How to ignore routes learned by OSPF

[COM-UCO]

I would like to ignore some of the routes learned by OSFP so they don't install in the forwarding table. Important, I'm not talking about suppress/filter routes that my PA announce through OSPF.

For explaining me better, I'm looking for "OSPF Inbound Filtering" in the language of Cisco:

http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/routmap.html

Thanks in advance!!!

[glastra1]

That should be a feature requests. As workaround you may want to use BGP or create static routes with less admin distance.

Regards,

Gerardo.

[COM-UCO]

Gerardo, thanks for your answer. I will look for the way to make that suggestion to Palo Alto Team.

Meanwhile, I've to found a way to prioritize static routes over dynamic routes. The administrative distance works when the prefix length of the routes are equal but it appears that longer prefix length routes take precedence over shorter independent of administrative distance.

[glastra1]

Yes, that's expected behavior shorther prefix lenghts will take over. Admin distance will only matter when you have the same route (including prefix lenght) coming from different routing protocols (static, ospf, bgp...). In adittion OSPF is an internal gateway protocol so is asummed that the the routes are coming from controled sources (where only the requiered routes are advertised), the only options left are changing to BGP (EGP) or configure static routes using the same prefix lenght.

As side note to check the installed routes in the dataplane you can use the following command,

>show routing fib 

regards,

Gerardo.

[pulukas]

Your other option here is to switch to BGP for route distribution.  This would then give you full control of import and export policies throughout the enterprise to handle this cases as you desire.

[COM-UCO]

Gerardo and Steve, thank you for your suggestions. The problem is that OSPF is forced by my provider and I can't change this 😞

Gerardo, you're right I shouldn't receive these routes through OSPF. The plan B is that my provider filter these routes.

Steve, I see that you found this other thread by yourself 😉

[pulukas]

You could perhaps move your provider peering via OSPF into a separate virtual router.  Then use BGP from this VR to your main VR with the controls you need to have in place.

[COM-UCO]

Steve, thank you for your last solution. Perhaps it could be worked.

Finally I solved my problem changing the type of OSPF area from standard to NSSA. This way we only receive the default route from our OSPF peer and at the same we announce our routes.