How can I prevent OSPF from distributing WAN subnet

Question

Hi all, 
 I have an XG firewall (v21) that I would like to use OSPF to distribute a couple of routes to my main network which is also using OSPF. I configured it and it is passing routes but it is also passing the subnet for the WAN interface, which I don't want. I made sure that "dynamic routing" was turned off on the WAN zone, but this route is still being included. 
 
 Any way I can prevent the WAN subnet from being distributed? Perhaps I'm missing something simple.

Mahalakshmi S · Accepted Answer

Lets say we have the following in the device: 
 Interface-1 : 10.1.1.0/24 
 Interface-2 : 10.1.2.0/24 
 
 If, in OSPF, we configure the network entry as 10.1.0.0/16, then both Interface-1 and Interface-2 would be included in OSPF. 
 A simple solution to enable OSPF only on Interface-1 and not on Interface-2 would be to configure OSPF network entry to match the exact prefix configured in the interface - here, 10.1.1.0/24. 
 OSPF network configuration of only 10.1.1.0/24 would include Interface-1 in OSPF and not Interface-2. 
 Another solution would be to configure route-filtering via the CLI which would restrict the unwanted prefix from being advertised. 
 Thanks,

Mahalakshmi S · Answer

Hi Bill Roland , 
 Yes, "redistribute connected" would include the prefixes of all the interfaces in the OSPF advertisements. To restrict the advertisement of one of the prefix, as in your case, we should use route-maps along with the redistribution. 
 Example: 
 Let one of the interfaces be configured with an ip in the subnet 10.255.0.0/24 and we want to prevent this prefix from being advertised. In the backend CLI configuration, use the following: 
 ospf> enable 
 ospf# config t 
 ospf(config)# 
 ospf(config)# access-list acl1 deny 10.255.0.0/24 
 ospf(config)# access-list acl1 permit any 
 ospf(config)# route-map map1 permit 5 
 ospf(config-route-map)# match ip address acl1 
 ospf(config-route-map)# exit 
 ospf(config)# router ospf 
 ospf(config-router)# redistribute connected route-map map1 
 ospf(config-router)# exit 
 ospf(config)# write 
 Configuration saved to /conf/routing/ospfd.conf 
 ospf(config)#

With the above configuration, the prefixes of all the connected interfaces but 10.255.0.0/24 would be included in the OSPF advertisements. 
 Thanks,

How can I prevent OSPF from distributing WAN subnet

Top Replies