ASA and OSPF - Denying one IP in an allowed range.

[sonya.rowland]

I need to add a new statement to our OSPF redistribuition access list. We have a vendor that has asked us to allow an entire /24 for their servers. However, we found out that one of the IPs in that range is for one of their ftp servers. I need to have that server enter our network on a different Internet pipe. (We have two paths in).

So if I write (and this is just an example without the real public addresses):

access-list (access list name) standard permit 10.10.10.0 255.255.255.0

access-list (access list name) standard deny host 10.10.10.20

Will this stop the 10.10.10.20 from being redistributed into the OSPF that the LAN learns?

We need the 10.10.10.20 to traverse a different internet path in to our network. The traffic needs to stay synchronous.

Thanks.

[Marcel Maeder]

Is the network 10.10.10.0/24 directly connected to the ASA or statically routed?

The way access-lists work you'd have to enter the deny before the permit. But in OSPF you can't exclude single IPs beause the LSA contains whole networks. So no.

The easiest way woud be to statically route 10.10.10.20 on the other device to the right destination.

[sonya.rowland]

Thanks!