Contents

Introduction· 1

Prerequisites· 1

Example: Configuring OSPF route filtering· 1

Network configuration· 1

Applicable hardware and software versions· 2

Restrictions and guidelines· 4

Procedures· 4

Configuring IP addresses· 4

Configuring OSPF· 4

Configuring RIP· 5

Configuring route redistribution· 6

Configuring OSPF route filtering· 7

Verifying the configuration· 7

Configuration files· 9

 

Introduction

This document provides OSPF route filtering configuration examples.

Prerequisites

This document is not restricted to specific software or hardware versions.

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of OSPF route filtering.

Example: Configuring OSPF route filtering

Network configuration

As shown in Figure 1, the devices of an enterprise reside in OSPF and RIP domains.

Configure route redistribution between OSPF and RIP to interconnect the devices.

Configure route filtering on Device E, Device C, and Device D to meet the following requirements:

·     The route destined for R&D department 2 is not redistributed to OSPF.

·     Marketing department 1 cannot reach R&D department 1.

·     R&D department 1 and the After-sale service department cannot reach Marketing department 2.

Figure 1 Network diagram

 

Table 1 Interface and IP address assignment

Device	Interface	IP address	Device	Interface	IP address
Device A	Vlan-int100	10.1.1.1/24	Device B	Vlan-int100	10.1.1.2/24
	Vlan-int200	10.2.1.1/24		Vlan-int300	10.3.1.1/24
	Vlan-int400	10.4.1.1/24
Device C	Vlan-int200	10.2.1.2/24	Device D	Vlan-int300	10.3.1.2/24
	Loop0	192.168.3.1/24		Loop0	192.168.1.1/24
				Loop1	192.168.2.1/24
Device E	Vlan-int400	10.4.1.2/24	Device F	Vlan-int500	10.5.1.2/24
	Vlan-int500	10.5.1.1/24		Loop0	192.168.4.1/24
				Loop1	192.168.5.1/24

 

Applicable hardware and software versions

The following matrix shows the hardware and software versions to which this configuration example is applicable:

 

Hardware	Software version
S6812 switch series S6813 switch series	Release 6615Pxx, Release 6628Pxx
S6550XE-HI switch series	Release 6008 and later, Release 8106Pxx
S6525XE-HI switch series	Release 6008 and later, Release 8106Pxx
S5850 switch series	Release 8005 and later
S5570S-EI switch series	Release 11xx
S5560X-EI switch series	Release 63xx, Release 65xx, Release 6615Pxx, Release 6628Pxx
S5560X-HI switch series	Release 63xx, Release 65xx, Release 6615Pxx, Release 6628Pxx
S5500V2-EI switch series	Release 63xx, Release 65xx, Release 6615Pxx, Release 6628Pxx
MS4520V2-30F switch	Release 63xx, Release 65xx, Release 6615Pxx, Release 6628Pxx
MS4520V2-30C switch MS4520V2-54C switch	Release 65xx, Release 6615Pxx, Release 6628Pxx
MS4520V2-28S switch MS4520V2-24TP switch	Release 63xx
S6520X-HI switch series S6520X-EI switch series	Release 63xx, Release 65xx
S6520X-SI switch series S6520-SI switch series	Release 63xx, Release 65xx, Release 6615Pxx, Release 6628Pxx
S5000-EI switch series	Release 63xx, Release 65xx, Release 6615Pxx, Release 6628Pxx
MS4600 switch series	Release 63xx, Release 65xx, Release 6615Pxx, Release 6628Pxx
ES5500 switch series	Release 63xx, Release 65xx, Release 6615Pxx, Release 6628Pxx
S5560S-EI switch series S5560S-SI switch series	Release 63xx
S5500V3-24P-SI S5500V3-48P-SI	Release 63xx
S5500V3-SI switch series (except S5500V3-24P-SI and S5500V3-48P-SI)	Release 11xx
S5170-EI switch series	Release 11xx
S5130S-HI switch series S5130S-EI switch series S5130S-SI switch series S5130S-LI switch series	Release 63xx
S5120V2-SI switch series S5120V2-LI switch series	Release 63xx
S5120V3-EI switch series	Release 11xx
S5120V3-36F-SI S5120V3-28P-HPWR-SI S5120V3-54P-PWR-SI	Release 11xx
S5120V3-SI switch series (except S5120V3-36F-SI, S5120V3-28P-HPWR-SI, and S5120V3-54P-PWR-SI)	Release 63xx
S5120V3-LI switch series	Release 63xx
S3600V3-EI switch series	Release 11xx
S3600V3-SI switch series	Not supported
S3100V3-EI switch series S3100V3-SI switch series	Release 63xx
S5110V2 switch series	Release 63xx
S5110V2-SI switch series	Not supported
S5000V3-EI switch series S5000V5-EI switch series	Not supported
S5000E-X switch series S5000X-EI switch series	Not supported
E128C switch E152C switch E500C switch series E500D switch series	Release 63xx
MS4320V2 switch series MS4320V3 switch series MS4300V2 switch series MS4320 switch series MS4200 switch series	Release 63xx
WS5850-WiNet switch series	Release 63xx
WS5820-WiNet switch series WS5810-WiNet switch series	Release 63xx
WAS6000 switch series	Release 63xx
IE4300-12P-AC switch IE4300-12P-PWR switch IE4300-M switch series IE4320 switch series	Release 63xx

