PAN-OS 10.2 : filter incoming OSPF routes

[EmilienRichard]

Hi,

We are trying to setup OSPFv2 between a PA-5220 in 10.2 and a Cisco ACI Fabric with "Advanced Routing" enabled.

For now, we are able to advertise routes to our ACI Fabric, we can filter outgoing advertisement but we are unable to filter incoming routes. We tried with RIB Filter - OSPFv2 without success (https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/network/network-routing-logi...) :

Have-you an idea of what we are missing ?

Thanks,

Emilien

[vloirat44]

Hi,

If it is not the way to do that, how can we filter incoming prefix with OSPF ?

Regards,

Vincent

[rivanov]

Hi,

Please remember with OSPF in general there is no way to filter prefixes within the area, as all routers in the area should agree on the LSA database. Removing routes from the RIB, yet still having corresponding LSAs is a very bad practice. If you are looking for prefix filtering, follow OSPF design requirements for that (such as stub areas).

[PavelK]

Hello @EmilienRichard

with OSPF, the filtering of prefixes is typically done on device that is either ABR or ASBR. I have to admit that I have no hands on experience with Advanced Routing Engine, however by looking into documentation: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/advanced-routing/create-filter... under section: Prefix Lists, there is below point:

From the screen shots you provided, it is not clear whether ACI is in a different OSPF area or the same area. If both devices are in the same area, then this would be my first guess that this is a reason why inbound filter does not work as Palo Alto firewall is not ABR.

If I would be in your place and OSPF area re-design would be an option on the table, I would place ACI into non backbone area and used the same filter you already created.

Kind Regards

Pavel

[EmilienRichard]

Hello,

We tried to filter incoming OSPF routes without success so we switched to a BGP peering with our ACI Fabric and we configured inbound prefix filtering :

with a prefix list :

Thanks for your help.