OSPF intra area filtering

[FarhanQureshi]

Hi

I have 3 interfaces on single Fortigate firewall.

1 x LAN1 - running OSPF

1 x LAN2 - running OSPF

1 x WAN - running BGP

OSPF's interfaces are in area 0.0.0.0.

BGP routes will be redistributed into OSPF which is straight forward.

I'm just in dilemma on how to stop ospf routes getting advertised from LAN1 to LAN2 interfaces and vice versa.

One way is to put the LAN1 and LAN2 interfaces into different VRF's but then BGP which will be in global will not be permitted to redistribute routes into each VRF (as I read, VRF's are isolated). We are running 6.0.7 and as I can see, route leakage can only work in 6.4.

Any work around or comments are welcome.

[lobstercreed]

I'm not very experienced in OSPF, but this reminded me a little bit of something I ran into with my ISP. I'm somewhat confused though because I would've assumed you want them advertising to each other since they're in area 0? 

Anyway I think maybe putting the LANs in different areas would allow you to do the filtering you want to do.  I have WAN with BGP and OSPF (annoying, long story involving multi-hop BGP and an ISP with poor network design imo) and then a LAN interface with OSPF.  LAN is in area 0 talking to my core router, WAN is in area 0.0.8.95.  They only want my public subnet, and I want none of their subnets (I get what I need from BGP).  I used the following:

config router ospf
    set router-id x.x.x.x
    set distribute-route-map-in "DropISPxxOSPF_Routemap" <-- Filtered OSPF routes from ISP
    config area
        edit 0.0.8.95
            config filter-list
                edit 2
                    set list "DenyAllRoutes_Prefix" <-- Supposed to prevent routes from being distributed to other areas I think?  Can't remember now if this or the distribute-route-map-in is more what did the job
                next
                edit 1
                    set list "SFCC-IPv4_Prefix" <-- set what to distribute from area 0 into area 0.0.8.95
                    set direction in
                next
            end
        next
    end

I seem to have saved these links in relation to it as well:

https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-advanced-routing-54/Routing_OSPF/OSP...

https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-advanced-routing-54/Routing_OSPF/Adv...

Hope that gets you pointed in the right direction maybe.  - Daniel

[FarhanQureshi]

Hi Daniel

Thank you for your response.

LAN1 and LAN2 are having user and servers subnets respectively so they need to be segregated. Other security appliance is already taking case of the firewall rules on LAN1 and LAN2 inter-zone communication. They are having RFC1918 IP addresses. Controlling the ACL and/or prefix-list is not operationally feasible even with 2 different OSPF areas.

BGP routes will be advertised into OSPF (LAN1 and LAN2).

I'm trying to play with route tagging now on OSPF by using another VDOM for LAN1.

Now some how the routes are not getting tagged and not been seeing on LAN2 VDOM. GGrrr...[&o]

Will see how it goes.