 

Restrictions and guidelines

When you configure OSPF route filtering, follow these restrictions and guidelines:

·     The filter-policy export command that filters redistributed routes takes effect only on an ASBR.

·     OSPF filters routes calculated using received LSAs. It does not filter LSAs.

·     IP communication is bidirectional. If a router filters out a route destined for Network A, the subnets attached to the router cannot reach Network A, and Network A cannot reach the subnets.

·     When you configure route filtering by referencing an ACL, configure the rule permit source any item following multiple rule deny source items to allow unmatched routes to pass.

Procedures

Configuring IP addresses

# Configure an IP address for VLAN-interface 100.

<DeviceA> system-view

[DeviceA] interface vlan-interface 100

[DeviceA-Vlan-interface100] ip address 10.1.1.1 24

# Configure IP addresses for other interfaces in the same way VLAN-interface 100 is configured. (Details not shown.)

Configuring OSPF

# Enable OSPF on Device A.

<DeviceA> system-view

[DeviceA] ospf

[DeviceA-ospf-1] area 0

[DeviceA-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.255

[DeviceA-ospf-1-area-0.0.0.0] quit

[DeviceA-ospf-1] area 2

[DeviceA-ospf-1-area-0.0.0.2] network 10.2.1.0 0.0.0.255

[DeviceA-ospf-1-area-0.0.0.2] quit

[DeviceA-ospf-1] area 1

[DeviceA-ospf-1-area-0.0.0.1] network 10.4.1.0 0.0.0.255

[DeviceA-ospf-1-area-0.0.0.1] quit

[DeviceA-ospf-1] quit

# Enable OSPF on Device B.

<DeviceB> system-view

[DeviceB] ospf

[DeviceB-ospf-1] area 0

[DeviceB-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.255

[DeviceB-ospf-1-area-0.0.0.0] quit

[DeviceB-ospf-1] area 3

[DeviceB-ospf-1-area-0.0.0.3] network 10.3.1.0 0.0.0.255

[DeviceB-ospf-1-area-0.0.0.3] quit

[DeviceB-ospf-1] quit

# Enable OSPF on Device C.

<DeviceC> system-view

[DeviceC] ospf

[DeviceC-ospf-1] area 2

[DeviceC-ospf-1-area-0.0.0.2] network 10.2.1.0 0.0.0.255

[DeviceC-ospf-1-area-0.0.0.2] network 192.168.3.0 0.0.0.255

[DeviceC-ospf-1-area-0.0.0.2] quit

[DeviceC-ospf-1] quit

# Enable OSPF on Device D.

<DeviceD> system-view

[DeviceD] ospf

[DeviceD-ospf-1] area 3

[DeviceD-ospf-1-area-0.0.0.3] network 10.3.1.0 0.0.0.255

[DeviceD-ospf-1-area-0.0.0.3] network 192.168.1.0 0.0.0.255

[DeviceD-ospf-1-area-0.0.0.3] network 192.168.2.0 0.0.0.255

[DeviceD-ospf-1-area-0.0.0.3] quit

[DeviceD-ospf-1] quit

# Enable OSPF on Device E.

<DeviceE> system-view

[DeviceE] ospf

[DeviceE-ospf-1] area 1

[DeviceE-ospf-1-area-0.0.0.1] network 10.4.1.0 0.0.0.255

[DeviceE-ospf-1-area-0.0.0.1] quit

[DeviceE-ospf-1] quit

Configuring RIP

# Enable RIP on Device E.

<DeviceE> system-view

[DeviceE] rip

[DeviceE-rip-1] version 2

[DeviceE-rip-1] undo summary

[DeviceE-rip-1] network 10.5.1.0 0.0.0.255

[DeviceE-rip-1] quit

# Enable RIP on Device F.

<DeviceF> system-view

[DeviceF] rip

[DeviceF-rip-1] version 2

[DeviceF-rip-1] undo summary

[DeviceF-rip-1] network 10.5.1.0 0.0.0.255

[DeviceF-rip-1] network 192.168.4.0 0.0.0.255

[DeviceF-rip-1] network 192.168.4.0 0.0.0.255

[DeviceF-rip-1] quit

Configuring route redistribution

# Configure Device E to redistribute OSPF and direct routes to RIP.

<DeviceE> system-view

[DeviceE] rip

[DeviceE-rip-1] import-route direct

[DeviceE-rip-1] import-route ospf

[DeviceE-rip-1] quit

# Configure Device E to redistribute RIP and direct routes to OSPF.

[DeviceE] ospf

[DeviceE-ospf-1] import-route direct

