Split-Horizon - DMVPN with OSPF

[Ronit Bhattacharjee]

Hi. I deployed a simple DMVPN setup with 1 Hub and 2 Spokes. I am running OSPF. Looks like, unlike EIGRP, OSPF doesn't use split-horizon to prevent Spoke routes from being advertised to other spokes. 

What is the most straight-forward way to prevent Spokes from learning routes from other spokes?

[MHM Cisco World]

Yes ospf not like eigrp in dmvpn.

Can you run two tunnel in hub one for each spoke ?

[Ronit Bhattacharjee]

Thanks, unfortunately I already deployed the setup and would like to avoid major changes as much as possible, as remote access is very tricky to arrange and stopping the spoke-to-spoke communication is low priority.

Also, there would be more spokes added in the future and the requirement is not to have to make any changes on the Hub to accommodate them.

[MHM Cisco World]

The issue you have one tunnel i.e. you run one area between spoke and hub'

And for ospf all routers in one area have same DB so each spoke have same db'

That why spoke know prefix directly from other spoks not via hub.

Let me check if there is othet solution 

[Ronit Bhattacharjee]

You're right. There's no way to prevent spoke-to-spoke communication at the routing level while using OSPF. We can use access-lists everywhere to block this traffic, but doesn't look like a good solution.

We discussed this internally and decided to go through the one-time pain of migrating to EIGRP to reach our design requirements. 

[MHM Cisco World]

That why Cisco always recommends eigrp or bgp(not for all case) for dmvpn.

The ospf have many limitations in dmvpn

[Ronit Bhattacharjee]

Actually I referred to this document during my original design and got misled by this line

Dynamic Multipoint VPN Configuration Guide, Cisco IOS Release 15M&T - Dynamic Multipoint VPN [Support] - Cisco
"Enhanced Interior Gateway Routing Protocol (EIGRP) should be avoided"

[MHM Cisco World]

EIGRP avoiding only for VRF aware (this I will make deep dive to full understand why)
but I your case as I see from topology there is no F-VRF (vrf aware).

[David Ruess]

Hello,

Only the interfaces connecting to the HUB have to be in the same area. All interfaces behind that can be in another area.

That being said you can utilize the area-range command to help with that

The link is similar to route setup:

https://study-ccnp.com/ospf-route-filtering-summarization-area-local-ospf/

You might also be able to turn those areas behind the spoke routers into stub areas where only a default route is advertised to them instead of the specific routes.

-David