OSPF and routing

[philip_nl]

Hello,

I have a question concerning OSPF with access-list and route-map.

It has to filter permit 192.168.0.0/16 and deny any.

When using an access-list, it works. When using a route-map it doesn't.

Here is part of the configuration:

FGT (ospf) # show
config router ospf
  set distribute-list-in "access-list-01"
  config area
  edit 0.0.0.0
  next
  edit 0.0.0.1
  next
end
config network
  edit 1
    set prefix 10.0.242.0 255.255.255.0
  next
  edit 2
    set prefix 10.99.12.0 255.255.255.0
    set area 0.0.0.1
  next
end
.......

FGT (ospf) # show
config router ospf
  set distribute-route-map-in "route-map-01"
  config area
  edit 0.0.0.0
  next
  edit 0.0.0.1
  next
end
config network
  edit 1
    set prefix 10.0.242.0 255.255.255.0
  next
  edit 2
    set prefix 10.99.12.0 255.255.255.0
    set area 0.0.0.1
  next
end
.......

FGT (access-list-01) # show
config router access-list
  edit "access-list-01"
  config rule
    edit 3
    set prefix 192.168.0.0 255.255.0.0
  next
  edit 5
    set action deny
    set prefix any
  next
  end
next
end

FGT (route-map) # show
config router route-map
  edit "route-map-01"
    config rule
      edit 1
        set match-ip-address "access-list-01"
        .......
     next
  end
next
end

What do I have to change to work it with route-maps?

Kind regards,

Philip

[dingjerry_FTNT]

Hi @philip_nl ,

Please check this article:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Inbound-route-filtering-in-OSPF-using-dist...

Note: The distribute-route-map-in feature to filter routes in OSPF, is useful only in case filter LSA type 5 (External) routes or matching the TAG value needs to be done.

You may also check this article:

https://community.fortinet.com/t5/FortiGate/Technical-Note-How-to-control-filter-OSPF-route-redistri...

[philip_nl]

Hello,

Thanks for the reply.

Only in case filter LSA type 5.

I will study the provided links.

Thanks,

Philip

[dingjerry_FTNT]

Hi @philip_nl ,

In general,

1) If you want to filter external routes, you can use distribute-route-map-in with route map;

2) Otherwise, you may have to use one of the following:

2.1) distribute-list-in with access list (using prefix)

or 

2.2) Using "set routemap" under "config redistribute"

[dingjerry_FTNT]

By the way, distribute-list-in is mainly for inbound route filtering, and "set route map" under "config redistribute" is mainly for outbound route filtering.

[philip_nl]

Thanks Jerry