1

I have a fairly complicated scenario that I've managed to duplicate with GNS3. Please see the attached image. In this scenario I have four "Branch Offices" each with their own router connected to each other with a /30 network between them. Each branch office has a simple layer 2 dumb switch with two hosts.

NetworkA and NetworkB are in OSPF area 0. While NetworkC and NetworkD are in area 1 with NetworkD connecting both areas.

OSPF adjacencies are formed between:

  • NetworkA and NetworkB
  • NetworkB and NetworkD
  • NetworkD and NetworkC
  • An OSPF adjacency is NOT formed between NetworkA and NetworkC.

For the sake of this question we're going to pretend that we're not allowed to form an OSPF adjacency between NetworkA and NetworkC. We're also going to pretend that we actually don't know what IPs are found behind NetworkA; even though the picture shows that the 192.168.1.16/29 subnet is there. For this reason we've set the gateway of last resort on NetworkC to point toward NetworkA.

So right now, NetworkA is advertising it's networks to NetworkB, which in turn is advertising it's networks to NetworkD and then finally they're being advertised to NetworkC. If a host on NetworkC (PC-3) attempts to ping a host on NetworkA (PC-2) then the packet goes all the way around to NetworkD, then to NetworkB, and then finally through NetworkA. Rather than taking the path directly between NetworkC and NetworkA. This is because there are OSPF routes in NetworkC's routing table telling it to forward them through NetworkD.

I'd like to find a way for traffic destined to NetworkA from NetworkC to go through the gateway of last resort. I believe what I need to do is setup a way for NetworkC to suppress any OSPF routes that it receives for NetworkA and rely entirely on it's gateway of last resort to access anything behind NetworkA.

I can make this work by simply adding static routes on both NetworkA and NetworkC but for this question we're pretending that we don't know what IPs are behind NetworkA (despite them being displayed in the diagram). For that reason I can't use a static route on NetworkCRouter to the 192.168.1.16/29 network and vice versa on NetworkARouter to 192.168.1.24/29 network.

I've been looking at OSPF Inbound Filtering by using a route-map with a distribution list to match on specific routes and deny them from being added to the routing table. But I can't figure out how to implement it correctly. Is this something you would do? Or I believe an alternative is to divide them up by using separate OSPF process ids. But I'm not sure how to get that to work either.

enter image description here

Improve this question
0

2 Answers 2

Reset to default
2

You cannot have a default route (0.0.0.0/0) be a preferred route. The route with the longest match in a routing table is always the one chosen to which a router will forward traffic. Any route with a mask length longer than 0 (any route other than a default route) that matches the destination will be chosen before the default route.

It would be possible using PBR (Policy-Based Routing) to construct a policy to send traffic to Router A, but you would again need to know the network(s) behind Router A to create the policy.

If you block Router C from learning the route from Router D, then you would lose any path to the network(s) behind Router A if the link from Router C to Router A fails (see below*), but you would need to know which route(s) to block, or you could block advertising the route(s) to Router C on Router D.

*Also, don't forget about AD (Administrative Distance). For Cisco devices, the AD of OSPF is 110, but the AD for a statically defined route is only 1. That means that the statically defined route is preferred (AD is like golf, the lower score wins).

Simply placing a static route for the 192.168.1.16/29 network pointing to 192.168.1.10 in Router C will cause Router C to send any traffic destined for that network to Router A. If the interface toward router A fails, the route will be withdrawn, and the route learned via OSPF will be placed in the routing table.

