I found the following article about ospf inter-area distribution.
OSPF and Fortigate are fairly new to me... I am planning to replace a Cisco Firepower with a Fortigate.
Currently on the Cisco firepower there are two opsf processes configured. One has area id 0 and the other has area-id 10 and both are connected to two different cisco switches. Because of the two ospf processes the areas are separated which means cisco-sw2 doesn't receive any routes from area 10. Since Fortigate doesn't support more than one ospf process I have to find another solution.
cisco-sw1---area-id 10---Fortigate(Cisco FTD)---area-id 0---cisco-sw2
How can I prevent Fortigate from distributing learned routes from area 10 to 0 (sw2)?
Current Fortigate config:
fortigate # show router ospf
config router ospf
set router-id 2.2.2.2
config area
edit 0.0.0.0
next
edit 0.0.0.10
set type stub
next
end
config ospf-interface
edit "clientvpn"
set interface "port2.505"
set dead-interval 40
set hello-interval 10
next
edit "dmvpn"
set interface "port2.503"
set dead-interval 40
set hello-interval 10
next
edit "inside"
set interface "inside"
set dead-interval 40
set hello-interval 10
next
edit "transit"
set interface "port2.506"
set dead-interval 40
set hello-interval 10
next
end
config network
edit 1
set prefix 10.30.15.0 255.255.255.240
next
edit 2
set prefix 10.30.13.0 255.255.255.240
next
edit 3
set prefix 10.30.14.0 255.255.255.240
next
edit 4
set prefix 10.30.16.0 255.255.255.240
set area 0.0.0.10
next
end
config redistribute "connected"
end
config redistribute "static"
end
config redistribute "rip"
end
config redistribute "bgp"
end
config redistribute "isis"
end
end
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Thanks for testing that. I just verified this in LAB and I am able to restrict the external routes entering area0 by making the area10 nssa and then apply the route filter we configured earlier.
1. Configure Area10 as NSSA on both Fortigate and Switch
2. Configure route filter as below
config router prefix-list
edit "FILTER_AREA_10_NETWORKS"
config rule
edit 1
set action deny
set prefix any
next
end
next
end
3. Apply this filter under Area10 as "Out" direction (default direction)
edit 0.0.0.10
set type nssa
config filter-list
edit 1
set list "FILTER_AREA_10_NETWORKS"
next
end
next
If you are looking to block all the routes from area 10, then we don't have to use any filters, we may try the below as suggested in the article shared by you.
Apply this on Area10 out direction.
Hi Suraj,
I tried it but nothing changes and rechecked the configuration.
"set direction out" doesn't appear in the show config but maybe this is just because it is the default value. I also tested it with set direction in which appeared in the config but again nothing changed...
Regards,
Patrick
Can you share the output of "get router info ospf database brief"
with filter:
fortigate # get router info ospf database brief
OSPF Router with ID (2.2.2.2) (Process ID 0, VRF 0)
Router Link States (Area 0.0.0.0)
Link ID ADV Router Age Seq# CkSum Flag Link count
1.1.1.1 1.1.1.1 1849 80000616 7c16 0012 1
2.2.2.2 2.2.2.2 1372 80000726 c7cc 0031 3
3.3.3.1 3.3.3.1 1191 8000076e 8f95 0012 1
3.3.3.3 3.3.3.3 1221 80000771 9584 0012 1
Net Link States (Area 0.0.0.0)
Link ID ADV Router Age Seq# CkSum Flag
10.30.13.12 3.3.3.1 1191 80000658 f895 0012
10.30.14.1 2.2.2.2 72 80000141 4d8f 0031
10.30.15.12 3.3.3.3 1221 80000659 e89e 0012
ASBR-Summary Link States (Area 0.0.0.0)
Link ID ADV Router Age Seq# CkSum Flag
4.4.4.4 2.2.2.2 1632 8000001f 36ee 0031
Router Link States (Area 0.0.0.10)
Link ID ADV Router Age Seq# CkSum Flag Link count
2.2.2.2 2.2.2.2 179 80000026 f8a4 0031 1
4.4.4.4 4.4.4.4 1983 8000022f 2034 0012 1
Net Link States (Area 0.0.0.10)
Link ID ADV Router Age Seq# CkSum Flag
10.30.16.14 4.4.4.4 471 8000001c 5a65 0012
Summary Link States (Area 0.0.0.10)
Link ID ADV Router Age Seq# CkSum Flag Route
10.30.13.0 2.2.2.2 762 8000001f 27e8 0031 10.30.13.0/28
10.30.14.0 2.2.2.2 72 8000001f 1cf2 0031 10.30.14.0/28
10.30.15.0 2.2.2.2 202 8000001f 11fc 0031 10.30.15.0/28
ASBR-Summary Link States (Area 0.0.0.10)
Link ID ADV Router Age Seq# CkSum Flag
1.1.1.1 2.2.2.2 292 80000023 b874 0031
3.3.3.1 2.2.2.2 1722 80000022 72b5 0031
3.3.3.3 2.2.2.2 442 80000023 5cc8 0031
AS External Link States
Link ID ADV Router Age Seq# CkSum Flag Route Tag
10.0.9.0 4.4.4.4 1983 80000222 4119 0012 E2 10.0.9.0/24 0
10.0.10.0 4.4.4.4 471 80000223 e53a 0012 E2 10.0.10.0/23 0
10.0.12.0 4.4.4.4 1982 80000222 2037 0012 E2 10.0.12.0/24 0
10.0.13.0 4.4.4.4 1982 80000222 1541 0012 E2 10.0.13.0/24 0
10.0.15.0 4.4.4.4 468 80000223 b366 0012 E2 10.0.15.0/24 0
...long list...
