OSPF Outbound Filter - Doing it wrong?

[RumSpringaHQ]

So I feel quite silly that I can't get this working, I haven't done many filters but they were never on a fortigate so I apologize for any ignorance in this post.

So we have a fair bit of individual subnets hanging off of the 10.24.0.0/16 space. I specifically want to filter out every /27 that's hung under 10.24.x.x. So currently I have this as my OSPF and prefix list configuration.

config router prefix-list
    edit "Block_External-MGMT"
        config rule
            edit 1
                set action deny
                set prefix 10.43.0.0 255.255.0.0
                unset ge
                unset le
            next
        end
    next
end
config router ospf
    set router-id 10.10.30.1
    config area
        edit 6.6.6.6
            set type stub
            config filter-list
                edit 1
                    set list "Block_External-MGMT"
                    // using the default outbound since this is the origin of redistributed
                next
            end
        next
    end
    config redistribute "static"
        set status enable
        set routemap "static-to-ospf-filter"
        set metric-type 1
    end
end

The redistribution is a working filter list allowing 2 specific static routes be advertised to a separate area I did not list in this config.

To be specific I am trying to keep only the networks I've added into area 6 stay in area 6 and not be impacted by the redis going on at this specific firewall. The other sites on this area get a bunch of subnets redistributed from another area that's working with completely different firewall's.

[akristof]

Hello,

Thank you for your question. With OSPF route filtering is not so easy as it looks. With OSPF, route filtering can be applied only on ABR. So for example if FortiGate has interfaces in 2 areas, you can filter routes to be distributed from areaX to areaY. Based on your config, your device is only in one area, so filtering will not work. In that case only option is to block/allow routes via redistribution.

More info on filter-list:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-OSPF-to-filter-Inter-Area-rout...

Have a nice day.