Edit:

This is one way (there are several) that you could do it with an area filter:

Router D:

interface Loopback0
 ip address 192.168.1.253 255.255.255.255
!
interface GigabitEthernet0/0
 description Interface to Router C GigabitEthernet0/0
 ip address 192.168.1.5 255.255.255.252
!
interface GigabitEthernet0/1
 description Interface to Router B GigabitEthernet0/1
 ip address 192.168.1.13 255.255.255.252
!
interface GigabitEthernet0/2
 description Interface to Switch D Ethernet0
 ip address 192.168.1.41 255.255.255.248
!
router ospf 1
 network 192.168.1.4 0.0.0.3 area 1   ! Network to Router C
 network 192.168.1.12 0.0.0.3 area 0
 network 192.168.1.40 0.0.0.7 area 0
 network 192.168.1.253 0.0.0.0 area 0
 area 0 filter-list prefix NetworkA out
!
ip prefix-list NetworkA seq 10 deny 192.168.1.16/29
ip prefix-list NetworkA seq 10 permit 0.0.0.0/0 ge 0
!

Router C:

interface Loopback0
 ip address 192.168.1.251 255.255.255.255
!
interface GigabitEthernet0/0
 description Interface to Router D GigabitEthernet0/0
 ip address 192.168.1.6 255.255.255.252
!
interface GigabitEthernet0/1
 description Interface to Switch C Ethernet0/0
 ip address 192.168.1.24 255.255.255.252
!
interface GigbitEthernet0/3
 description Interface to Router A GigabitEthernet0/0
 ip address 192.168.1.9 255.255.255.248
!
router ospf 1
 passive interface GigabitEthernet0/3   ! No OSPF to Router A
 network 0.0.0.0 255.255.255.255 area 1 ! Include all networks in OSPF
!
ip route 0.0.0.0 0.0.0.0 192.168.1.10   ! Default route to Router A
!

Using an area filter, you can permit or deny any networks between areas. It has the in and out keywords, and you can place the filter on any area connected to the ABR, e.g. out from Area 0 or in to Area 1. Remember that an ABR must be connected to Area 0 because all inter-area traffic goes through Area 0.

Cisco has several documents about OSPF filtering, e.g. ABR Type 3 LSA filtering, just search for them.

Improve this answer
6
  • Could you tell me how I could block Router C from learning the route from Router D? I understand that I would lose a redundant or backup path which; in this understandably rare case, is an acceptable solution for me.
    – dutsnekcirf
    Aug 22, 2018 at 2:43
  • There are several ways. OSPF routers in a single area must have a complete picture of all the routers and networks in that area. You can set up Router C in its own area and use an area filter list. Why is this such a special case? You really do not want to do what you seem to want to do.
    – Ron Maupin ♦
    Aug 22, 2018 at 3:30
  • I would consider this a special case because I wouldn't expect anyone to have the need for this besides me. Bear in mind that the drawing is a very simplified example of my issue. The network behind NetworkA is actually a very large enterprise network owned by a separate organization. They provide some services that we require and they've been gracious enough to allow us to connect to them but their policy dictates that we can not form an OSPF adjacency with their router. We can access their services but only by taking the long way around rather than via the direct connection.
    – dutsnekcirf
    Aug 22, 2018 at 15:30
  • "The network behind NetworkA is actually a very large enterprise network owned by a separate organization." Then it is a separate AS (Autonomous System). OSPF is the wrong tool for the job. BGP is the routing protocol to use between ASes. OSPF must be maintained by a single AS, and I would not allow another AS to connect to my AS via OSPF because OSPF requires a full understanding of all the routers and networks, and bouncing a link or router will cause all the OSPF routers to reconverge. It seems you are trying to use a screwdriver to drive a nail. Use the proper tool for the job.
    – Ron Maupin ♦
    Aug 22, 2018 at 16:13
  • "I would not allow another AS to connect to my AS via OSPF". Perhaps that's the reason why they won't allow us to form an adjacency with them either. Can you think of a way to make this work as is? You mentioned earlier that I could put Router C in its own area and use an area filter list. I'll look into doing that. We've also managed to get it to work by separating the route advertisements into different OSPF process IDs. Have you implemented OSPF Inbound Filtering by using a route-map with a distribution list? Do you think that could also work?
    – dutsnekcirf
    Aug 22, 2018 at 18:49
0

Since I'm being told that I can't do this by filtering the route advertisements using separate OSPF process IDs I'd like to provide details on how this can indeed be done:

