Fortigate OSPF stop inter-area distribution

[sidp]

I found the following article about ospf inter-area distribution.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-OSPF-to-filter-Inter-Area-rout...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuration-of-OSPF-Stub-Totally-Stub-NS...

OSPF and Fortigate are fairly new to me... I am planning to replace a Cisco Firepower with a Fortigate.

Currently on the Cisco firepower there are two opsf processes configured. One has area id 0 and the other has area-id 10 and both are connected to two different cisco switches. Because of the two ospf processes the areas are separated which means cisco-sw2 doesn't receive any routes from area 10. Since Fortigate doesn't support more than one ospf process I have to find another solution.

cisco-sw1---area-id 10---Fortigate(Cisco FTD)---area-id 0---cisco-sw2

How can I prevent Fortigate from distributing learned routes from area 10 to 0 (sw2)?

Current Fortigate config:

fortigate # show router ospf 
config router ospf
set router-id 2.2.2.2
config area
edit 0.0.0.0
next
edit 0.0.0.10
set type stub
next
end
config ospf-interface
edit "clientvpn"
set interface "port2.505"
set dead-interval 40
set hello-interval 10
next
edit "dmvpn"
set interface "port2.503"
set dead-interval 40
set hello-interval 10
next
edit "inside"
set interface "inside"
set dead-interval 40
set hello-interval 10
next
edit "transit"
set interface "port2.506"
set dead-interval 40
set hello-interval 10
next
end
config network
edit 1
set prefix 10.30.15.0 255.255.255.240
next
edit 2
set prefix 10.30.13.0 255.255.255.240
next
edit 3
set prefix 10.30.14.0 255.255.255.240
next
edit 4
set prefix 10.30.16.0 255.255.255.240
set area 0.0.0.10
next
end
config redistribute "connected"
end
config redistribute "static"
end
config redistribute "rip"
end
config redistribute "bgp"
end
config redistribute "isis"
end
end

[srajeswaran]

Please ignore the previous comment, i am not finding an option to delete it.

[srajeswaran]

These are are not filtered as they are External type routes. The best way to eliminate these would be to configure Area10 as stub.

Can you reconfigure the area10 as stub on Fortigate and Switch and share a new lsdb to check?

I tested this in my setup and making the area stub is stopping the external routes flooded to area0.

[sidp]

Hi Suraj

Sorry for my late respond.

As soon as I configure area 10 as stub on fortigate and switch I get no more routes even on the fortigate... and there I need them.

Regards,

Patrick

[srajeswaran · Accepted solution]

Thanks for testing that. I just verified this in LAB and I am able to restrict the external routes entering area0 by making the area10 nssa and then apply the route filter we configured earlier.

1. Configure Area10 as NSSA on both Fortigate and Switch

2. Configure route filter as below

config router prefix-list
edit "FILTER_AREA_10_NETWORKS"
config rule
edit 1
set action deny
set prefix any
next
end
next
end

3. Apply this filter under Area10 as "Out" direction (default direction)

edit 0.0.0.10
set type nssa
config filter-list
edit 1
set list "FILTER_AREA_10_NETWORKS"
next
end
next

[sidp]

Hi Suraj

Configuring area 10 on both devices as nssa and adding the filter list did the trick. Thank you very much!

Regards,

Patrick

[srajeswaran]

Thats great to hear :)