H3C MSR Routers OSPF Configuration Examples (Comware V7)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contents

Introduction· 1

Prerequisites· 1

Example: Configuring OSPF route filtering· 1

Network requirements· 1

Software version used· 2

Configuration restrictions and guidelines· 2

Configuration procedures· 2

Configuring IP addresses· 2

Configuring OSPF· 2

Configure RIP· 3

Configuring route redistribution· 4

Configuring OSPF route filtering· 5

Verifying the configuration· 5

Configuration files· 8

Related documentation· 10

 

Introduction

This document provides OSPF route filtering configuration examples.

Prerequisites

This document applies to Comware V7-based MSR routers. Procedures and information in the examples might be slightly different depending on the software or hardware version of the router.

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of OSPF route filtering.

Example: Configuring OSPF route filtering

Network requirements

As shown in Figure 1, the devices of an enterprise reside in OSPF and RIP domains.

Configure route redistribution between OSPF and RIP to interconnect the devices.

Configure route filtering on Device E, Device C, and Device D to meet the following requirements:

·     The route destined for R&D department 2 is not redistributed to OSPF.

·     Marketing department 1 cannot reach R&D department 1.

·     R&D department 1 and the After-sale service department cannot reach Marketing department 2.

Figure 1 Network diagram

 

Table 1 Interface and IP address assignment

Device	Interface	IP address	Device	Interface	IP address
Device A	GE2/0/1	10.1.1.1/24	Device B	GE2/0/1	10.1.1.2/24
	GE2/0/2	10.2.1.1/24		GE2/0/2	10.3.1.1/24
	GE2/0/3	10.4.1.1/24
Device C	GE2/0/1	10.2.1.2/24	Device D	GE2/0/1	10.3.1.2/24
	Loop0	192.168.3.1/24		Loop0	192.168.1.1/24
				Loop1	192.168.2.1/24
Device E	GE2/0/1	10.4.1.2/24	Device F	GE2/0/1	10.5.1.2/24
	GE2/0/2	10.5.1.1/24		Loop0	192.168.4.1/24
				Loop1	192.168.5.1/24

 

Software version used

This configuration example was created and verified on R0106.

Configuration restrictions and guidelines

When you configure OSPF route filtering, follow these restrictions and guidelines:

·     The filter-policy export command that filters redistributed routes takes effect only on an ASBR.

·     OSPF filters routes calculated using received LSAs. It does not filter LSAs.

·     IP communication is bidirectional. If a router filters a route destined for Network A, the subnets attached to the router cannot reach Network A, and Network A cannot reach the subnets.

·     When you configure route filtering by referencing an ACL, configure the rule permit source any item following multiple rule deny source items to allow unmatched routes to pass.

