topic Re: PAN-OS 10.2 : filter incoming OSPF routes in General Topics

PAN-OS 10.2 : filter incoming OSPF routes

EmilienRichard — Thu, 12 May 2022 08:41:38 GMT

Hi,

We are trying to setup OSPFv2 between a PA-5220 in 10.2 and a Cisco ACI Fabric with "Advanced Routing" enabled.

For now, we are able to advertise routes to our ACI Fabric, we can filter outgoing advertisement but we are unable to filter incoming routes. We tried with RIB Filter - OSPFv2 without success (https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/network/network-routing-logical-routers/network-routing-logical-routers-general) :

Have-you an idea of what we are missing ?

Thanks,

Emilien

Re: PAN-OS 10.2 : filter incoming OSPF routes

vloirat44 — Fri, 13 May 2022 09:32:04 GMT

Hi,

If it is not the way to do that, how can we filter incoming prefix with OSPF ?

Regards,

Vincent

Re: PAN-OS 10.2 : filter incoming OSPF routes

rivanov — Fri, 13 May 2022 13:41:38 GMT

Hi,

Please remember with OSPF in general there is no way to filter prefixes within the area, as all routers in the area should agree on the LSA database. Removing routes from the RIB, yet still having corresponding LSAs is a very bad practice. If you are looking for prefix filtering, follow OSPF design requirements for that (such as stub areas).

Re: PAN-OS 10.2 : filter incoming OSPF routes

PavelK — Sat, 14 May 2022 14:19:36 GMT

Hello @EmilienRichard

with OSPF, the filtering of prefixes is typically done on device that is either ABR or ASBR. I have to admit that I have no hands on experience with Advanced Routing Engine, however by looking into documentation: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/advanced-routing/create-filters-for-the-advanced-routing-engine under section: Prefix Lists, there is below point:

From the screen shots you provided, it is not clear whether ACI is in a different OSPF area or the same area. If both devices are in the same area, then this would be my first guess that this is a reason why inbound filter does not work as Palo Alto firewall is not ABR.

If I would be in your place and OSPF area re-design would be an option on the table, I would place ACI into non backbone area and used the same filter you already created.

Kind Regards

Pavel

Re: PAN-OS 10.2 : filter incoming OSPF routes

EmilienRichard — Wed, 01 Jun 2022 08:44:23 GMT

Hello,

We tried to filter incoming OSPF routes without success so we switched to a BGP peering with our ACI Fabric and we configured inbound prefix filtering :

with a prefix list :

Thanks for your help.