Re: OSPF Redistribution route-map with prefix-list not working after u - Page 2

heinrichsra · ‎12-29-2023

Dear Cisco DevOps for OSPF on ASA,

why has the configuration of prefix-lists been removed from OSPF v3/OSPFv4 when your DevOps colleagues for BGP, IS-IS and EIGRP continue to implement prefix-list?

Furthermore, without prefix-list it is no longer possible to use "less specific" routes as a backup path.
According to the workaround in CSCwi31091, how should it be possible to filter a "less-specific" route via ACL?
Example:
route outside 10.246.2.0 255.255.255.0 [BackupPath-NextHop] 15 <=== DO NOT redistribute
route outside 10.246.2.0 255.255.255.128 [PrimaryPath-NextHop] 10 <= Prefix for redistribution
route outside 10.246.2.128 255.255.255.128 [PrimaryPath-NextHop] 10 <= Prefix for redistribution

Kind regards
Ralf

heinrichsra · ‎01-01-2024

@ruben
I did couple of test back and forth but none of the solutions works using the workaround described in the BugID CSCwi31091 nor your provided solutions.

Any solutions are vry welcome.

MHM Cisco World · ‎01-01-2024

So you use tag in static route and then match it in route-map and did not work!!

MHM

heinrichsra · ‎01-01-2024

It is impossible to add a tag to a static route on ASA

Colsen899 · ‎01-02-2024

It appears that using the prefix-list approach in redistributing VPN routes into OSPF provides more precise control compared to the access-list method. The reminder in the access-list to exclude the /24 ensures a cleaner redistribution, avoiding unnecessary routes in OSPF.

MHM Cisco World · ‎01-03-2024

I dont have ASA image to test but I get other solution
using extended ACL instead of Standard ACL in redistribute

heinrichsra · ‎01-03-2024

The ACL looks weird. I'll test it on ASA and let you know.

heinrichsra · ‎01-04-2024

I have configured your solution on an ASA but sadly it does not work.
<<< config snip-set >>>

route outside 10.247.1.0 255.255.255.0 [PrimaryPath-NextHop] 10		<= prefix for redistribution
route outside 10.247.2.0 255.255.255.0 [BackupPath-NextHop] 15		<=== DO NOT redistribute
route outside 10.247.2.0 255.255.255.128 [PrimaryPath-NextHop] 10	<= prefix for redistribution
route outside 10.247.2.128 255.255.255.128 [PrimaryPath-NextHop] 10	<= prefix for redistribution
!
prefix-list Redistribute_VPN_OSPF seq 10 permit 10.247.1.0/24
prefix-list Redistribute_VPN_OSPF seq 20 permit 10.247.2.0/25
prefix-list Redistribute_VPN_OSPF seq 30 permit 10.247.2.128/25
!
access-list Redistribute_STATIC_OSPF extended permit ip any4 10.247.1.0 255.255.255.0
access-list Redistribute_STATIC_OSPF extended permit ip host 10.247.2.0 host 255.255.255.128
access-list Redistribute_STATIC_OSPF extended permit ip host 10.247.2.128 host 255.255.255.128
access-list Redistribute_STATIC_OSPF_DENY extended permit ip host 10.247.2.0 host 255.255.255.0
!
route-map Redistribute_STATIC_OSPF deny 10
 match ip address Redistribute_STATIC_OSPF_DENY
route-map Redistribute_STATIC_OSPF permit 20
 match ip address Redistribute_STATIC_OSPF
!
router ospf 1
 router-id 10.255.255.2
 redistribute static metric 30 metric-type 1 subnets tag 7 route-map Redistribute_STATIC_OSPF

! From OSPF router-id 10.255.255.2
		Type-5 AS External Link States
              
Link ID         ADV Router      Age         Seq#       Checksum Tag
0.0.0.0         10.255.255.2    1162        0x80003d3a 0x8126 1
10.247.1.0      10.255.255.2    318         0x8000000c 0x9d58 7

! From OSPF router-id 10.255.255.1 (OSPF neighbor of OSPF router-id 10.255.255.2)
O E1     10.247.1.0 255.255.255.0 [110/90] via ...
MISSING  10.247.2.0 255.255.255.0				<=== Good
MISSING  10.247.2.0 255.255.255.128				<=== WRONG!!! Should be redistributed
MISSING  10.247.2.128 255.255.255.128			<=== WRONG!!! Should be redistributed

BTW, I just added 10.247.1.0/24 to see whether or not the redistribution is working at all.

It seems to ASA once again behaves different than a router or L3-Switch. But sadly we still have no proper solution.
Any other ideas?

MHM Cisco World · ‎01-04-2024

Can you add keywords subnet with redistrubte static under ospf

MHM

heinrichsra · ‎01-04-2024

It's already added:
redistribute static metric 30 metric-type 1 subnets tag 7 route-map Redistribute_STATIC_OSPF

heinrichsra · ‎01-04-2024

I have tried a different approach, which is already configured on several ASA with OS version lower than 9.16(4)42, 9.18(4)5 or 9.20(2) using a "match metric" criteria inside the route-map for redistribution of static routes into OSPF.

