bgp routing | just allow ospf redistribution to one single bgp neighbor and not connected and static

[JoergB]

Dear colleagues,

I am looking for an article or advice on how to redistribute only OSPF routes to a single BGP neighbor, without including connected or static routes.

We are using a FortiGate device where all routes—connected, static, and OSPF—are currently being redistributed to all BGP neighbors, which is the intended behavior. No filters are in place, as all routes should be advertised.

However, we have recently added another BGP neighbor where we want to redistribute only OSPF routes. I have not been able to find a clear way to achieve this.

I know it is possible to add a filter, but it seems that I would need to manually include all OSPF networks, which I would prefer to avoid for future scalability and maintenance.

Has anyone encountered a similar requirement and could point me in the right direction?

Many thanks in advanced and best regards,
Joerg

[Toshi_Esumi]

I never needed to do that before. But since you still need to have all routes at other BGP neighbors, only way you can filter out other routes for that particular BGP neighbor is to have a special tag in BGP for those OSPF advertised prefixes, then filter them IN while filter all others OUT for the route-map-out for the neighbor using the tag.

Since OSFP redestribution statement takes a route-map (inbound), you should be able to add a community (say community:1) as the tag for the OSFP routes. Then you can filter out all other prefixes that don't have community:1  when you advertise them to the BGP neighbor with route-map-out.

Just a theory but I don't see any reason not to work.

Toshi 

[Toshi_Esumi]

By the way the community is a transitive metric in BGP domain. So the BGP neighbor (regardless it's another FGT or other vendor routers) who receives those routes advertised from the local FGT would see the community:1 as well in case that router needs to do more filtering or re-advertisement.

Toshi

[JoergB]

Hello Toshi,

many thanks for your advice which I will check and report back the result.
But it will need some days as I need to work togehter with the network team to verify.
I will keep you posted.

Joerg