O E2 172.28.50.0/24 [60/0] via 10.9.9.70, internal6, 00:12:49 O E2 172.28.51.0/24 [60/10] via 10.2.2.1, internal1, 00:11:15 O E2 172.28.52.0/24 [60/10] via 10.2.2.1, internal1, 00:11:15 It means they have been injected into OSPF by redistribution. By design, only LSA type 1, 2 and 3 can be filtered at area boundary using filter-list. LSA type 5 are propagated everywhere regardless of the filter-list. There several solutions to resolved your issue : Solution 1 - Do not inject 172.28.0.0/16 subnets with redistribute. Use network statement instead (config network). Subnets will be injected in OSPF as LSA type 1 instead of a type 5 (in term of OSPF design, it is the best solution) Solution 2 - Use Stub area instead of "normal" area. LSA type 5 are not forwarded in a stub area (they are blocked at the ABR), a default route pointing to ABR is generated instead. Solution 3 - Use distribute list to control routes which will be installed in the routing table. However, it will not prevent propagation of LSA type 5. It will only prevent route installation in the local routing table. Here is an example of distribute list : http://kb.fortinet.com/kb...D30259&languageId=

So the problem is not solvable.

emnoc · ‎02-13-2015

I have to disagree, the solution is in the link that you provide.

Like suggested before the distribute list with a prefix-list should work. The LSA will be in the ospf-database but the RIB would not display the route

i.e

set distribute-list-in 10_In_0.0.0.2

PCNSE

NSE

StrongSwan