Filter tagged route to downstream routers

Question

I'd like to filter a redistributed route from EIGRP into OSPF to all routers in AREA2 and AREA34. I have tagged the route 10.90.100.0/24 with tag 90 at the Tampa router where its redistributed into OSPF, on the Chicago router I used a distribute-list to deny the route tagged with 90. The route isn't present on the Chicago router, but Dallas and Arizona can still reach the redistributed EIGRP network. Ideally i'd like to deny it once on one of the upstream routers if possible.

Tampa Config:

TampaRTR#show running-config
Building configuration...

Current configuration : 3561 bytes
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname TampaRTR
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
ethernet lmi ce
!
!
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
no ip icmp rate-limit unreachable
!
!
!
!
!
!
ip name-server 8.8.8.8
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
redundancy
!
no cdp log mismatch duplex
!
ip tcp synwait-time 5
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 4.4.4.4 255.255.255.255
!
interface GigabitEthernet0/0
 description WAN
 ip address 10.101.100.253 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/1
 description WAN
 ip address 10.90.100.254 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/2
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/3
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
!
router eigrp 1
 network 4.4.4.4 0.0.0.0
 network 10.90.100.0 0.0.0.255
 redistribute ospf 1 metric 1000 100 250 100 1500
!
router ospf 1
 area 1 nssa
 redistribute eigrp 1 metric 20 metric-type 1 subnets route-map RMAPTAGEIGRP
 network 4.4.4.4 0.0.0.0 area 1
 network 10.101.100.0 0.0.0.255 area 1
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
!
route-map RMAPTAGEIGRP permit 10
 set tag 90
!
!
!
control-plane
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 login
 transport input none
!
no scheduler allocate
!
end

TampaRTR#

NewYorkRTR Config

NewYorkRTR#show run
Building configuration...

Current configuration : 3348 bytes
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname NewYorkRTR
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
ethernet lmi ce
!
!
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
no ip icmp rate-limit unreachable
!
!
!
!
!
!
ip name-server 8.8.8.8
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
redundancy
!
no cdp log mismatch duplex
!
ip tcp synwait-time 5
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 2.2.2.2 255.255.255.255
!
interface GigabitEthernet0/0
 description WAN
 ip address 10.100.100.253 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/1
 ip address 10.101.100.254 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/2
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/3
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
router ospf 1
 area 1 nssa no-summary
 network 2.2.2.2 0.0.0.0 area 0
 network 10.100.100.0 0.0.0.255 area 0
 network 10.101.100.0 0.0.0.255 area 1
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
!
!
!
control-plane
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 login
 transport input none
!
no scheduler allocate
!
end

NewYorkRTR#

ChicagoRTR Config

ChicagoRTR#show run
Building configuration...

Current configuration : 3498 bytes
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ChicagoRTR
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
ethernet lmi ce
!
!
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
no ip icmp rate-limit unreachable
!
!
!
!
!
!
ip name-server 8.8.8.8
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
redundancy
!
no cdp log mismatch duplex
!
ip tcp synwait-time 5
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.255
!
interface GigabitEthernet0/0
 description WAN
 ip address 10.100.100.252 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/1
 description WAN
 ip address 10.102.100.254 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/2
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/3
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
router ospf 1
 area 2 virtual-link 5.5.5.5
 network 3.3.3.3 0.0.0.0 area 0
 network 10.100.100.0 0.0.0.255 area 0
 network 10.102.100.0 0.0.0.255 area 2
 distribute-list route-map RMAPDENYEIGRP in
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
!
route-map RMAPDENYEIGRP deny 10
 match tag 90
!
route-map RMAPDENYEIGRP permit 20
!
!
!
control-plane
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 login
 transport input none
!
no scheduler allocate
!
end

ChicagoRTR#

DallasRTR Config:

DallasRTR#show run
Building configuration...

Current configuration : 3353 bytes
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname DallasRTR
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
ethernet lmi ce
!
!
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
no ip icmp rate-limit unreachable
!
!
!
!
!
!
ip name-server 8.8.8.8
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
redundancy
!
no cdp log mismatch duplex
!
ip tcp synwait-time 5
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 5.5.5.5 255.255.255.255
!
interface GigabitEthernet0/0
 description WAN
 ip address 10.102.100.253 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/1
 ip address 10.134.100.254 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/2
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
interface GigabitEthernet0/3
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
!
router ospf 1
 area 2 virtual-link 3.3.3.3
 network 5.5.5.5 0.0.0.0 area 2
 network 10.102.100.0 0.0.0.255 area 2
 network 10.134.100.0 0.0.0.255 area 34
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
!
!
!
control-plane
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 login
 transport input none
!
no scheduler allocate
!
end

DallasRTR#

Picture of topology for reference.

Answer 1

You are correct to attempt your filtering on a ABR

router ospf 1
 ...
 distribute-list route-map RMAPDENYEIGRP in

The distribute-list command above does not stop the propagation of OSPF LSA's in your network. It only prevents the installation of the routes in the route table. If you look at your OSPF database, you will see that the LSAs are still there and sent on to other routers (which then set up their route tables using the LSAs).

OSPF is not like BGP. In BGP only routes installed in the routing table are considered for propogation. In OSPF the LSAs are propagated unless themselves filtered at the ABRs.

It is possible to filter OSPF routes at ABR's with a prefix list, and using the filter-list command, but that does not filter based on OSPF tags.

Here's my example where I block a specific /32 from being propagated between areas on a ABR.

ip prefix-list bob deny 172.16.7.1/32
ip prefix-list bob permit 0.0.0.0/0 le 32
router ospf 1
 ...
 area 0 filter-list prefix bob out

A good discussion at https://www.cisco.com/c/dam/en_us/training-events/le31/le46/cln/promo/share_the_wealth_contest/finalists/Susan_Mansfield_FILTERING_WITH_OSPF_-_Technical_Overview.pdf

But here's a Cisco link with a bad discussion. It shows how to filter OSPF with route maps, but does not tell you that its only filtering route installation, not propagation of LSA's: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_ospf/configuration/xe-16-6/iro-xe-16-6-book/iro-inbound.html

I demonstrated the problems with OSPF distribute lists and using a prefix-list filter in my old "Cisco Hands on Training Video Podcast".

OSPF Distribute List problems (14 minutes): https://www.youtube.com/watch?v=SQ2jGzm4cNM

OSPF route filtering and area border routers (16 minutes): https://www.youtube.com/watch?v=Doa9Ns57PXA

Sadly, the routers I was using at the time did not support using a route-map to filter LSAs into or out of an area. Just into or out of the route table. I do not think that has changed.