Configuration procedures

Configuring IP addresses

# Configure an IP address for GigabitEthernet 2/0/1.

<DeviceA> system-view

[DeviceA] interface GigabitEthernet 2/0/1

[Device A-GigabitEthernet2/0/1] ip address 10.1.1.1 24

[DeviceA-GigabitEthernet2/0/1] quit

# Configure IP addresses for other interfaces, as shown in Figure 1. (Details not shown.)

Configuring OSPF

# Enable OSPF on Device A.

<DeviceA> system-view

[DeviceA] ospf

[DeviceA-ospf-1] area 0

[DeviceA-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.255

[DeviceA-ospf-1-area-0.0.0.0] quit

[DeviceA-ospf-1] area 2

[DeviceA-ospf-1-area-0.0.0.2] network 10.2.1.0 0.0.0.255

[DeviceA-ospf-1-area-0.0.0.2] quit

[DeviceA-ospf-1] area 1

[DeviceA-ospf-1-area-0.0.0.1] network 10.4.1.0 0.0.0.255

[DeviceA-ospf-1-area-0.0.0.1] quit

[DeviceA-ospf-1] quit

# Enable OSPF on Device B.

<DeviceB> system-view

[DeviceB] ospf

[DeviceB-ospf-1] area 0

[DeviceB-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.255

[DeviceB-ospf-1-area-0.0.0.0] quit

[DeviceB-ospf-1] area 3

[DeviceB-ospf-1-area-0.0.0.3] network 10.3.1.0 0.0.0.255

[DeviceB-ospf-1-area-0.0.0.3] quit

[DeviceB-ospf-1] quit

# Enable OSPF on Device C.

<DeviceC> system-view

[DeviceC] ospf

[DeviceC-ospf-1] area 2

[DeviceC-ospf-1-area-0.0.0.2] network 10.2.1.0 0.0.0.255

[DeviceC-ospf-1-area-0.0.0.2] network 192.168.3.0 0.0.0.255

[DeviceC-ospf-1-area-0.0.0.2] quit

[DeviceC-ospf-1] quit

# Enable OSPF on Device D.

<DeviceD> system-view

[DeviceD] ospf

[DeviceD-ospf-1] area 3

[DeviceD-ospf-1-area-0.0.0.3] network 10.3.1.0 0.0.0.255

[DeviceD-ospf-1-area-0.0.0.3] network 192.168.1.0 0.0.0.255

[DeviceD-ospf-1-area-0.0.0.3] network 192.168.2.0 0.0.0.255

[DeviceD-ospf-1-area-0.0.0.3] quit

[DeviceD-ospf-1] quit

# Enable OSPF on Device E.

<DeviceE> system-view

[DeviceE] ospf

[DeviceE-ospf-1] area 1

[DeviceE-ospf-1-area-0.0.0.1] network 10.4.1.0 0.0.0.255

[DeviceE-ospf-1-area-0.0.0.1] quit

[DeviceE-ospf-1] quit

Configure RIP

# Enable RIP on Device E.

<DeviceE> system-view

[DeviceE] rip

[DeviceE-rip-1] version 2

[DeviceE-rip-1] undo summary

[DeviceE-rip-1] network 10.5.1.0 0.0.0.255

[DeviceE-rip-1] quit

# Enable RIP on Device F.

<DeviceF> system-view

[DeviceF] rip

[DeviceF-rip-1] version 2

[DeviceF-rip-1] undo summary

[DeviceF-rip-1] network 10.5.1.0 0.0.0.255

[DeviceF-rip-1] network 192.168.4.0 0.0.0.255

[DeviceF-rip-1] network 192.168.4.0 0.0.0.255

[DeviceF-rip-1] quit

Configuring route redistribution

# Configure Device E to redistribute OSPF and direct routes to RIP.

<DeviceE> system-view

[DeviceE] rip

[DeviceE-rip-1] import-route direct

[DeviceE-rip-1] import-route ospf

[DeviceE-rip-1] quit

# Configure Device E to redistribute RIP and direct routes to OSPF.

[DeviceE] ospf

[DeviceE-ospf-1] import-route direct

[DeviceE-ospf-1] import-route rip

[DeviceE-ospf-1] quit

# Verify that Device E has routes to all networks.

[DeviceE] display ip routing-table

 

Destinations : 24        Routes : 24

 

