Return to Question

Picture of topology for reference.

TampaRTR Config:

TampaRTR#show run | sec ospf
 redistribute ospf 1 metric 1000 100 250 100 1500
router ospf 1
 area 1 nssa
 redistribute eigrp 1 metric 20 metric-type 1 subnets route-map RMAPTAGEIGRP
 network 4.4.4.4 0.0.0.0 area 1
 network 10.101.100.0 0.0.0.255 area 1
TampaRTR#
TampaRTR#show route-map
route-map RMAPTAGEIGRP, permit, sequence 10
  Match clauses:
  Set clauses:
    tag 90
  Policy routing matches: 0 packets, 0 bytes
TampaRTR#

ChicagoRTR Config:

ChicagoRTR#show run | sec ospf
router ospf 1
 area 2 virtual-link 5.5.5.5
 network 3.3.3.3 0.0.0.0 area 0
 network 10.100.100.0 0.0.0.255 area 0
 network 10.102.100.0 0.0.0.255 area 2
 distribute-list route-map RMAPDENYEIGRP in
ChicagoRTR#
ChicagoRTR#show route-map
route-map RMAPDENYEIGRP, deny, sequence 10
  Match clauses:
     tag 90
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes
route-map RMAPDENYEIGRP, permit, sequence 20
  Match clauses:
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes
ChicagoRTR#

Denied in Chicago:

ChicagoRTR#show ip route 10.90.100.0
% Subnet not in table

Allowed in Dallas:

DallasRTR#show ip route 10.90.100.0
Routing entry for 10.90.100.0/24
  Known via "ospf 1", distance 110, metric 24
  Tag 90, type extern 1
  Last update from 10.102.100.254 on GigabitEthernet0/0, 00:02:11 ago
  Routing Descriptor Blocks:
  * 10.102.100.254, from 2.2.2.2, 00:02:11 ago, via GigabitEthernet0/0
      Route metric is 24, traffic share count is 1
      Route tag 90
DallasRTR#

Tampa Config:

TampaRTR#show running-config
Building configuration...

Current configuration : 3561 bytes
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname TampaRTR
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
ethernet lmi ce
!
!
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
no ip icmp rate-limit unreachable
!
!
!
!
!
!
ip name-server 8.8.8.8
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
redundancy
!
no cdp log mismatch duplex
!
ip tcp synwait-time 5
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 4.4.4.4 255.255.255.255
!
interface GigabitEthernet0/0
 description WAN
 ip address 10.101.100.253 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/1
 description WAN
 ip address 10.90.100.254 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/2
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/3
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
!
router eigrp 1
 network 4.4.4.4 0.0.0.0
 network 10.90.100.0 0.0.0.255
 redistribute ospf 1 metric 1000 100 250 100 1500
!
router ospf 1
 area 1 nssa
 redistribute eigrp 1 metric 20 metric-type 1 subnets route-map RMAPTAGEIGRP
 network 4.4.4.4 0.0.0.0 area 1
 network 10.101.100.0 0.0.0.255 area 1
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
!
route-map RMAPTAGEIGRP permit 10
 set tag 90
!
!
!
control-plane
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0 
 privilege level 15
 logging synchronous
line vty 0 4
 login
 transport input none
!
no scheduler allocate
!
end

TampaRTR#

NewYorkRTR Config

NewYorkRTR#show run
Building configuration...

Current configuration : 3348 bytes
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname NewYorkRTR
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
ethernet lmi ce
!
!
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
no ip icmp rate-limit unreachable
!
!
!
!
!
!
ip name-server 8.8.8.8
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
redundancy
!
no cdp log mismatch duplex
!
ip tcp synwait-time 5
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 2.2.2.2 255.255.255.255
!
interface GigabitEthernet0/0
 description WAN
 ip address 10.100.100.253 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/1
 ip address 10.101.100.254 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/2
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/3
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
router ospf 1
 area 1 nssa no-summary
 network 2.2.2.2 0.0.0.0 area 0
 network 10.100.100.0 0.0.0.255 area 0
 network 10.101.100.0 0.0.0.255 area 1
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
!
!
!
control-plane
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 login
 transport input none
!
no scheduler allocate
!
end

NewYorkRTR#

ChicagoRTR Config

ChicagoRTR#show run
Building configuration...

