Fortigate OSPF stop inter-area distribution

[sidp]

I found the following article about ospf inter-area distribution.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-OSPF-to-filter-Inter-Area-rout...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuration-of-OSPF-Stub-Totally-Stub-NS...

OSPF and Fortigate are fairly new to me... I am planning to replace a Cisco Firepower with a Fortigate.

Currently on the Cisco firepower there are two opsf processes configured. One has area id 0 and the other has area-id 10 and both are connected to two different cisco switches. Because of the two ospf processes the areas are separated which means cisco-sw2 doesn't receive any routes from area 10. Since Fortigate doesn't support more than one ospf process I have to find another solution.

cisco-sw1---area-id 10---Fortigate(Cisco FTD)---area-id 0---cisco-sw2

How can I prevent Fortigate from distributing learned routes from area 10 to 0 (sw2)?

Current Fortigate config:

fortigate # show router ospf 
config router ospf
set router-id 2.2.2.2
config area
edit 0.0.0.0
next
edit 0.0.0.10
set type stub
next
end
config ospf-interface
edit "clientvpn"
set interface "port2.505"
set dead-interval 40
set hello-interval 10
next
edit "dmvpn"
set interface "port2.503"
set dead-interval 40
set hello-interval 10
next
edit "inside"
set interface "inside"
set dead-interval 40
set hello-interval 10
next
edit "transit"
set interface "port2.506"
set dead-interval 40
set hello-interval 10
next
end
config network
edit 1
set prefix 10.30.15.0 255.255.255.240
next
edit 2
set prefix 10.30.13.0 255.255.255.240
next
edit 3
set prefix 10.30.14.0 255.255.255.240
next
edit 4
set prefix 10.30.16.0 255.255.255.240
set area 0.0.0.10
next
end
config redistribute "connected"
end
config redistribute "static"
end
config redistribute "rip"
end
config redistribute "bgp"
end
config redistribute "isis"
end
end

[srajeswaran]

If you are looking to block all the routes from area 10, then we don't have to use any filters, we may try the below as suggested in the article shared by you.

# config router prefix-list

edit "FILTER_AREA_10_NETWORKS"

# config rule

edit 1

set action deny

set prefix any

unset ge

unset le

next

end

Apply this on Area10 out direction.

# config router ospf

# config area

edit 0.0.0.10

# config filter-list

edit 1

set list "FILTER_AREA_10_NETWORKS"

set direction out        

next

end

next

end

end

[sidp]

Hi Suraj,

I tried it but nothing changes and rechecked the configuration.

"set direction out" doesn't appear in the show config but maybe this is just because it is the default value. I also tested it with set direction in which appeared in the config but again nothing changed...

Regards,

Patrick

[srajeswaran]

Can you share the output of "get router info ospf database brief"

[sidp]

with filter:

Spoiler

fortigate # get router info ospf database brief

OSPF Router with ID (2.2.2.2) (Process ID 0, VRF 0)

Router Link States (Area 0.0.0.0)

Link ID ADV Router Age Seq# CkSum Flag Link count
1.1.1.1 1.1.1.1 1849 80000616 7c16 0012 1
2.2.2.2 2.2.2.2 1372 80000726 c7cc 0031 3
3.3.3.1 3.3.3.1 1191 8000076e 8f95 0012 1
3.3.3.3 3.3.3.3 1221 80000771 9584 0012 1

Net Link States (Area 0.0.0.0)

Link ID ADV Router Age Seq# CkSum Flag
10.30.13.12 3.3.3.1 1191 80000658 f895 0012
10.30.14.1 2.2.2.2 72 80000141 4d8f 0031
10.30.15.12 3.3.3.3 1221 80000659 e89e 0012

ASBR-Summary Link States (Area 0.0.0.0)

Link ID ADV Router Age Seq# CkSum Flag
4.4.4.4 2.2.2.2 1632 8000001f 36ee 0031

Router Link States (Area 0.0.0.10)

Link ID ADV Router Age Seq# CkSum Flag Link count
2.2.2.2 2.2.2.2 179 80000026 f8a4 0031 1
4.4.4.4 4.4.4.4 1983 8000022f 2034 0012 1

Net Link States (Area 0.0.0.10)

Link ID ADV Router Age Seq# CkSum Flag
10.30.16.14 4.4.4.4 471 8000001c 5a65 0012

Summary Link States (Area 0.0.0.10)

Link ID ADV Router Age Seq# CkSum Flag Route
10.30.13.0 2.2.2.2 762 8000001f 27e8 0031 10.30.13.0/28
10.30.14.0 2.2.2.2 72 8000001f 1cf2 0031 10.30.14.0/28
10.30.15.0 2.2.2.2 202 8000001f 11fc 0031 10.30.15.0/28

ASBR-Summary Link States (Area 0.0.0.10)

Link ID ADV Router Age Seq# CkSum Flag
1.1.1.1 2.2.2.2 292 80000023 b874 0031
3.3.3.1 2.2.2.2 1722 80000022 72b5 0031
3.3.3.3 2.2.2.2 442 80000023 5cc8 0031

AS External Link States

Link ID ADV Router Age Seq# CkSum Flag Route Tag
10.0.9.0 4.4.4.4 1983 80000222 4119 0012 E2 10.0.9.0/24 0
10.0.10.0 4.4.4.4 471 80000223 e53a 0012 E2 10.0.10.0/23 0
10.0.12.0 4.4.4.4 1982 80000222 2037 0012 E2 10.0.12.0/24 0
10.0.13.0 4.4.4.4 1982 80000222 1541 0012 E2 10.0.13.0/24 0
10.0.15.0 4.4.4.4 468 80000223 b366 0012 E2 10.0.15.0/24 0
...long list...