[DeviceE-ospf-1] import-route rip

[DeviceE-ospf-1] quit

# Verify that Device E has routes to all networks.

[DeviceE] display ip routing-table

 

Destinations : 24        Routes : 24

 

Destination/Mask   Proto   Pre Cost        NextHop         Interface

0.0.0.0/32         Direct  0   0           127.0.0.1       InLoop0

10.1.1.0/24        O_INTER 10  2           10.4.1.1        Vlan400

10.2.1.0/24        O_INTER 10  2           10.4.1.1        Vlan400

10.3.1.0/24        O_INTER 10  3           10.4.1.1        Vlan400

10.4.1.0/24        Direct  0   0           10.4.1.2        Vlan400

10.4.1.0/32        Direct  0   0           10.4.1.2        Vlan400

10.4.1.2/32        Direct  0   0           127.0.0.1       InLoop0

10.4.1.255/32      Direct  0   0           10.4.1.2        Vlan400

10.5.1.0/24        Direct  0   0           10.5.1.1        Vlan500

10.5.1.0/32        Direct  0   0           10.5.1.1        Vlan500

10.5.1.1/32        Direct  0   0           127.0.0.1       InLoop0

10.5.1.255/32      Direct  0   0           10.5.1.1        Vlan500

127.0.0.0/8        Direct  0   0           127.0.0.1       InLoop0

127.0.0.0/32       Direct  0   0           127.0.0.1       InLoop0

127.0.0.1/32       Direct  0   0           127.0.0.1       InLoop0

127.255.255.255/32 Direct  0   0           127.0.0.1       InLoop0

192.168.1.1/32     O_INTER 10  3           10.4.1.1        Vlan400

192.168.2.1/32     O_INTER 10  3           10.4.1.1        Vlan400

192.168.3.1/32     O_INTER 10  2           10.4.1.1        Vlan400

192.168.4.0/24     RIP     100 1           10.5.1.2        Vlan500

192.168.5.0/24     RIP     100 1           10.5.1.2        Vlan500

224.0.0.0/4        Direct  0   0           0.0.0.0         NULL0

224.0.0.0/24       Direct  0   0           0.0.0.0         NULL0

255.255.255.255/32 Direct  0   0           127.0.0.1       InLoop0

# Verify that other devices have routes to all networks. (Details not shown.)

Configuring OSPF route filtering

# On Device C, configure IPv4 basic ACL 2000 to permit any subnet except 192.168.2.0/24.

<DeviceC> system-view

[DeviceC] acl basic 2000

[DeviceC-acl-ipv4-basic-2000] rule 0 deny source 192.168.2.0 0.0.0.255

[DeviceC-acl-ipv4-basic-2000] rule permit source any

[DeviceC-acl-ipv4-basic-2000] quit

# On Device C, use ACL 2000 to filter received routes.

[DeviceC] ospf

[DeviceC-ospf-1] filter-policy 2000 import

[DeviceC-ospf-1] quit

# On Device D, configure IPv4 basic ACL 2000 to permit any subnet except 192.168.5.0/24.

<DeviceD> system-view

[DeviceD] acl basic 2000

[DeviceD-acl-ipv4-basic-2000] rule 0 deny source 192.168.5.0 0.0.0.255

[DeviceD-acl-ipv4-basic-2000] rule permit source any

[DeviceD-acl-ipv4-basic-2000] quit

# On Device D, use ACL 2000 to filter received routes.

[DeviceD] ospf

[DeviceD-ospf-1] filter-policy 2000 import

[DeviceD-ospf-1] quit

# On Device E, configure IPv4 basic ACL 2000 to permit any subnet except 192.168.4.0/24.

<DeviceE> system-view

[DeviceE] acl basic 2000

[DeviceE-acl-ipv4-basic-2000] rule 0 deny source 192.168.4.0 0.0.0.255

[DeviceE-acl-ipv4-basic-2000] rule permit source any

[DeviceE-acl-ipv4-basic-2000] quit

# On Device E, use ACL 2000 to filter routes redistributed from RIP.

[DeviceE] ospf

[DeviceE-ospf-1] filter-policy 2000 export rip 1

[DeviceE-ospf-1] quit

Verifying the configuration

# Verify that Device C does not have a route to 192.168.2.0/24.

[DeviceC] display ip routing-table

 

