rvr

What you are experiencing is normal behavior for OSPF. Once an OSPF router generates an LSA for a subnet (as your ASAs are doing) then the LSA gets flooded to every router in the domain.

While it might seem logical to use distribute lists (or route maps) to filter the routes it turns out to not be very successful (as you experience). The reason for this is that distribute lists (and route maps) are filtering on route information. OSPF advertises LSAs (not routes) and then calculates routes based on the content of the Link State Data Base. So the distribute list can control the route information from OSPF that goes into the local routing table. But the LSA is still in the data base and will still be advertised to peers behind it because distribute lists can not control LSAs.

If you do not want the public networks in the routing table of your internal network would it be possible to just take out the network statement in OSPF on the ASA so that the ASA will not generate LSAs for these addresses?

Or if having the ASA not advertise the ISP ranges is not feasible there is another possibility to consider. You might configure 2 OSPF processes on each 3560. One process would include the interfaces toward the ASA and would process advertisements including the ISP ranges. The other process would include the interfaces to internal resources. You would need to redistribute between processes and in redistribution you have an opportunity to filter and could deny the ISP ranges in the redistribution.

HTH

Rick