BUT!!! The DevOps of OSPF for ASA also removed this support:

route-map Redistribute_STATIC_OSPF deny 20
 match metric 15
WARNING: "Redistribute_STATIC_OSPF" used as redistribute static into ospf route-map, metric match not supported

DevOps, what are you doing? Removing "prefix-list" as well "match metric" for OSPF is not a good sign for any customer using OSPF on ASA. What will be the next unsupportted OSPF functionality/feature on ASA running OSPF?

DevOps, which solution can you offer?

MHM Cisco World · ‎01-04-2024

match metric is used for redistribute BGP into OSPF/EIGRP
but I have other solution I need to try it first
update you today
MHM

heinrichsra · ‎01-04-2024

Example from an ASA config (BTW, "match metric" for static routes into OSPF is used the last decades):

route-map vpn-routes deny 10
 match ip address filter-default-static-route
!
route-map vpn-routes permit 20
 match metric 1
 set metric-type type-1
!
router ospf 1
 router-id 192.168.254.63
 network xxx.xxx.xxx.xxx 255.255.255.248 area 0
 log-adj-changes
 redistribute static metric 1 subnets tag xxxxxxx route-map vpn-routes

MHM Cisco World · ‎01-05-2024

I already try it match metric and it not work for static, for direct connect I will try later
NOW
ASA not support tag with static route
ASA not work as I test when we use extended ACL
last solution
we will use distribute-list in OSPF neighbour and I hope it not ASA so we can use prefix-list and omitted 192.168.1.0/24 from routing table, are this solution is OK for you ?
MHM

heinrichsra · ‎01-05-2024

It's worth trying it with distribute-list.

heinrichsra · ‎01-05-2024

I cannot explain it right now why the redistribution works when using the prior prefix-list inside a policy-list under a route-map.

/* info from ASA running 9.16(4)42 about the options inside a route-map leads to "policy-list"
route-map Redistribute_VPN_OSPF permit 10
  match ?

route-map mode commands/options:
  as-path      Match BGP AS path list
  community    Match BGP community list
  interface    Match first hop interface of route
  ip           IP specific information
  ipv6         IPv6 specific information
  metric       Match metric of route
  policy-list  Match IP policy list
  route-type   Match route-type of route
  tag          Match tag of route
*/
route outside 10.247.1.0 255.255.255.0 [PrimaryPath-NextHop] 10		<= prefix for redistribution
route outside 10.247.2.0 255.255.255.0 [BackupPath-NextHop] 15		<=== DO NOT redistribute
route outside 10.247.2.0 255.255.255.128 [PrimaryPath-NextHop] 10	<= prefix for redistribution
route outside 10.247.2.128 255.255.255.128 [PrimaryPath-NextHop] 10	<= prefix for redistribution
!
prefix-list Redistribute_STATIC_OSPF seq 10  permit 10.247.1.0/24
prefix-list Redistribute_STATIC_OSPF seq 100 permit 10.247.2.0/25
prefix-list Redistribute_STATIC_OSPF seq 110 permit 10.247.2.128/25
!
policy-list Redistribute_STATIC_OSPF permit
 match ip address prefix-list Redistribute_STATIC_OSPF
!
route-map Redistribute_STATIC_OSPF permit 10
 match policy-list Redistribute_STATIC_OSPF
!
router ospf 1
 router-id 10.255.255.2
 redistribute static metric 30 metric-type 1 subnets tag 7 route-map Redistribute_STATIC_OSPF

! From OSPF router-id 10.255.255.2
		Type-5 AS External Link States
              
Link ID         ADV Router      Age         Seq#       Checksum Tag
0.0.0.0         10.255.255.2    1952        0x80003d68 0x2554 1
10.247.1.0      10.255.255.2    163         0x80000001 0xb34d 7
10.247.2.0      10.255.255.2    163         0x80000001 0xabd3 7
10.247.2.128    10.255.255.2    163         0x80000001 0xa658 7

! From OSPF router-id 10.255.255.1 (OSPF neighbor of OSPF router-id 10.255.255.2
O E1     10.247.1.0 255.255.255.0 [110/90] via ...			<=== Good
O E1     10.247.2.0 255.255.255.128 [110/90] via ...			<=== Good
O E1     10.247.2.128 255.255.255.128 [110/90] via ...			<=== Good

Routing entry for 10.247.2.0 255.255.255.128
  Known via "ospf 1", distance 110, metric 90
  Tag 7, type extern 1
  Last update from 198.18.255.18 on ec2, 0:25:08 ago
  Routing Descriptor Blocks:
  * 198.18.255.18, from 10.255.255.2, 0:25:08 ago, via ec2
      Route metric is 90, traffic share count is 1
      Route tag 7

Need help to understand the following: Why is prefix-list inside a policy-list under a policy-map working but it is unsupported to use the prefix-list directly under the policy-map?
Will this policy-list as a "(wo)man in the middle" be a proper solution or has a policy-list any negative impact inside OSPF?

OSPF Redistribution route-map with prefix-list not working after upgr