Destinations : 22        Routes : 22

 

Destination/Mask   Proto   Pre Cost        NextHop         Interface

0.0.0.0/32         Direct  0   0           127.0.0.1       InLoop0

10.1.1.0/24        O_INTER 10  2           10.2.1.1        Vlan200

10.2.1.0/24        Direct  0   0           10.2.1.2        Vlan200

10.2.1.0/32        Direct  0   0           10.2.1.2        Vlan200

10.2.1.2/32        Direct  0   0           127.0.0.1       InLoop0

10.2.1.255/32      Direct  0   0           10.2.1.2        Vlan200

10.3.1.0/24        O_INTER 10  3           10.2.1.1        Vlan200

10.4.1.0/24        O_INTER 10  2           10.2.1.1        Vlan200

10.5.1.0/24        O_ASE2  150 1           10.2.1.1        Vlan200

127.0.0.0/8        Direct  0   0           127.0.0.1       InLoop0

127.0.0.0/32       Direct  0   0           127.0.0.1       InLoop0

127.0.0.1/32       Direct  0   0           127.0.0.1       InLoop0

127.255.255.255/32 Direct  0   0           127.0.0.1       InLoop0

192.168.1.1/32     O_INTER 10  3           10.2.1.1        Vlan200

192.168.3.0/24     Direct  0   0           192.168.3.1     Loop0

192.168.3.0/32     Direct  0   0           192.168.3.1     Loop0

192.168.3.1/32     Direct  0   0           127.0.0.1       InLoop0

192.168.3.255/32   Direct  0   0           192.168.3.1     Loop0

192.168.5.0/24     O_ASE2  150 1           10.2.1.1        Vlan200

224.0.0.0/4        Direct  0   0           0.0.0.0         NULL0

224.0.0.0/24       Direct  0   0           0.0.0.0         NULL0

255.255.255.255/32 Direct  0   0           127.0.0.1       InLoop0

# Verify that Marketing department 1 cannot reach R&D department 1.

[DeviceC] ping -a 192.168.3.1 192.168.2.1

Ping 192.168.2.1 (192.168.2.1) from 192.168.3.1: 56 data bytes, press CTRL+C to

break

Request time out

Request time out

Request time out

Request time out

Request time out

 

--- Ping statistics for 192.168.2.1 ---

5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss

# Verify that Device D does not have a route to 192.168.5.0/24.

[DeviceD] display ip routing-table

 

Destinations : 25        Routes : 25

 

