OSPF redistributed routes filtering

[Dmitriy_V]

Hello, we have next type of configuration.

A Fortigate device with two static routes, say Static_1 and Static_2 and OSPF configuration. This two routes are redistributed into OSPF process. Also we have two different vpn tunnels to our partners. These two tunnels are in different areas, say area 15 and 16.
For now both redistributed routes are sent to both our partners through OSPF process.
But we need to make some filtering, say Staic_1 send to Parner_1 only and Static_2 send to Partner_2 only.

How could we accomplish this?

[Elmir]

You can create a route map to accomplish this issue.

[fricci_FTNT]

Hi @Dmitriy_V ,

You may find the following article useful:
https://community.fortinet.com/t5/FortiGate/Technical-Note-How-to-control-filter-OSPF-route-redistri...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-OSPF-static-routes-redistribution-example/...

Best regards,

[Dmitriy_V]

Thanks for your answer. Surely I know about route-maps and I already read this article and even checked this in real environment. 

But my case is quite different. We need to send only specific redistributed routes to specific areas, which are created with our partners.

Say we redistributed both static routes Static_1 and Static_2, but we need to send Static_1 to our Partner_1 in area 15 and Static_2  to our Partner_2 in area 16.

So we need such kind of granularity and filter not only by prefix but maybe by area or interface.

[fricci_FTNT]

Hi @Dmitriy_V ,

Thank you for clarifying. With routemaps you can configure specific prefix list that match a FGT interface and the next-hop routers IPs  (i.e.: your specific area neighbor's routers IPs). I have never tested it in lab and I would need a bit of spare time to build a lab to test it:

config router route-map
 edit "OSPF_routemap"
  config rule
   edit 1
    set match-interface "port2"
    set match-ip-address "ospf_prefix-list"
    set match-ip-nexthop "ospf-area-15-routers"
  next

 end
end

Alternatively you could try with filter-lists that, if my understanding is correct, should provide you a way to achieve what you need:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-OSPF-to-filter-Inter-Area-rout...

Best regards,

[Dmitriy_V]

Many thanks, I will try it in my lab first.