Hi,
I was doing something and found a problem regarding route filtering in OSPF. It seemed to me like this was a trivial thing but it turned out that is not.
I have a network with one central router, one backup router and remote locations routers connected through IPsec VPN to central and backup router. Primary and backup tunnel are differentiated with lower and higher OSPF costs on the tunnel. Everything works fine, all routes are propagating OK and there is no problem with that.
Here are networks in this example.
Central router
LAN: 10.168.1.0/24
Backup router
LAN: 10.168.105.0/24
Remoto location
LAN: 10.169.1.0/24
I have one static route on central router 10.0.0.0 255.0.0.0 10.168.1.107
What I wanted to do is to redistribute this route in the network as E1 type route and then filter routing tables on remote locations so that they have only this (default) 10.0.0.0 route in their routing tables. Remote locations are not communicating with each other, only with central and backup locations. So all the traffic from remote locations is going only to central or backup location.
Here are the routing tables, I will put only entries concerning this problem, because I have some loopback interfaces, VTI interfaces and so on. But basically everything is on the network 10.0.0.0.
Central router:
Gateway of last resort is not set
10.0.0.0/8 is variably subnetted, 13 subnets, 5 masks
S 10.0.0.0/8 [1/0] via 10.168.1.107
O 10.169.1.0/24 [110/51] via 10.168.211.6, 00:01:36, Tunnel20
C 10.168.1.0/24 is directly connected, FastEthernet0/0
O 10.168.105.0/24 [110/60] via 10.168.211.105, 04:07:12, Tunnel1
Backup router
Gateway of last resort is not set
10.0.0.0/8 is variably subnetted, 13 subnets, 5 masks
O E1 10.0.0.0/8 [110/71] via 10.168.211.1, 01:08:36, Tunnel0
O 10.169.1.0/24 [110/151] via 10.168.211.6, 01:01:55, Tunnel21
O 10.168.1.0/24 [110/51] via 10.168.211.1, 04:30:51, Tunnel0
C 10.168.105.0/24 is directly connected, FastEthernet0/0
Remote location
Gateway of last resort is not set
10.0.0.0/8 is variably subnetted, 10 subnets, 4 masks
O E1 10.0.0.0/8 [110/121] via 10.168.211.1, 00:00:08, Tunnel1
C 10.169.1.0/24 is directly connected, FastEthernet0/0
O 10.168.1.0/24 [110/101] via 10.168.211.1, 00:00:08, Tunnel1
O 10.168.105.0/24 [110/160] via 10.168.211.105, 00:00:03, Tunnel2
The problem is when I configure "distribute-list in" on local router permitting only network 10.0.0.0, all OSPF routes are blocked, althoug this route was previously in the table as it was posted above.
Here is the distribute list:
distribute-list DEFAULT_ROUTE in
ip access-list standard DEFAULT_ROUTE
permit 10.0.0.0
Remote location
Gateway of last resort is not set
10.0.0.0/8 is variably subnetted, 3 subnets, 3 masks
C 10.169.1.0/24 is directly connected, FastEthernet0/0
It took me a while and then I found out that i have to additonally permit route 10.168.1.0 (LAN of the central router) and then route 10.0.0.0 also appears. I tried permitting 10.0.0.0 0.255.255.255 in access list also and every other possible combination but, until I permit 10.168.1.0 this route will not appear in routing table of remot router.
ip access-list standard DEFAULT_ROUTE
permit 10.0.0.0
permit 10.168.1.0 0.0.0.255
Remote location
10.0.0.0/8 is variably subnetted, 5 subnets, 4 masks
O E1 10.0.0.0/8 [110/121] via 10.168.211.1, 00:00:03, Tunnel1
C 10.169.1.0/24 is directly connected, FastEthernet0/0
O 10.168.1.0/24 [110/101] via 10.168.211.1, 00:00:03, Tunnel1
Could someone explain me why is that? Is it because originally this static route is on central router pointing to host in that network (10.0.0.0 255.0.0.0 10.168.1.107) and that has to something with that? It seems to me that this has no sense, but maybe I am missing something.
Thanks.