Destination/Mask   Proto   Pre Cost        NextHop         Interface

0.0.0.0/32         Direct  0   0           127.0.0.1       InLoop0

10.1.1.0/24        O_INTER 10  2           10.3.1.1        Vlan300

10.2.1.0/24        O_INTER 10  3           10.3.1.1        Vlan300

10.3.1.0/24        Direct  0   0           10.3.1.2        Vlan300

10.3.1.0/32        Direct  0   0           10.3.1.2        Vlan300

10.3.1.2/32        Direct  0   0           127.0.0.1       InLoop0

10.3.1.255/32      Direct  0   0           10.3.1.2        Vlan300

10.4.1.0/24        O_INTER 10  3           10.3.1.1        Vlan300

10.5.1.0/24        O_ASE2  150 1           10.3.1.1        Vlan300

127.0.0.0/8        Direct  0   0           127.0.0.1       InLoop0

127.0.0.0/32       Direct  0   0           127.0.0.1       InLoop0

127.0.0.1/32       Direct  0   0           127.0.0.1       InLoop0

127.255.255.255/32 Direct  0   0           127.0.0.1       InLoop0

192.168.1.0/24     Direct  0   0           192.168.1.1     Loop0

192.168.1.0/32     Direct  0   0           192.168.1.1     Loop0

192.168.1.1/32     Direct  0   0           127.0.0.1       InLoop0

192.168.1.255/32   Direct  0   0           192.168.1.1     Loop0

192.168.2.0/24     Direct  0   0           192.168.2.1     Loop1

192.168.2.0/32     Direct  0   0           192.168.2.1     Loop1

192.168.2.1/32     Direct  0   0           127.0.0.1       InLoop0

192.168.2.255/32   Direct  0   0           192.168.2.1     Loop1

192.168.3.1/32     O_INTER 10  3           10.3.1.1        Vlan300

224.0.0.0/4        Direct  0   0           0.0.0.0         NULL0

224.0.0.0/24       Direct  0   0           0.0.0.0         NULL0

255.255.255.255/32 Direct  0   0           127.0.0.1       InLoop0

# Verify that the After-sale service department cannot reach Marketing department 2.

[DeviceD] ping -a 192.168.1.1 192.168.5.1

Ping 192.168.5.1 (192.168.5.1) from 192.168.1.1: 56 data bytes, press CTRL+C to

break

Request time out

Request time out

Request time out

Request time out

Request time out

 

--- Ping statistics for 192.168.5.1 ---

5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss

# Verify that R&D department 1 cannot reach Marketing department 2.

[DeviceD] ping -a 192.168.2.1 192.168.5.1

Ping 192.168.5.1 (192.168.5.1) from 192.168.2.1: 56 data bytes, press CTRL+C to

break

Request time out

Request time out

Request time out

Request time out

Request time out

 

--- Ping statistics for 192.168.5.1 ---

5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss

The output on Device C and Device D shows that Device E has filtered out the route destined for R&D development 2.

Configuration files

·     Device A:

#

ospf 1

 area 0.0.0.0

  network 10.1.1.0 0.0.0.255

 area 0.0.0.1

network 10.4.1.0 0.0.0.255

area 0.0.0.2

  network 10.2.1.0 0.0.0.255

#

vlan 100

#

vlan 200

#

vlan 400

#

interface Vlan-interface100

 ip address 10.1.1.1 255.255.255.0

#

interface Vlan-interface200

 ip address 10.2.1.1 255.255.255.0

#

interface Vlan-interface400

 ip address 10.4.1.1 255.255.255.0

#

·     Device B:

#

ospf 1

 area 0.0.0.0

  network 10.1.1.0 0.0.0.255

 area 0.0.0.3

  network 10.3.1.0 0.0.0.255

#

vlan 100

#

vlan 300

#

interface Vlan-interface100

 ip address 10.1.1.2 255.255.255.0

#

interface Vlan-interface300

 ip address 10.3.1.1 255.255.255.0

#

·     Device C:

#

ospf 1

 filter-policy 2000 import

 area 0.0.0.2

  network 10.2.1.0 0.0.0.255

  network 192.168.3.0 0.0.0.255

#

vlan 200

#

interface LoopBack0

 ip address 192.168.3.1 255.255.255.0

#

interface Vlan-interface200

 ip address 10.2.1.2 255.255.255.0

#

acl basic 2000

 rule 0 deny source 192.168.2.0 0.0.0.255

rule 5 permit

#

·     Device D:

#

ospf 1

 filter-policy 2000 import

 area 0.0.0.3

  network 10.3.1.0 0.0.0.255

  network 192.168.1.0 0.0.0.255

  network 192.168.2.0 0.0.0.255

#

vlan 300

#

interface LoopBack0

 ip address 192.168.1.1 255.255.255.0

#

interface LoopBack1

 ip address 192.168.2.1 255.255.255.0

#

interface Vlan-interface300

 ip address 10.3.1.2 255.255.255.0

#

acl basic 2000

 rule 0 deny source 192.168.5.0 0.0.0.255

rule 5 permit

#

·     Device E:

#

ospf 1

 import-route direct

 import-route rip 1

 filter-policy 2000 export rip 1

 area 0.0.0.1

  network 10.4.1.0 0.0.0.255

#

rip 1

 undo summary

 version 2

 network 10.5.1.0 0.0.0.255

 import-route direct

 import-route ospf 1

#

vlan 400

#

vlan 500

#

interface Vlan-interface400

 ip address 10.4.1.2 255.255.255.0

#

interface Vlan-interface500

 ip address 10.5.1.1 255.255.255.0

#

acl basic 2000

 rule 0 deny source 192.168.4.0 0.0.0.255

rule 5 permit

#

·     Device F:

#

rip 1

 undo summary

 version 2

 network 10.5.1.0 0.0.0.255

 network 192.168.4.0

 network 192.168.5.0

#

vlan 500

#

interface LoopBack0

 ip address 192.168.4.1 255.255.255.0

#

interface LoopBack1

 ip address 192.168.5.1 255.255.255.0

#

interface Vlan-interface500

 ip address 10.5.1.2 255.255.255.0

#