Route Filtering With OSPF

CCIE Security V4 Technology Labs Section 1:
System Hardening and Availability
Route Filtering with OSPF

Last updated: May 10, 2013
Task
Load the task configuration files for R1, R2, R3, and SW1.
When the files are loaded, ensure that each router is seeing OSPF routes.
On R1, ensure that you do not receive RFC1918 routes via OSPF from R3. Use a distribute list for
this.
Ensure that your own network is never advertised by OSPF into R3 from R1. Use a prefix list for this.
Ensure that you do not accept OSPF routes for the following networks:
0.0.0.0/8
127.0.0.0/8
169.254.0.0/16
192.0.2.0/24
198.18.0.0/15
224.0.0.0/4
255.255.255.255/32
Explanation and Verification

Multiple methods can be used when filtering with OSPF.
Verify OSPF Routes

Check each router to ensure that it has OSPF routes. Note that R1 has 10.0.0.0 and 10.1.0.0 in its
routing table. These will be filtered in the next task.
R1:
R1#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+ - replicated route, % - next hop override
Gateway of last resort is not set
10.0.0.0/24 is subnetted, 2 subnets
O
10.0.0.0 [110/2] via 136.1.13.3, 00:38:05, GigabitEthernet0/0

19.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
19.0.0.0/8 is directly connected, Loopback12

136.1.13.0/24 is directly connected, GigabitEthernet0/0
136.1.23.0/24 [110/2] via 136.1.13.3, 00:38:05, GigabitEthernet0/0




R1#
R3:
R3#sh ip route
C
10.0.0.0/24 is directly connected, FastEthernet0/0.10
19.0.0.0/8 [110/2] via 136.1.13.1, 00:39:44, FastEthernet0/0.13


146.77.77.0 [110/2] via 136.1.13.1, 00:39:44, FastEthernet0/0.13


R3#
R2:
R2#sh ip route
o - ODR, P - periodic downloaded static route, + - replicated route
O




R2#
SW1:
SW1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
o - ODR, P - periodic downloaded static route
O
136.1.13.0 [110/2] via 136.1.23.3, 00:40:58, Vlan23
136.1.25.0 is directly connected, Loopback11
136.1.23.0 is directly connected, Vlan23
136.1.99.0 [120/2] via 136.1.23.3, 00:00:21, Vlan23
19.0.0.0/8 [110/3] via 136.1.23.3, 00:40:58, Vlan23

10.0.0.0 [110/2] via 136.1.23.3, 00:40:59, Vlan23
10.1.0.0 [110/2] via 136.1.23.3, 00:40:59, Vlan23

176.14.23.0 [110/3] via 136.1.23.3, 00:41:00, Vlan23
209.85.22.0/24 [110/3] via 136.1.23.3, 00:41:00, Vlan23

146.77.77.0 [110/3] via 136.1.23.3, 00:41:00, Vlan23

150.1.2.0 [110/2] via 136.1.23.2, 00:41:00, Vlan23
150.1.1.0 [120/2] via 136.1.23.3, 00:00:22, Vlan23
SW1#
Filter RFC1918 Routes from Being Sent by R3

You are asked to filter routes using a distribute list in OSPF. Start by creating the ACL and
applying it inbound on G0/0.
R1:
R1#
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#access-list 19 deny
10.0.0.0 0.255.255.255
172.16.0.0 0.15.255.255
192.168.0.0 0.0.255.255
R1(config)#access-l 19 permit any

R1(config)#
R1(config)#router ospf 1
R1(config-router)#distribute-list 19 in G0/0
R1(config-router)#
R1(config-router)#
R1(config-router)#end
R1#
R1#
Verify that the 10.0.0.0 and 10.1.0.0 routes are gone. In this case, they still appear in the routing
table, and that's fine. The task is specific. It requires the routes from OSPF to be filtered, not the
routes from RIP.
R1#sh ip route
R






R1#
Use a Prefix List to Filter Routes on R1
You are required to configure a pre-fix list to filter your own network from being advertised into R3
from R1. If you look at the routing table on R3, you can see a 136.1.99.0/24 route.
R3#sh ip route
C

O IA



On R1, create the prefix list to match the required traffic.
R1(config)#ip prefix-list MY_NETS deny 136.1.0.0/16 le 24

R1(config)#ip prefix-list MY_NETS permit 0.0.0.0/0 le 32
R1(config)#
R1(config-router)#area 1 filter-list prefix MY_NETS out
R1(config-router)#
R1(config-router)#exit
R1(config)#end
Verify that the 136.1.99.0 prefix is no longer in the routing table on R3.
R3#sh ip route
C




R3#
Do Not Accept OSPF Routes for the Specified Networks

For this task, we switch back to distribute lists. This is because we can't use a prefix list to filter
these routes, because they are not type 3 LSAs (which is specific to this example). Also, the
requirement states not to "accept" routes, which means it would not be an outbound filter on R1, so
it must be an inbound filter on R3.
R3:
R3#
R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#
R3(config)#
ip 0.0.0.0 0.255.255.255 any
ip 127.0.0.0 0.255.255.255 any
ip 169.254.0.0 0.0.255.255 any
ip 192.0.2.0 0.0.0.255 any
ip 198.18.0.0 0.1.255.255 any
ip 224.0.0.0 15.255.255.255 any
ip host 255.255.255.255 any
ip 136.1.0.0 0.0.255.255 any
R3(config)#access-list 136 permit ip any any

R3(config)#
R3(config)#router ospf 1
R3(config-router)#distribute-list 136 in f0/0.13
R3(config-router)#end
R3#
Now ensure that the matching routes are no longer seen in OSPF.
R3#sh ip route
C


