OSPF distribute-list with different netmasks

Oct 06, 2006 6 Replies
G

Hello, We need to filter a single route in the OSPF advertisements from a router to another. I tested distribute-list and it works fine, but we have the following problem:



Suppose we have following routes advertised via OSPF:


192.168.1.0/24
192.168.1.0/26

How can we filter only 192.168.1.0/24 and allow the advertisement of



192.168.1.0/26? The following configuration blocks both routes:

access list 10 deny 192.168.1.0 0.0.0.255 router ospf 20 distribute-list 10 in



We tested with



access list 10 deny 192.168.1.0 0.0.0.0 access list 10 deny 192.168.1.0



but the result is the same. Any help will be appreciated. Thank you.



Regards,



German



Vote
Twitter Facebook LinkedIn
D

How about changing the access list to: access-list 10 permit 192.168.1.0 0.0.0.63 access-list 10 deny 192.168.1.0 0.0.0.255

Doan

Vote
Twitter Facebook LinkedIn
G

Thank you, Doan. I tested your suggestion, but in this case it is allowing both networks 192.168.1.0/26 and 192.168.1.0/24.

It seems that distribute-list checks only the network part of the route (not the netmask) and compares it to the ACL. In this case the "access-list 10 permit 192.168.1.0 0.0.0.63" is matching both networks...

Is there any other way to filter this specific route (using route-maps, etc.)? Thanks!!

Vote
Twitter Facebook LinkedIn
D

Did you configure "ip classless" on your routers?

Doan

Vote
Twitter Facebook LinkedIn
J

Try looking into using prefix lists.

Vote
Twitter Facebook LinkedIn
G

John, I tested with prefix-lists and it is working now. The config is the following:

router ospf 20 distribute-list prefix FILTER in ! ip prefix-list FILTER seq 10 deny 192.168.1.0/24 ip prefix-list FILTER seq 20 permit 0.0.0.0/0 le 32

The second prefix-list line allows all other routes, including

192.168.1.0/26.

Thank you very much!

Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required