The solution is implemented on both NetworkCRouter and NetworkDRouter. Relevant settings follow:

NetworkARouter <--We provided this organization our subnets so they could add a static route to us. They did not provide their subnets to us for us to create a static route.

ip route 192.168.1.24 255.255.255.248 192.168.1.9

NetworkCRouter:

interface Loopback0
 ip address 192.168.1.251 255.255.255.255
 ip ospf 1 area 1

router ospf 1
 network 192.168.1.4 0.0.0.3 area 1
 network 192.168.1.24 0.0.0.7 area 1

ip route 0.0.0.0 0.0.0.0 192.168.1.10

This router's routing table winds up looking like this minus the local and directly connected routes: 

Gateway of last resort is 192.168.1.10 to network 0.0.0.0

192.168.1.0/24 is variably subnetted, 10 subnets, 3 masks
O        192.168.1.40/29 [110/2] via 192.168.1.5, 00:29:35, GigabitEthernet0/0

NetworkDRouter:

interface Loopback0
 ip address 192.168.1.253 255.255.255.255
 ip ospf 1 area 0

interface Loopback1
 ip address 192.168.1.252 255.255.255.255
 ip ospf 1 area 1

router ospf 1
 redistribute ospf 4 subnets
 network 192.168.1.4 0.0.0.3 area 1
 network 192.168.1.40 0.0.0.7 area 1

router ospf 3
 redistribute ospf 1 subnets
 network 192.168.1.12 0.0.0.3 area 0

router ospf 4
 redistribute ospf 1 subnets

This router's routing table winds up looking like this minus the local and directly connected routes: 

192.168.1.0/24 is variably subnetted, 16 subnets, 3 masks
O        192.168.1.0/30 [110/2] via 192.168.1.14, 00:28:20, GigabitEthernet0/1
O        192.168.1.8/30 [110/3] via 192.168.1.14, 00:28:20, GigabitEthernet0/1
O        192.168.1.16/29
           [110/3] via 192.168.1.14, 00:28:20, GigabitEthernet0/1
O        192.168.1.24/29 [110/2] via 192.168.1.6, 00:27:20, GigabitEthernet0/0
O        192.168.1.32/29
           [110/2] via 192.168.1.14, 00:28:20, GigabitEthernet0/1

Any packet entering this router destined for any network other than the 192.168.1.40 network gets sent out the default gateway. I can ping any host on any network with this solution from the NetworkC hosts. I do; however, get asynchronous routing when pinging a host on NetworkB. For example, if I ping from PC3 to PC6 then the packet goes through NetworkCRouter to NetworkARouter via the default route and then over to NetworkB. The ping response from PC6 goes through the NetworkDRouter and then over to NetworkC.

And it is also true that if the connection goes down between NetworkCRouter and NetworkARouter then we lose total connectivity to the NetworkA and NetworkB.

Improve this answer
3
  • 1
    This is much more convoluted than it needs to be. Simply set up a single OSPF process on Router D, which you set up as an ABR by putting the two interfaces in different areas, then use an area filter. It seems to be against what your question asks about needing to not know the network(s) behind Router A.
    – Ron Maupin ♦
    Aug 23, 2018 at 17:49
  • I want to mark this as the answer because it looks like the area filter list is much cleaner. On the NetworkDRouter (the ABR) I created a prefix-list that permits the 192.168.1.40/29 network and then denies 0.0.0.0/0. I then applied the prefix-list to router ospf 1 area 0. This only allows the NetworkCRouter to the 192.168.1.40 network, while forcing all other traffic to go out the default gateway through the NetworkARouter. I still get the same asynchronous routing when I ping the NetworkB hosts from NetworkC but that's a side effect I might have to live with.
    – dutsnekcirf
    Aug 23, 2018 at 21:08
  • OK. I edited my answer to explain how it may be possible with an area filter.
    – Ron Maupin ♦
    Aug 24, 2018 at 1:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.