without filter:

Spoiler

fortigate # get router info ospf database brief

OSPF Router with ID (2.2.2.2) (Process ID 0, VRF 0)

Router Link States (Area 0.0.0.0)

Link ID ADV Router Age Seq# CkSum Flag Link count
1.1.1.1 1.1.1.1 1543 80000616 7c16 0012 1
2.2.2.2 2.2.2.2 1067 80000726 c7cc 0031 3
3.3.3.1 3.3.3.1 886 8000076e 8f95 0012 1
3.3.3.3 3.3.3.3 916 80000771 9584 0012 1

Net Link States (Area 0.0.0.0)

Link ID ADV Router Age Seq# CkSum Flag
10.30.13.12 3.3.3.1 886 80000658 f895 0012
10.30.14.1 2.2.2.2 1527 80000140 4f8e 0031
10.30.15.12 3.3.3.3 916 80000659 e89e 0012

Summary Link States (Area 0.0.0.0)

Link ID ADV Router Age Seq# CkSum Flag Route
10.30.16.0 2.2.2.2 377 8000001f 0607 0031 10.30.16.0/28

ASBR-Summary Link States (Area 0.0.0.0)

Link ID ADV Router Age Seq# CkSum Flag
4.4.4.4 2.2.2.2 1327 8000001f 36ee 0031

Router Link States (Area 0.0.0.10)

Link ID ADV Router Age Seq# CkSum Flag Link count
2.2.2.2 2.2.2.2 1747 80000023 fea1 0031 1
4.4.4.4 4.4.4.4 1678 8000022f 2034 0012 1

Net Link States (Area 0.0.0.10)

Link ID ADV Router Age Seq# CkSum Flag
10.30.16.14 4.4.4.4 165 8000001c 5a65 0012

Summary Link States (Area 0.0.0.10)

Link ID ADV Router Age Seq# CkSum Flag Route
10.30.13.0 2.2.2.2 457 8000001f 27e8 0031 10.30.13.0/28
10.30.14.0 2.2.2.2 1507 8000001e 1ef1 0031 10.30.14.0/28
10.30.15.0 2.2.2.2 1707 8000001e 13fb 0031 10.30.15.0/28

ASBR-Summary Link States (Area 0.0.0.10)

Link ID ADV Router Age Seq# CkSum Flag
1.1.1.1 2.2.2.2 1797 80000022 ba73 0031
3.3.3.1 2.2.2.2 1417 80000022 72b5 0031
3.3.3.3 2.2.2.2 137 80000023 5cc8 0031

AS External Link States

Link ID ADV Router Age Seq# CkSum Flag Route Tag
10.0.9.0 4.4.4.4 1678 80000222 4119 0012 E2 10.0.9.0/24 0
10.0.10.0 4.4.4.4 165 80000223 e53a 0012 E2 10.0.10.0/23 0
10.0.12.0 4.4.4.4 1677 80000222 2037 0012 E2 10.0.12.0/24 0
10.0.13.0 4.4.4.4 1677 80000222 1541 0012 E2 10.0.13.0/24 0
10.0.15.0 4.4.4.4 163 80000223 b366 0012 E2 10.0.15.0/24 0
...long list...

[srajeswaran]

I believe this output is taken from the Fortigate acting as ABR (on which both areas are configured) and on ABR you are expected to see all the routes from connected networks/areas.

Can you connect to any other device/router in Area 0 and check if they can see the Area10 route?

As per the attached outputs, the area10 network is 10.30.16.0, you can see this route as "Net Link States (Area 0.0.0.10)" in both outputs (before and after applying the filter).

Before applying the filter the same route was shared with Area0 and same is visible under "Summary Link States (Area 0.0.0.0)" as below. But this summary route is removed after applying the filter.

Summary Link States (Area 0.0.0.0)

Link ID ADV Router Age Seq# CkSum Flag Route
10.30.16.0 2.2.2.2 377 8000001f 0607 0031 10.30.16.0/28

[sidp]

---

@srajeswaran wrote:

I believe this output is taken from the Fortigate acting as ABR (on which both areas are configured) and on ABR you are expected to see all the routes from connected networks/areas.

Can you connect to any other device/router in Area 0 and check if they can see the Area10 route?

---

Yes, that's exactly what i described and try to prevent. Fortigate is the ABR connected to a Cisco switch (cisco-sw1) in area 10 and a Cisco switch (cisco-sw2) in area 0.

On the Cisco switch cisco-sw2 in area 0 I can see all the routes from the cisco-sw1 from area 0 and that's what I try to prevent. Forti is distributing all routes from area 10 to area 0 and I somehow need to stop this behavior.

[Toshi_Esumi]

I think, if you want to filter out incoming routes from area 10, the filter-list should have
   set direction in

instead.

Toshi

[srajeswaran]

yes, if we are applying the filter under area0, the direction need to be "in". If we apply the filter under area10 as in this case, the direction need to be "out".

I think the filter is working as expected, I see the area10 subnet 10.30.16.0/28 is getting filtered.

[Toshi_Esumi]

The KB is saying opposite:

"Apply the filter-list either under area 0 with the 'out' direction or under area 1 with the 'in' direction.

Area 0:

# config router ospf

# config area

edit 0.0.0.1

# config filter-list

edit 1

set list "FILTER_AREA_1_NETWORKS"

set direction out          <--- Default direction value

next

end

next

end

end

Or Area 1:

# config router ospf

# config area

edit 0.0.0.0

# config filter-list

edit 1

set list "FILTER_AREA_1_NETWORKS"

set direction in

next

end

next

end

end"