without filter:
fortigate # get router info ospf database brief
OSPF Router with ID (2.2.2.2) (Process ID 0, VRF 0)
Router Link States (Area 0.0.0.0)
Link ID ADV Router Age Seq# CkSum Flag Link count
1.1.1.1 1.1.1.1 1543 80000616 7c16 0012 1
2.2.2.2 2.2.2.2 1067 80000726 c7cc 0031 3
3.3.3.1 3.3.3.1 886 8000076e 8f95 0012 1
3.3.3.3 3.3.3.3 916 80000771 9584 0012 1
Net Link States (Area 0.0.0.0)
Link ID ADV Router Age Seq# CkSum Flag
10.30.13.12 3.3.3.1 886 80000658 f895 0012
10.30.14.1 2.2.2.2 1527 80000140 4f8e 0031
10.30.15.12 3.3.3.3 916 80000659 e89e 0012
Summary Link States (Area 0.0.0.0)
Link ID ADV Router Age Seq# CkSum Flag Route
10.30.16.0 2.2.2.2 377 8000001f 0607 0031 10.30.16.0/28
ASBR-Summary Link States (Area 0.0.0.0)
Link ID ADV Router Age Seq# CkSum Flag
4.4.4.4 2.2.2.2 1327 8000001f 36ee 0031
Router Link States (Area 0.0.0.10)
Link ID ADV Router Age Seq# CkSum Flag Link count
2.2.2.2 2.2.2.2 1747 80000023 fea1 0031 1
4.4.4.4 4.4.4.4 1678 8000022f 2034 0012 1
Net Link States (Area 0.0.0.10)
Link ID ADV Router Age Seq# CkSum Flag
10.30.16.14 4.4.4.4 165 8000001c 5a65 0012
Summary Link States (Area 0.0.0.10)
Link ID ADV Router Age Seq# CkSum Flag Route
10.30.13.0 2.2.2.2 457 8000001f 27e8 0031 10.30.13.0/28
10.30.14.0 2.2.2.2 1507 8000001e 1ef1 0031 10.30.14.0/28
10.30.15.0 2.2.2.2 1707 8000001e 13fb 0031 10.30.15.0/28
ASBR-Summary Link States (Area 0.0.0.10)
Link ID ADV Router Age Seq# CkSum Flag
1.1.1.1 2.2.2.2 1797 80000022 ba73 0031
3.3.3.1 2.2.2.2 1417 80000022 72b5 0031
3.3.3.3 2.2.2.2 137 80000023 5cc8 0031
AS External Link States
Link ID ADV Router Age Seq# CkSum Flag Route Tag
10.0.9.0 4.4.4.4 1678 80000222 4119 0012 E2 10.0.9.0/24 0
10.0.10.0 4.4.4.4 165 80000223 e53a 0012 E2 10.0.10.0/23 0
10.0.12.0 4.4.4.4 1677 80000222 2037 0012 E2 10.0.12.0/24 0
10.0.13.0 4.4.4.4 1677 80000222 1541 0012 E2 10.0.13.0/24 0
10.0.15.0 4.4.4.4 163 80000223 b366 0012 E2 10.0.15.0/24 0
...long list...
Created on 01-22-2023 12:44 AM Edited on 01-22-2023 01:11 AM
I believe this output is taken from the Fortigate acting as ABR (on which both areas are configured) and on ABR you are expected to see all the routes from connected networks/areas.
Can you connect to any other device/router in Area 0 and check if they can see the Area10 route?
As per the attached outputs, the area10 network is 10.30.16.0, you can see this route as "Net Link States (Area 0.0.0.10)" in both outputs (before and after applying the filter).
Before applying the filter the same route was shared with Area0 and same is visible under "Summary Link States (Area 0.0.0.0)" as below. But this summary route is removed after applying the filter.
Summary Link States (Area 0.0.0.0)
Link ID ADV Router Age Seq# CkSum Flag Route
10.30.16.0 2.2.2.2 377 8000001f 0607 0031 10.30.16.0/28
@srajeswaran wrote:I believe this output is taken from the Fortigate acting as ABR (on which both areas are configured) and on ABR you are expected to see all the routes from connected networks/areas.
Can you connect to any other device/router in Area 0 and check if they can see the Area10 route?
Yes, that's exactly what i described and try to prevent. Fortigate is the ABR connected to a Cisco switch (cisco-sw1) in area 10 and a Cisco switch (cisco-sw2) in area 0.
On the Cisco switch cisco-sw2 in area 0 I can see all the routes from the cisco-sw1 from area 0 and that's what I try to prevent. Forti is distributing all routes from area 10 to area 0 and I somehow need to stop this behavior.
I think, if you want to filter out incoming routes from area 10, the filter-list should have
set direction in
instead.
Toshi
yes, if we are applying the filter under area0, the direction need to be "in". If we apply the filter under area10 as in this case, the direction need to be "out".
I think the filter is working as expected, I see the area10 subnet 10.30.16.0/28 is getting filtered.
The KB is saying opposite:
"Apply the filter-list either under area 0 with the 'out' direction or under area 1 with the 'in' direction.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1647 | |
1070 | |
751 | |
443 | |
214 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.