I found the following article about ospf inter-area distribution.
OSPF and Fortigate are fairly new to me... I am planning to replace a Cisco Firepower with a Fortigate.
Currently on the Cisco firepower there are two opsf processes configured. One has area id 0 and the other has area-id 10 and both are connected to two different cisco switches. Because of the two ospf processes the areas are separated which means cisco-sw2 doesn't receive any routes from area 10. Since Fortigate doesn't support more than one ospf process I have to find another solution.
cisco-sw1---area-id 10---Fortigate(Cisco FTD)---area-id 0---cisco-sw2
How can I prevent Fortigate from distributing learned routes from area 10 to 0 (sw2)?
Current Fortigate config:
fortigate # show router ospf
config router ospf
set router-id 2.2.2.2
config area
edit 0.0.0.0
next
edit 0.0.0.10
set type stub
next
end
config ospf-interface
edit "clientvpn"
set interface "port2.505"
set dead-interval 40
set hello-interval 10
next
edit "dmvpn"
set interface "port2.503"
set dead-interval 40
set hello-interval 10
next
edit "inside"
set interface "inside"
set dead-interval 40
set hello-interval 10
next
edit "transit"
set interface "port2.506"
set dead-interval 40
set hello-interval 10
next
end
config network
edit 1
set prefix 10.30.15.0 255.255.255.240
next
edit 2
set prefix 10.30.13.0 255.255.255.240
next
edit 3
set prefix 10.30.14.0 255.255.255.240
next
edit 4
set prefix 10.30.16.0 255.255.255.240
set area 0.0.0.10
next
end
config redistribute "connected"
end
config redistribute "static"
end
config redistribute "rip"
end
config redistribute "bgp"
end
config redistribute "isis"
end
end
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Thanks for testing that. I just verified this in LAB and I am able to restrict the external routes entering area0 by making the area10 nssa and then apply the route filter we configured earlier.
1. Configure Area10 as NSSA on both Fortigate and Switch
2. Configure route filter as below
config router prefix-list
edit "FILTER_AREA_10_NETWORKS"
config rule
edit 1
set action deny
set prefix any
next
end
next
end
3. Apply this filter under Area10 as "Out" direction (default direction)
edit 0.0.0.10
set type nssa
config filter-list
edit 1
set list "FILTER_AREA_10_NETWORKS"
next
end
next
Created on 01-26-2023 12:34 AM Edited on 01-26-2023 12:37 AM
Please ignore the previous comment, i am not finding an option to delete it.
These are are not filtered as they are External type routes. The best way to eliminate these would be to configure Area10 as stub.
Can you reconfigure the area10 as stub on Fortigate and Switch and share a new lsdb to check?
I tested this in my setup and making the area stub is stopping the external routes flooded to area0.
Hi Suraj
Sorry for my late respond.
As soon as I configure area 10 as stub on fortigate and switch I get no more routes even on the fortigate... and there I need them.
Regards,
Patrick
Thanks for testing that. I just verified this in LAB and I am able to restrict the external routes entering area0 by making the area10 nssa and then apply the route filter we configured earlier.
1. Configure Area10 as NSSA on both Fortigate and Switch
2. Configure route filter as below
config router prefix-list
edit "FILTER_AREA_10_NETWORKS"
config rule
edit 1
set action deny
set prefix any
next
end
next
end
3. Apply this filter under Area10 as "Out" direction (default direction)
edit 0.0.0.10
set type nssa
config filter-list
edit 1
set list "FILTER_AREA_10_NETWORKS"
next
end
next
Hi Suraj
Configuring area 10 on both devices as nssa and adding the filter list did the trick. Thank you very much!
Regards,
Patrick
Thats great to hear :)
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.