Destination/Mask    Proto  Pre  Cost         NextHop         Interface

0.0.0.0/32          Direct 0    0            127.0.0.1       InLoop0

10.1.1.0/24         OSPF   10   2            10.4.1.1        GE2/0/1

10.2.1.0/24         OSPF   10   2            10.4.1.1        GE2/0/1

10.3.1.0/24         OSPF   10   3            10.4.1.1        GE2/0/1

10.4.1.0/24         Direct 0    0            10.4.1.2        GE2/0/1

10.4.1.0/32         Direct 0    0            10.4.1.2        GE2/0/1

10.4.1.2/32         Direct 0    0            127.0.0.1       InLoop0

10.4.1.255/32       Direct 0    0            10.4.1.2        GE2/0/1

10.5.1.0/24         Direct 0    0            10.5.1.1        GE2/0/2

10.5.1.0/32         Direct 0    0            10.5.1.1        GE2/0/2

10.5.1.1/32         Direct 0    0            127.0.0.1       InLoop0

10.5.1.255/32       Direct 0    0            10.5.1.1        GE2/0/2

127.0.0.0/8         Direct 0    0            127.0.0.1       InLoop0

127.0.0.0/32        Direct 0    0            127.0.0.1       InLoop0

127.0.0.1/32        Direct 0    0            127.0.0.1       InLoop0

127.255.255.255/32  Direct 0    0            127.0.0.1       InLoop0

192.168.1.1/32      OSPF   10   3            10.4.1.1        GE2/0/1

192.168.2.1/32      OSPF   10   3            10.4.1.1        GE2/0/1

192.168.3.1/32      OSPF   10   2            10.4.1.1        GE2/0/1

192.168.4.0/24      RIP    100  1            10.5.1.2        GE2/0/2

192.168.5.0/24      RIP    100  1            10.5.1.2        GE2/0/2

224.0.0.0/4         Direct 0    0            0.0.0.0         NULL0

224.0.0.0/24        Direct 0    0            0.0.0.0         NULL0

255.255.255.255/32  Direct 0    0            127.0.0.1       InLoop0

# Verify that other devices have routes to all networks. (Details not shown.)

Configuring OSPF route filtering

# On Device C, configure IPv4 basic ACL 2000 to deny 192.168.2.0/24.

<DeviceC> system-view

[DeviceC] acl number 2000

[DeviceC-acl-basic-2000] rule 0 deny source 192.168.2.0 0.0.0.255

[DeviceC-acl-basic-2000] rule permit source any

[DeviceC-acl-basic-2000] quit

# On Device C, use ACL 2000 to filter received routes.

[DeviceC] ospf

[DeviceC-ospf-1] filter-policy 2000 import

[DeviceC-ospf-1] quit

# On Device D, configure IPv4 basic ACL 2000 to deny 192.168.5.0/24.

<DeviceD> system-view

[DeviceD] acl number 2000

[DeviceD-acl-basic-2000] rule 0 deny source 192.168.5.0 0.0.0.255

[DeviceD-acl-basic-2000] rule permit source any

[DeviceD-acl-basic-2000] quit

# On Device D, use ACL 2000 to filter received routes.

[DeviceD] ospf

[DeviceD-ospf-1] filter-policy 2000 import

[DeviceD-ospf-1] quit

# On Device E, configure IPv4 basic ACL 2000 to deny 192.168.4.0/24.

<DeviceE> system-view

[DeviceE] acl number 2000

[DeviceE-acl-basic-2000] rule 0 deny source 192.168.4.0 0.0.0.255

[DeviceE-acl-basic-2000] rule permit source any

[DeviceE-acl-basic-2000] quit

# On Device E, use ACL 2000 to filter routes redistributed from RIP.

[DeviceE] ospf

[DeviceE-ospf-1] filter-policy 2000 export rip 1

[DeviceE-ospf-1] quit

Verifying the configuration

# Verify that Device C does not have a route to 192.168.2.0/24.

[DeviceC] display ip routing-table

 

Destinations : 22        Routes : 22

 