Current configuration : 3498 bytes
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ChicagoRTR
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
ethernet lmi ce
!
!
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
no ip icmp rate-limit unreachable
!
!
!
!
!
!
ip name-server 8.8.8.8
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
redundancy
!
no cdp log mismatch duplex
!
ip tcp synwait-time 5
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.255
!
interface GigabitEthernet0/0
 description WAN
 ip address 10.100.100.252 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/1
 description WAN
 ip address 10.102.100.254 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/2
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/3
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
router ospf 1
 area 2 virtual-link 5.5.5.5
 network 3.3.3.3 0.0.0.0 area 0
 network 10.100.100.0 0.0.0.255 area 0
 network 10.102.100.0 0.0.0.255 area 2
 distribute-list route-map RMAPDENYEIGRP in
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
!
route-map RMAPDENYEIGRP deny 10
 match tag 90
!
route-map RMAPDENYEIGRP permit 20
!
!
!
control-plane
!
line con 0
 exec-timeout 0 0 
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 login
 transport input none
!
no scheduler allocate
!
end

ChicagoRTR#

DallasRTR Config:

DallasRTR#show run
Building configuration...

Current configuration : 3353 bytes
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname DallasRTR
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
ethernet lmi ce
!
!
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
no ip icmp rate-limit unreachable
!
!
!
!
!
!
ip name-server 8.8.8.8
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
redundancy
!
no cdp log mismatch duplex
!
ip tcp synwait-time 5
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 5.5.5.5 255.255.255.255
!
interface GigabitEthernet0/0
 description WAN
 ip address 10.102.100.253 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/1
 ip address 10.134.100.254 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/2
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/3
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
router ospf 1
 area 2 virtual-link 3.3.3.3
 network 5.5.5.5 0.0.0.0 area 2
 network 10.102.100.0 0.0.0.255 area 2
 network 10.134.100.0 0.0.0.255 area 34
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
!
!
!
control-plane
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 login
 transport input none
!
no scheduler allocate
!
end

DallasRTR#

I'd like to filter a redistributed route from EIGRP into OSPF to all routers in AREA2 and AREA34. I have tagged the route 10.90.100.0/24 with tag 90 at the Tampa router where its redistributed into OSPF, on the Chicago router I used a distribute-list to deny the route tagged with 90. The route isn't present on the Chicago router, but Dallas and Arizona can still reach the redistributed EIGRP network. Ideally i'd like to deny it once on one of the upstream routers if possible.

I'd like to filter a redistributed route from EIGRP into OSPF to all routers in AREA2 and AREA34. I have tagged the route 10.90.100.0/24 with tag 90 at the Tampa router where its redistributed into OSPF, on the Chicago router I used a distribute-list to deny the route tagged with 90. The route isn't present on the Chicago router, but Dallas and Arizona can still reach the redistributed EIGRP network. Ideally i'd like to deny it once on one of the upstream routers if possible.

TampaRTR Config:

TampaRTR#show run | sec ospf
 redistribute ospf 1 metric 1000 100 250 100 1500
router ospf 1
 area 1 nssa
 redistribute eigrp 1 metric 20 metric-type 1 subnets route-map RMAPTAGEIGRP
 network 4.4.4.4 0.0.0.0 area 1
 network 10.101.100.0 0.0.0.255 area 1
TampaRTR#
TampaRTR#show route-map
route-map RMAPTAGEIGRP, permit, sequence 10
  Match clauses:
  Set clauses:
    tag 90
  Policy routing matches: 0 packets, 0 bytes
TampaRTR#

ChicagoRTR Config:

ChicagoRTR#show run | sec ospf
router ospf 1
 area 2 virtual-link 5.5.5.5
 network 3.3.3.3 0.0.0.0 area 0
 network 10.100.100.0 0.0.0.255 area 0
 network 10.102.100.0 0.0.0.255 area 2
 distribute-list route-map RMAPDENYEIGRP in
ChicagoRTR#
ChicagoRTR#show route-map
route-map RMAPDENYEIGRP, deny, sequence 10
  Match clauses:
     tag 90
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes
route-map RMAPDENYEIGRP, permit, sequence 20
  Match clauses:
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes
ChicagoRTR#

Denied in Chicago:

ChicagoRTR#show ip route 10.90.100.0
% Subnet not in table

Allowed in Dallas:

DallasRTR#show ip route 10.90.100.0
Routing entry for 10.90.100.0/24
  Known via "ospf 1", distance 110, metric 24
  Tag 90, type extern 1
  Last update from 10.102.100.254 on GigabitEthernet0/0, 00:02:11 ago
  Routing Descriptor Blocks:
  * 10.102.100.254, from 2.2.2.2, 00:02:11 ago, via GigabitEthernet0/0
      Route metric is 24, traffic share count is 1
      Route tag 90
DallasRTR#