-
Products
-
SonicPlatform
SonicPlatform is the cybersecurity platform purpose-built for MSPs, making managing complex security environments among multiple tenants easy and streamlined.
Discover More
-
-
Solutions
-
Federal
Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn MoreFederalProtect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn More - Industries
- Use Cases
-
-
Partners
-
Partner Portal
Access to deal registration, MDF, sales and marketing tools, training and more
Learn MorePartner PortalAccess to deal registration, MDF, sales and marketing tools, training and more
Learn More - SonicWall Partners
- Partner Resources
-
-
Support
-
Support Portal
Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn MoreSupport PortalFind answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn More - Support
- Resources
- Capture Labs
-
- Company
- Contact Us
How to filter incoming OSPF routes
03/26/2020 
26 People found this article helpful
486,355 Views
Description
This document explains the steps to filter out incoming OSPF routes from appearing in the Routing table of Dell SonicWall Security Appliance.
Scenario:
Two Dell SonicWall Security Appliances TZ 210 (5.9.1.5) and TZ215 (5.9.1.1) are being used to demonstrate OSPF route filtering.
Resolution
In this example, 10.10.11.0/24 and 10.10.21.0/24 networks will be filtered from routing table using Distribute-list and access rules OSPF CLI commands from TZ 210:
Login to the CLI via SSH or Console and type the admin username and password.
admin@TZ210@5-9-1-5> configure terminal
config(TZ210@5-9-1-5)# routing
(config-routing)# nsm
ZebOS version 7.7.0 IPIRouter 7/2009
ARS NSM>show ip route
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default
O E2 10.10.11.0/24 [110/20] via 10.71.252.14, X1, 00:02:03
O E2 10.10.21.0/24 [110/20] via 10.71.252.14, X1, 00:02:03
C 10.71.252.0/24 is directly connected, X1
O E2 10.200.200.0/24 [110/20] via 10.71.252.14, X1, 00:02:03
C 127.0.0.0/8 is directly connected, lo0
C 172.19.125.0/24 is directly connected, X0
ARS NSM>exit
(config-routing)#
Enter to OSPF CLI configuration:
(config-routing)# ospf
ZebOS version 7.7.0 IPIRouter 7/2009
Create named access list as Filter-Routes-in and add the following deny statements:
ARS OSPF>configure terminal
ARS OSPF(config)>access-list Filter-Routes-In deny 10.10.11.0/24
ARS OSPF(config)>access-list Filter-Routes-In deny 10.10.21.0/24
ARS OSPF(config)>access-list Filter-Routes-In permit any
ARS OSPF(config)>exit
To view the access list created above:
ARS OSPF>show access-list
ZebOS IP access list Filter-Routes-In
deny 10.10.11.0/24
deny 10.10.21.0/24
Apply the access list with distribute-list command by navigating to the OSPF process.
ARS OSPF>configure terminal
ARS OSPF(config)>router ospf
ARS OSPF(config-router)>distribute-list Filter-Routes-In in
Verify the configuration with show ip ospf route command on TZ210:
ARS OSPF(config-router)>exit
ARS OSPF(config)>exit
ARS OSPF>show ip ospf route
C 10.71.252.0/24 [1] is directly connected, X1, Area 0.0.0.0
C 172.19.125.0/24 [1] is directly connected, X0, Area 0.0.0.10
To save the above configuration:
ARS OSPF>write
Configuration saved to OSPF
ARS OSPF>
To enable the routes back in the routing table:
ARS OSPF(config)>router ospf
ARS OSPF(config-router)>no distribute-list Filter-Routes-In in
ARS OSPF(config-router)>exit
ARS OSPF(config)>exit
ARS OSPF>show ip ospf route
E2 10.10.11.0/24 [1/20] via 10.71.252.14, X1
E2 10.10.21.0/24 [1/20] via 10.71.252.14, X1
C 10.71.252.0/24 [1] is directly connected, X1, Area 0.0.0.0
E2 10.200.200.0/24 [1/20] via 10.71.252.14, X1
C 172.19.125.0/24 [1] is directly connected, X0, Area 0.0.0.10
ARS OSPF>
Related Articles
- How to Block Google QUIC Protocol on SonicOSX 7.0?
- How to block certain Keywords on SonicOSX 7.0?
- How internal Interfaces can obtain Global IPv6 Addresses using DHCPv6 Prefix Delegation
Categories
- Firewalls > TZ Series
- Firewalls > SonicWall SuperMassive E10000 Series
- Firewalls > SonicWall SuperMassive 9000 Series
- Firewalls > SonicWall NSA Series
YES
NO