Destination/Mask    Proto  Pre  Cost         NextHop         Interface

0.0.0.0/32          Direct 0    0            127.0.0.1       InLoop0

10.1.1.0/24         OSPF   10   2            10.2.1.1        GE2/0/1

10.2.1.0/24         Direct 0    0            10.2.1.2        GE2/0/1

10.2.1.0/32         Direct 0    0            10.2.1.2        GE2/0/1

10.2.1.2/32         Direct 0    0            127.0.0.1       InLoop0

10.2.1.255/32       Direct 0    0            10.2.1.2        GE2/0/1

10.3.1.0/24         OSPF   10   3            10.2.1.1        GE2/0/1

10.4.1.0/24         OSPF   10   2            10.2.1.1        GE2/0/1

10.5.1.0/24         OSPF   150  1            10.2.1.1        GE2/0/1

127.0.0.0/8         Direct 0    0            127.0.0.1       InLoop0

127.0.0.0/32        Direct 0    0            127.0.0.1       InLoop0

127.0.0.1/32        Direct 0    0            127.0.0.1       InLoop0

127.255.255.255/32  Direct 0    0            127.0.0.1       InLoop0

192.168.1.1/32      OSPF   10   3            10.2.1.1        GE2/0/1

192.168.3.0/24      Direct 0    0            192.168.3.1     Loop0

192.168.3.0/32      Direct 0    0            192.168.3.1     Loop0

192.168.3.1/32      Direct 0    0            127.0.0.1       InLoop0

192.168.3.255/32    Direct 0    0            192.168.3.1     Loop0

192.168.5.0/24      OSPF   150  1            10.2.1.1        GE2/0/1

224.0.0.0/4         Direct 0    0            0.0.0.0         NULL0

224.0.0.0/24        Direct 0    0            0.0.0.0         NULL0

255.255.255.255/32  Direct 0    0            127.0.0.1       InLoop0

# Verify that Marketing department 1 cannot reach R&D department 1.

[DeviceC] ping -a 192.168.3.1 192.168.2.1

Ping 192.168.2.1 (192.168.2.1) from 192.168.3.1: 56 data bytes, press CTRL_C to

break

Request time out

Request time out

Request time out

Request time out

Request time out

 

--- Ping statistics for 192.168.2.1 ---

5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss

# Verify that Device D does not have a route to 192.168.5.0/24.

[DeviceD] display ip routing-table

 

Destinations : 25        Routes : 25

 

Destination/Mask    Proto  Pre  Cost         NextHop         Interface

0.0.0.0/32          Direct 0    0            127.0.0.1       InLoop0

10.1.1.0/24         OSPF   10   2            10.3.1.1        GE2/0/1

10.2.1.0/24         OSPF   10   3            10.3.1.1        GE2/0/1

10.3.1.0/24         Direct 0    0            10.3.1.2        GE2/0/1

10.3.1.0/32         Direct 0    0            10.3.1.2        GE2/0/1

10.3.1.2/32         Direct 0    0            127.0.0.1       InLoop0

10.3.1.255/32       Direct 0    0            10.3.1.2        GE2/0/1

10.4.1.0/24         OSPF   10   3            10.3.1.1        GE2/0/1

10.5.1.0/24         OSPF   150  1            10.3.1.1        GE2/0/1

127.0.0.0/8         Direct 0    0            127.0.0.1       InLoop0

127.0.0.0/32        Direct 0    0            127.0.0.1       InLoop0

127.0.0.1/32        Direct 0    0            127.0.0.1       InLoop0

127.255.255.255/32  Direct 0    0            127.0.0.1       InLoop0

192.168.1.0/24      Direct 0    0            192.168.1.1     Loop0

192.168.1.0/32      Direct 0    0            192.168.1.1     Loop0

192.168.1.1/32      Direct 0    0            127.0.0.1       InLoop0

192.168.1.255/32    Direct 0    0            192.168.1.1     Loop0

192.168.2.0/24      Direct 0    0            192.168.2.1     Loop1

192.168.2.0/32      Direct 0    0            192.168.2.1     Loop1

192.168.2.1/32      Direct 0    0            127.0.0.1       InLoop0

192.168.2.255/32    Direct 0    0            192.168.2.1     Loop1

192.168.3.1/32      OSPF   10   3            10.3.1.1        GE2/0/1

224.0.0.0/4         Direct 0    0            0.0.0.0         NULL0

224.0.0.0/24        Direct 0    0            0.0.0.0         NULL0

255.255.255.255/32  Direct 0    0            127.0.0.1       InLoop0

# Verify that the After-sale service department cannot reach Marketing department 2.

[DeviceD] ping -a 192.168.1.1 192.168.5.1

Ping 192.168.5.1 (192.168.5.1) from 192.168.1.1: 56 data bytes, press CTRL_C to

break

Request time out

Request time out

Request time out

Request time out

Request time out

 

--- Ping statistics for 192.168.5.1 ---

5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss

# Verify that R&D department 1 cannot reach Marketing department 2.

[DeviceD] ping -a 192.168.2.1 192.168.5.1

Ping 192.168.5.1 (192.168.5.1) from 192.168.2.1: 56 data bytes, press CTRL_C to

break

Request time out

Request time out

Request time out

Request time out

Request time out

 

--- Ping statistics for 192.168.5.1 ---

5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss

The output on Device C and Device D shows that Device E has filtered the route destined for R&D development 2.

