Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
sidp
New Contributor III

Fortigate OSPF stop inter-area distribution

I found the following article about ospf inter-area distribution.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-OSPF-to-filter-Inter-Area-rout...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuration-of-OSPF-Stub-Totally-Stub-NS...

 

OSPF and Fortigate are fairly new to me... I am planning to replace a Cisco Firepower with a Fortigate.

 

Currently on the Cisco firepower there are two opsf processes configured. One has area id 0 and the other has area-id 10 and both are connected to two different cisco switches. Because of the two ospf processes the areas are separated which means cisco-sw2 doesn't receive any routes from area 10. Since Fortigate doesn't support more than one ospf process I have to find another solution.

 

cisco-sw1---area-id 10---Fortigate(Cisco FTD)---area-id 0---cisco-sw2

 

How can I prevent Fortigate from distributing learned routes from area 10 to 0 (sw2)?

 

Current Fortigate config:

fortigate # show router ospf 
config router ospf
set router-id 2.2.2.2
config area
edit 0.0.0.0
next
edit 0.0.0.10
set type stub
next
end
config ospf-interface
edit "clientvpn"
set interface "port2.505"
set dead-interval 40
set hello-interval 10
next
edit "dmvpn"
set interface "port2.503"
set dead-interval 40
set hello-interval 10
next
edit "inside"
set interface "inside"
set dead-interval 40
set hello-interval 10
next
edit "transit"
set interface "port2.506"
set dead-interval 40
set hello-interval 10
next
end
config network
edit 1
set prefix 10.30.15.0 255.255.255.240
next
edit 2
set prefix 10.30.13.0 255.255.255.240
next
edit 3
set prefix 10.30.14.0 255.255.255.240
next
edit 4
set prefix 10.30.16.0 255.255.255.240
set area 0.0.0.10
next
end
config redistribute "connected"
end
config redistribute "static"
end
config redistribute "rip"
end
config redistribute "bgp"
end
config redistribute "isis"
end
end

 

1 Solution
srajeswaran

Thanks for testing that. I just verified this in LAB and I am able to restrict the external routes entering area0 by making the area10 nssa and then apply the route filter we configured earlier.

 

1. Configure Area10 as NSSA on both Fortigate and Switch

2. Configure route filter as below

config router prefix-list
edit "FILTER_AREA_10_NETWORKS"
config rule
edit 1
set action deny
set prefix any
next
end
next
end

 

3. Apply this filter under Area10 as "Out" direction (default direction)

edit 0.0.0.10
set type nssa
config filter-list
edit 1
set list "FILTER_AREA_10_NETWORKS"
next
end
next

 

 

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

View solution in original post

25 REPLIES 25
srajeswaran

Please ignore the previous comment, i am not finding an option to delete it.

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

srajeswaran

These are are not filtered as they are External type routes. The best way to eliminate these would be to configure Area10 as stub.

Can you reconfigure the area10 as stub on Fortigate and Switch and share a new lsdb to check?

I tested this in my setup and making the area stub is stopping the external routes flooded to area0.

 

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

sidp
New Contributor III

Hi Suraj

 

Sorry for my late respond.

As soon as I configure area 10 as stub on fortigate and switch I get no more routes even on the fortigate... and there I need them.

 

Regards,

Patrick

srajeswaran

Thanks for testing that. I just verified this in LAB and I am able to restrict the external routes entering area0 by making the area10 nssa and then apply the route filter we configured earlier.

 

1. Configure Area10 as NSSA on both Fortigate and Switch

2. Configure route filter as below

config router prefix-list
edit "FILTER_AREA_10_NETWORKS"
config rule
edit 1
set action deny
set prefix any
next
end
next
end

 

3. Apply this filter under Area10 as "Out" direction (default direction)

edit 0.0.0.10
set type nssa
config filter-list
edit 1
set list "FILTER_AREA_10_NETWORKS"
next
end
next

 

 

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

sidp
New Contributor III

Hi Suraj

 

Configuring area 10 on both devices as nssa and adding the filter list did the trick. Thank you very much!

 

Regards,

Patrick

srajeswaran

Thats great to hear :)

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

Top Kudoed Authors