OSPF - Prevent OSPF routes from being re-advertised to other OSPF neighbor

[ergotherego]

I have two hub and spoke networks, and old and new. I am in the process of moving all spokes over to the new hubs, but some sites need to be attached to both for a period of time, I can't just cut them all over at once.

Issue I am running into is routes from hub network 1 (H1) are being re-advertised by a spoke (S1) into hub network 2 (H2). Everything today is in area 0.0.0.0, and H1 and H2 are not directly connected - they are only connected by way of the spokes.

I am trying to find a way to filter at each spoke to only advertise LSAs for it's own local networks - and not re-advertise from H1 to H2. It's been awhile since I studied OSPF, but it seems like the only way to do this would be for H1 and H2 to be in different areas, and then put the spokes into a 3rd area. But both H1 and H2 need to have their own backbone area - so that doesn't seem feasible either.

Anyone have any suggestions on how I can accomplish this?

[ergotherego]

Wanted to update this thread in case anyone else runs into this same problem ...

There is an ability in 5.4 to perform the filtering I need, except it would be inbound only (prevent LSAs from being added to the routing table). However, it does not work in 5.4.4 (FortiNet TAC confirmed, pending bug ID).

The method would be to use a route-map statement with the 'match-interface' command - along with 'match-ip-address'. Then apply this route map under OSPF with the command 'distribute-route-map-in'. That way you can accept certain routes only from certain VPN tunnels (peers).

The only option left is to convert my smaller hub-and-spoke network to another protocol - BGP. That enables me to easily control (prevent) redistribution from OSPF to BGP at every spoke.

[MikePruett]

In 5.2.x I used route maps as you mentioned to keep certain routes out etc. It worked fairly well.