- In this video we want to consider
how to filter routes within OSPF
and there are different places within
an OSPF network where we can do that route filtering.
Let's talk about it in theory
and then we'll go out to a live interface
and I'll demonstrate how to do a couple
of approaches to filtering routes.
First of all, if we have a different autonomous system,
something other than our OSPF autonomous system,
like here we have EIGRP,
and we're redistributing routes from EIGRP
into area 1 into OSPF, router R4 is doing that.
We call router R4, in that case, an ASBR,
an autonomous system boundary router,
and R4 is going to be configured
for a route redistribution.
Now, route redistribution
is not a topic on the ENCOR exam blueprint.
It is a topic on the ENARSI blueprint
that you'll probably go to as your next step
if you're going after your CCNP Enterprise certification
or if you're taking ENCOR
as your written exam for your
CCIE Enterprise infrastructure lab,
you'll probably learn about redistribution then.
But, for now, we don't need to worry
about it in the ENCOR course.
But just be aware, from a theory perspective,
that that's one place where we can do route filtering.
As part of the redistribution configuration,
we can say "All right, I want to filter out
some specific routes".
Another place where we can filter out
a route with OSPF is as we're going
from one area to another area.
If we're going from area 1 into area 0,
for example, we're going to be going
through router R3, and router R3 is an ABR,
an area border router.
There, we can use a filter list
to filter out any unwanted routes.
But within an area, is it possible to filter out a route?
I mean, if you think about it,
it seems to violate what we said about OSPF,
where every router within an area
has an identical view of that area,
it seems like, if I filtered out a route from R1,
for example, and not from R2,
they would have different maps of the area.
Is it possible to do that?
Well, here's what we have to do.
We can not filter out a route
from router R1's OSPF database
because the database that OSPF uses
has to be identical on all the routers in the area.
But, here's what we can do.
We can filter a route between the OSPF database
and the IP routing table.
OSPF is going to know about it in its database
but we can create what's called a distribute list
and that can filter out the unwanted routes
before they get injected into the IP routing table.
And if they're not in the IP routing table,
even if OSPF knows about them, we're not going to use them.
So it gives us the same effect as filtering the route.
Now, let's got to a live interface,
and, again we're not going to talk about
the redistribution approach
in this video because redistribution
is not a topic on the ENCOR blueprint.
But I do want to show you how we could
use that filter list to filter routes
as we're advertising form one area into another area,
and I want to show you how to use the distribute list
to filter routed from going into a routers IP routing table
while still living in that routers OSPF database.
So, let's go out to the live interface
and get that configured.
Before we get started with out filtering,
let's take a look and remind ourselves
what routs we have knowledge of on R1.
This is based on the typology
that we created in out previous video.
I'm using the same OSPF configuration.
Lets do a show IP route and you can see
that I know about all the loopback interfaces.
I know about 2.2.2.2, I know about 3.3.3.3,
the loopback interface used for R2 and R3,
and I know about that network hanging off of R3,
of 10.2.2.0/24.
Let's do some filtering so that
those routes no longer appear on router R1.
Specifically, here's what I'm going to do.
I'm going to create a filter list
to filter out these loopback interfaces.
I'm going to say that, for whatever reason,
I don't want R1 to know about 2.2.2.2/32 or 3.3.3.3/32.
We'll use a filter list to filter that out at the ABR
on or around R2.
Then, we'll use a distribute list
to filter out another route.
We use a distribute list to say
"See this 10.2.2.0/24?
We want to filter that out".
It's going to live in the OSPF database
but we're going to prevent it from going
into this routers IP routing table using a distribute list.
Now, let's get going by going over to router R2
and let's create, here on the ABR,
lets create a prefix list,
which is then going to be referenced by a filter list.
Let's go into global configuration mode
and I'm going to say "ip prefix-list".
And, again, the purpose in life of this prefix list
is to prevent loopback interfaces
from being advertised into area 0.
I'm going to call this "NO-LOOPBACKS",
just a name I came up with.
And, we can give different sequence numbers.
Lower sequence numbers are issued first.
So, eventually, after I say
"Block this and block this and block that",
I've got to have another statement that says
"Okay, permit everything else",
because I don't want to filter other routes out.
I just want to deny my loopback networks.
