Route map doesn't filter OSPF routes

[fortimaster]

Hi all¡

I have a simple scenario where 2 fortigates connect to area 0 using a Point to Point OSPF network and a /30 IPv4 network.

One distributes connected routes and the other receives them. I would like to filter some of those routes using a route map with an ACL but, when I apply it the routes are not filtered.

I have created 2 ACL, one used to filter one network and another used to permit all the rest of traffic. Finally, a route map with these 2 ACL.

config router access-list
edit "ACL_OSPF_DENY"
config rule
edit 1
set prefix 192.168.1.0 255.255.255.0
set exact-match enable
next
end
next
edit "ACL_OSPF_PERMITANY"
config rule
edit 1
set prefix any
set exact-match enable <-- comment, witouth this command it doesn't work either.

config router route-map
edit "RM-OSPF"
config rule
edit 1
set action deny
set match-ip-address "ACL_OSPF_DENY"
next
edit 2
set match-ip-address "ACL_OSPF_PERMITANY"

If I get the OSPF routes afther having applied the route map (using GUI), the 192.168.1.0 network still there. I have tryed several ways but the route map doesn't filter the route. Could you help me please? What I'm doing wrong?

Thanks¡¡

[Toshi_Esumi]

OSPF doesn't filter route within an area. You need to use BGP instead.
If you search "OSFP by definition doesn't filter specific routes within the area" at Google search, it would give you below AI answer:
This statement is correct; OSPF (Open Shortest Path First) does not inherently filter specific routes within an area because it operates as a link-state protocol, where all routers within an area must maintain the same Link-State Database (LSDB), meaning you cannot selectively filter routes within that area without affecting the consistency of the database across all devices.

Toshi

[Toshi_Esumi]

Or, if only two neighbors, you could filter those routes BEFORE redestributed into OSFP domain, like under "config redistribute connected", "config redistribute static", etc. depending on the source of the prefix.
You can use a route-map there.

Toshi

[fortimaster]

Thanks for your help Toshi ¡¡

It makes sense that as it is a common database you cannot filter routes, but I have tryed using a prefix-list and it works perfectly, not applyed at source.

config router prefix-list
edit "PREFIX"
config rule
edit 1
set action deny
set prefix 192.168.116.0 255.255.255.0
unset ge
unset le
next
edit 2
set prefix any
unset ge
unset le
next

config router ospf
set router-id 1.1.1.1
set distribute-list-in "PREFIX"

Curiously it works.

[Toshi_Esumi]

The "distibute-list-in" is a filter that is applied when OSPF routes go into RIB. It's NOT filtering when OSPF advertising to the neighbor. You're filtering routes on the receiving side. That's why it works. See the KB below:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-OSPF-distribute-list-in-example-...

You would see all routes in OSPF domain with "get router info ospf route".

Toshi

[Toshi_Esumi]

It maybe opposite. The KB's description is confusing. Which side did you apply this?

Toshi

[fortimaster]

Hi Toshi, I applyed it on the receiving firewall.

[dingjerry_FTNT]

Hi @fortimaster ,

As the KB explained:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-OSPF-distribute-list-in-example-...

It does not filter routes. It only controls routes injected into the routing table.

[Toshi_Esumi]

Ok, then my original interpretation was right. It's same as Cisco's OSPF configuration like below:
  router ospf 1
    router-id 10.0.0.2
    log-adjacency-changes
    network 172.16.2.1 0.0.0.255 area 0
    distribute-list route-map <route-map-name> in        [OSPF table -> RIB]

Toshi

[dingjerry_FTNT]

And as you tested, for OSPF, it's better to use a Prefix list instead of an Access list.