R3#

Route Filtering With OSPF

Transféré par

Informations du document

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

Route Filtering With OSPF

Transféré par

Droits d'auteur :

Formats disponibles

CCIE Security V4 Technology Labs Section 1:

System Hardening and Availability

Route Filtering with OSPF

Explanation and Verification

Verify OSPF Routes

10.0.0.0 [110/2] via 136.1.13.3, 00:38:05, GigabitEthernet0/0

10.1.0.0 [110/2] via 136.1.13.3, 00:38:05, GigabitEthernet0/0

19.0.0.0/8 is directly connected, Loopback12

19.0.0.1/32 is directly connected, Loopback12

136.1.13.0/24 is directly connected, GigabitEthernet0/0

136.1.13.1/32 is directly connected, GigabitEthernet0/0

136.1.23.0/24 [110/2] via 136.1.13.3, 00:38:05, GigabitEthernet0/0

136.1.24.0/24 [110/3] via 136.1.13.3, 00:38:05, GigabitEthernet0/0

136.1.25.0/24 [110/3] via 136.1.13.3, 00:38:05, GigabitEthernet0/0

136.1.26.0/24 [110/3] via 136.1.13.3, 00:38:05, GigabitEthernet0/0

136.1.27.0/24 [110/3] via 136.1.13.3, 00:38:05, GigabitEthernet0/0

136.1.28.0/24 [110/3] via 136.1.13.3, 00:38:05, GigabitEthernet0/0

136.1.99.0/24 is directly connected, Loopback99

136.1.99.1/32 is directly connected, Loopback99

146.77.77.0/24 is directly connected, Loopback13

146.77.77.1/32 is directly connected, Loopback13

150.1.1.0/24 is directly connected, Loopback0

150.1.1.1/32 is directly connected, Loopback0

150.1.2.0/24 [110/3] via 136.1.13.3, 00:38:05, GigabitEthernet0/0

176.14.23.0/24 is directly connected, Loopback11

176.14.23.1/32 is directly connected, Loopback11

209.85.22.0/24 is directly connected, Loopback10

209.85.22.1/32 is directly connected, Loopback10

10.0.0.0/24 is directly connected, FastEthernet0/0.10

10.0.0.3/32 is directly connected, FastEthernet0/0.10

10.1.0.0/24 is directly connected, FastEthernet0/0.11

10.1.0.3/32 is directly connected, FastEthernet0/0.11

19.0.0.0/8 [110/2] via 136.1.13.1, 00:39:44, FastEthernet0/0.13

136.1.13.0/24 is directly connected, FastEthernet0/0.13

136.1.13.3/32 is directly connected, FastEthernet0/0.13

136.1.23.0/24 is directly connected, FastEthernet0/0.23

136.1.23.3/32 is directly connected, FastEthernet0/0.23

136.1.24.0/24 [110/2] via 136.1.23.20, 00:39:44, FastEthernet0/0.23

136.1.25.0/24 [110/2] via 136.1.23.20, 00:39:44, FastEthernet0/0.23

136.1.26.0/24 [110/2] via 136.1.23.20, 00:39:44, FastEthernet0/0.23

136.1.27.0/24 [110/2] via 136.1.23.20, 00:39:44, FastEthernet0/0.23

136.1.28.0/24 [110/2] via 136.1.23.20, 00:39:44, FastEthernet0/0.23

136.1.99.0/24 [120/1] via 136.1.13.1, 00:00:04, FastEthernet0/0.13

146.77.77.0 [110/2] via 136.1.13.1, 00:39:44, FastEthernet0/0.13

150.1.1.0 [120/1] via 136.1.13.1, 00:00:04, FastEthernet0/0.13

150.1.2.0 [110/2] via 136.1.23.2, 00:39:44, FastEthernet0/0.23

176.14.23.0 [110/2] via 136.1.13.1, 00:39:44, FastEthernet0/0.13

209.85.22.0/24 [110/2] via 136.1.13.1, 00:39:44, FastEthernet0/0.13

10.0.0.0 [110/2] via 136.1.23.3, 00:40:45, GigabitEthernet0/0

10.1.0.0 [110/2] via 136.1.23.3, 00:40:45, GigabitEthernet0/0

19.0.0.0/8 [110/3] via 136.1.23.3, 00:40:45, GigabitEthernet0/0

136.1.13.0/24 [110/2] via 136.1.23.3, 00:40:45, GigabitEthernet0/0

136.1.23.0/24 is directly connected, GigabitEthernet0/0

136.1.23.2/32 is directly connected, GigabitEthernet0/0

136.1.24.0/24 [110/2] via 136.1.23.20, 00:40:45, GigabitEthernet0/0

136.1.25.0/24 [110/2] via 136.1.23.20, 00:40:45, GigabitEthernet0/0

136.1.26.0/24 [110/2] via 136.1.23.20, 00:40:45, GigabitEthernet0/0

136.1.27.0/24 [110/2] via 136.1.23.20, 00:40:45, GigabitEthernet0/0

136.1.28.0/24 [110/2] via 136.1.23.20, 00:40:45, GigabitEthernet0/0

136.1.99.0/24 [120/2] via 136.1.23.3, 00:00:24, GigabitEthernet0/0

146.77.77.0 [110/3] via 136.1.23.3, 00:40:46, GigabitEthernet0/0

150.1.1.0/24 [120/2] via 136.1.23.3, 00:00:24, GigabitEthernet0/0

150.1.2.0/24 is directly connected, Loopback0

150.1.2.2/32 is directly connected, Loopback0