Configuration files

·     Device A:

#

ospf 1

 area 0.0.0.0

  network 10.1.1.0 0.0.0.255

 area 0.0.0.1

network 10.4.1.0 0.0.0.255

area 0.0.0.2

  network 10.2.1.0 0.0.0.255

#

interface GigabitEthernet2/0/1

 port link-mode route

 ip address 10.1.1.1 255.255.255.0

#

interface GigabitEthernet2/0/2

 port link-mode route

 ip address 10.2.1.1 255.255.255.0

#

interface GigabitEthernet2/0/3

 port link-mode route

 ip address 10.4.1.1 255.255.255.0

#

·     Device B:

#

ospf 1

 area 0.0.0.0

  network 10.1.1.0 0.0.0.255

 area 0.0.0.3

  network 10.3.1.0 0.0.0.255

#

interface GigabitEthernet2/0/1

 port link-mode route

 ip address 10.1.1.2 255.255.255.0

#

interface GigabitEthernet2/0/2

 port link-mode route

 ip address 10.3.1.1 255.255.255.0

#

·     Device C:

#

ospf 1

 filter-policy 2000 import

 area 0.0.0.2

  network 10.2.1.0 0.0.0.255

  network 192.168.3.0 0.0.0.255

#

interface LoopBack0

 ip address 192.168.3.1 255.255.255.0

#

interface GigabitEthernet2/0/1

 port link-mode route

 ip address 10.2.1.2 255.255.255.0

#

acl number 2000

 rule 0 deny source 192.168.2.0 0.0.0.255

rule 5 permit

#

·     Device D:

#

ospf 1

 filter-policy 2000 import

 area 0.0.0.3

  network 10.3.1.0 0.0.0.255

  network 192.168.1.0 0.0.0.255

  network 192.168.2.0 0.0.0.255

#

interface LoopBack0

 ip address 192.168.1.1 255.255.255.0

#

interface LoopBack1

 ip address 192.168.2.1 255.255.255.0

#

interface GigabitEthernet2/0/1

 port link-mode route

 ip address 10.3.1.2 255.255.255.0

#

acl number 2000

 rule 0 deny source 192.168.5.0 0.0.0.255

rule 5 permit

#

·     Device E:

#

ospf 1

 import-route direct

 import-route rip 1

 filter-policy 2000 export rip 1

 area 0.0.0.1

  network 10.4.1.0 0.0.0.255

#

rip 1

 undo summary

 version 2

 network 10.5.1.0 0.0.0.255

 import-route direct

 import-route ospf 1

#

interface GigabitEthernet2/0/1

 port link-mode route

 ip address 10.4.1.2 255.255.255.0

#

interface GigabitEthernet2/0/2

 port link-mode route

 ip address 10.5.1.1 255.255.255.0

#

acl number 2000

 rule 0 deny source 192.168.4.0 0.0.0.255

rule 5 permit

#

·     Device F:

#

rip 1

 undo summary

 version 2

 network 10.5.1.0 0.0.0.255

 network 192.168.4.0

 network 192.168.5.0

#

interface LoopBack0

 ip address 192.168.4.1 255.255.255.0

#

interface LoopBack1

 ip address 192.168.5.1 255.255.255.0

#

interface GigabitEthernet2/0/1

 port link-mode route

 ip address 10.5.1.2 255.255.255.0

#

Related documentation

·     H3C MSR Series Routers Layer 3—IP Routing Command Reference(V7)

·     H3C MSR Series Routers Layer 3—IP Routing Configuration Guide(V7)