So I'll start with the low sequence numbers.
I'll say, sequence number 10,
I want to deny the network of 2.2.2.2/32.
That's going to be the loopback interface for R2
that's currently in area 1.
Let's also deny, and I'll use the sequence number
of 20 for that, let's deny the loopback interface
on R3, and it was a network of 3.3.3.3/32.
Now, I want to permit everything else.
So let's cerate a sequence number of 30,
I want to permit everybody, which is going to be 0.0.0.0/0,
and I want to say "le 32", meaning that the prefix,
the subnet masked length, in other words,
is less than or equal to 32, which encompasses
all possible subnet masked lengths.
So, that encompasses every possible IP version four address.
And, because I'm giving it a sequence number
of 30, it's only going to be issued,
we're only going to permit everybody
after we've denied the two networks
that we want to filter.
You know what?
I just noticed I misspelled "NO-LOOPBACK".
I said N-P instead of N-O.
At least we kept the name consistent
so, I'll just need to be careful
and apply that particular prefix list.
So, let's go under router configuration mode
for OSPF process ID,
I think I used a two here on router R2.
And I'll say "area 0, I want to apply a filter-list,
based on my prefix list named..."
I meant to call it "NO-LOOPBACKS",
I called it "NP-LOOPBACKS".
And I want to apply it in the inbound direction,
as we're advertising networks into area 0.
Let's end that.
Now, let's go back to router R1 and confirm
that router R1 no longer knows about those two routes.
Notice we did know about them previously,
there's the 2.2.2.2 and the 3.3.3.3.
Let's, once again, do a show IP route.
Do we know about them now?
No we don't.
We know about our local loopback interphase
of 1.1.1.1, but conspicuously absent,
we don't have the 2.2.2.2
nor do we have the 3.3.3.3 any longer,
and that was by applying a prefix list on the ABR.
We said that we could also
use a distribute list within a router.
All the routers in an OSPF area
have to agree on what the typology looks like.
We cannot filter a route from an OSPF database
on one router and not on another router.
But, what we can do is we can
use a distribute list to prevent
a route known to OSPF from being injected
into the IP routing table.
And, the route that we want to prevent
from being injected is this 10.2.2.0/24,
that's that network hanging off of gigabit 0/2 on R3.
Let's create a prefix list
that we will then reference with a distribute list.
So, on router R1 this time, I'll say
"ip prefix-list",
and I'll call this FILTER_10.2.2.0,
and again, sequence number 10, we'll start with that.
Where I will deny that specific network 10.2.2.0/24.
Now, I want to permit everyone else
and I'll use sequence number 20 to do that.
Sequence number 20.
I'll say that "We want to permit 0.0.0.0/0
with a subnet mask length that's less than or equal to 32".
Now, let's apply that to our routing process.
Let's go into router OSPF 1.
And I'll say "distribute-list".
We're going to reference the prefix list that we called,
in fact I want to make sure I get it typed correctly
so I'm just going to do a copy-paste.
Let's copy that, and paste it in,
so I don't have a typo like I did earlier.
And I'll say "in" as we're advertising networks
into the IP routing table,
we want to filter out whatever's specified
by that prefix list.
All right.
Let's go take a look--
First of all, before you even look at the IP routing table,
let's see if it's in our OSPF database.
If I do a "show ip ospf database" command,
we can see networks that we've learned form another area.
Those are based on type three LSAs,
that's something we talked about back in your CCNA studies,
but that's the summary net link states.
We know about 10.2.2.0.
That was advertised from another area as was 192.168.1.0.
Those were type three LSAs that got injected by R2
into area 0, and I'm in area 0,
I'm R1, so I know about it.
But, just because it's in my OSPF database,
we said we don't want it to appear in the IP routing table.
Let's see if it does.
Let's do a "show ip route", again,
we're looking for the absence of 10.2.2.0.
And, let's see.
Is it there?
No it's not.
Look at that.
We have now filtered out our loopback interphases
on R2 and R3 using a filter list applied on the ABR,
and we filtered out the 10.2.2.0/24 network
on router R1 even though router R1 OSPF database
knew about it, we filtered it from being injected
into the IP routing table on R1 using a distribute list.
And those are a couple of ways
that we can do route filtering within OSPF.