Palo Alto Networks Firewall Does Not Redistribute Individual IP Addresses Via OSPF

Issue

The Palo Alto Networks firewall may have /32 IP addresses assigned to individual interfaces or loopback interfaces. However, those addresses will not be redistributed via OSPF, even if the interfaces are added to the OSPF redistribution profile.

Cause

A /32 address is considered a "host" address, and not a "connected" address. The Palo Alto Networks firewall can only redistribute the following types of routes:

• bgp
• connect
• ospf
• rip
• static

Since "host" is not a selection, any /32 address will not be redistributed using a redistribution profile.

Resolution

Beginning with PAN-OS 5.0, single IP addresses can be added to the export rules of the virtual router:

1. Navigate to Network > Virtual Routers.
2. Select your virtual router.
3. Go to the OSPF > Export Rules tab.
4. Add the appropriate IP addresses. Specific IP addresses can be added with /32 notation for export.
   

Note that this is not strictly redistribution. This will advertise the route but will not allow a non-host (learned) route to be redistributed in this fashion.

owner: gwesson