Hi,

There few methods to deny certain network to float in routing protocol like Distribution list  and Route map implementation in routing protocol.

I would suggest as you want to deny only few subnet reaching to other site via ospf just go with distribution list configuration and apply that to ospf configuration to deny reaching to other site.

Configures a distribution list to explicitly deny specific routes from being eligible for installation in the IP route table. By default, all OSPF routes in the OSPF route table are eligible for installation in the IP route table.

NOTE: This feature does not block receipt of LSAs for the denied routes. The Routing Switch still receives the routes and installs them in the OSPF database. The feature only prevents the software from installing the denied OSPF routes into the IP route table.

To configure an OSPF distribution list:

Configure a standard or extended ACL that identifies the routes you want to deny. Using a standard ACL lets you deny routes based on the destination network, but does not filter based on the network mask. To also filter based on the destination network’s network mask, use an extended ACL.

Configure an OSPF distribution list that uses the ACL as input.

NOTE: If you change the ACL after you configure the OSPF distribution list, you must clear the IP route table to place the changed ACL into effect. To clear the IP route table, enter the clear ip route command at the Privileged EXEC level of the CLI.

EXAMPLE:
The following examples show how to use the CLI to configure an OSPF distribution list. Separate examples are provided for standard and extended ACLs.

The examples show named ACLs. However, you also can use a numbered ACL as input to the OSPF distribution list.

To use a standard ACL to configure an OSPF distribution list for denying specific routes, enter commands such as the following:

HP9300(config)# ip access-list standard no_ip
HP9300(config-std-nacl)# deny 4.0.0.0 0.255.255.255
HP9300(config-std-nacl)# permit any any
HP9300(config-std-nacl)# exit
HP9300(config)# router ospf
HP9300(config-ospf-router)# distribute-list no_ip in

The first three commands configure a standard ACL that denies routes to any 4.x.x.x destination network and allows all other routes for eligibility to be installed in the IP route table. The last three commands change the CLI to the OSPF configuration level and configure an OSPF distribution list that uses the ACL as input. The distribution list prevents routes to any 4.x.x.x destination network from entering the IP route table. The distribution list does not prevent the routes from entering the OSPF database.

To use an extended ACL to configure an OSPF distribution list for denying specific routes, enter commands such as the following:

HP9300(config)# ip access-list extended no_ip
HP9300(config-ext-nacl)# deny ip 4.0.0.0 0.255.255.255 255.255.0.0 0.0.255.255
HP9300(config-ext-nacl)# permit ip any any
HP9300(config-ext-nacl)# exit
HP9300(config)# router ospf
HP9300(config-ospf-router)# distribute-list no_ip in

The first three commands configure an extended ACL that denies routes to any 4.x.x.x destination network with a 255.255.0.0 network mask and allows all other routes for eligibility to be installed in the IP route table. The last three commands change the CLI to the OSPF configuration level and configure an OSPF distribution list that uses the ACL as input. The distribution list prevents routes to any 4.x.x.x destination network with network mask 255.255.0.0 from entering the IP route table. The distribution list does not prevent the routes from entering the OSPF database.

Hope that clear out your query !!

Regards

Ganesh.H

Hello Santo,

the simplest way to achieve what you want is to use network ... area commands instead of redistribute connected.

In this way, you can specify what IP subnets you want to advertise in OSPF.

router ospf

network 172.22.132.64 0.0.0.31 area 0

network 172.22.132.211 0.0.0.0 area 0

network 172.22.133.0 0.0.0.127 area 0

network 172.22.133.128 0.0.0.127 area 0

no red connected subnets

Note: you need a filter to avoid to import from EIGRP the routes that don't have to be sent to the FW.

so a route-map is needed, it may be already implemented in your route-map named DO_NOT_ADVERTISE

I would expect it to have the same aspect of route-map proposed by Jerry.

access-list 11 permit 172.22.134.0 0.0.0.31

access-list 11 permit 172.22.134.32 0.0.0.7

route-map DO_NOT_ADVERTISE deny 10

match ip address 11

route-map DO_NOT_ADVERTISE permit 20

!

a distribute-list can be used in OSPF only on receiving device so it should be configured on the FW itself.

It is not recommended for the link state nature of OSPF a distribute-list can be used inbound to decide what prefixes to install in local routing table but it does not influence LSA propagation. If FW speaks OSPF with somebody else it would pass the LSAs for prefixes blocked by distribute-list causing a routing black hole

Hope to help

Giuseppe