Cisco ASA OSPF filtering inbound routes

[Roman Mamontov]

Hello, folks.

How filter inbound routes in Cisco ASA OSPF? Because Cisco ASA has no "distibute-list" command for OSFP process configuration, I try to use "filter-list" command in area definition. So, I try to use next configuration:

R1 (Cisco 3660):

skip

!

router ospf 1

log-adjacency-changes

redistribute static subnets

network 10.10.10.0 0.0.0.255 area 0

network 192.168.90.0 0.0.0.127 area 0

distribute-list 1 in

!

Cisco ASA (Version 8.4(2)

skip

!
router ospf 1
network 192.168.90.0 255.255.255.128 area 0
network 192.168.90.128 255.255.255.128 area 0
area 0 filter-list prefix in_filter in
log-adj-changes
redistribute connected route-map redist_connected
redistribute static subnets route-map redist_static
!

prefix-list filter_in seq 5 permit 172.48.21.0/24
prefix-list filter_in seq 10 deny 10.10.10.0/24
!

But whatever I see 10.10.10.0/24 routes in Cisco ASA:

ciscoasa# sh route | in 10.10.10.0

O    10.10.10.0 255.255.255.0 [110/11] via 192.168.90.1, 0:08:38, outside

ciscoasa#

Any ideas how filter any inbound routes except some?

[Giuseppe Larosa]

Hello Roman,

the area filter-list command works only on an OSPF ABR between different OSPF areas.

In your case it does not work because both devices are in area 0.

I'm afraid that if distribute-list is not supported there are no other options available, and you can only override with static routing.

That is you can use a static route to null0 as a way to override the unwanted OSPF routes.

Edit:

the static routes may point to a more appropriate interface then null0 as the purpose is to override the routes learned by OSPF.

Hope to help

Giuseppe

[Roman Mamontov]

Thanks for reply, Giuseppe.

Yes, I can override OSPF routes with static routes, but I don't know in good time which routes will be announced to me from remote side.