IGP – Protocol Independent Route Filtering

When most network engineer think of route filtering, they automatically assume that some kind of distribute list is required. However, it is important to think outside the box and consider all possible options before implementing a route filtering policy. Recall that in Cisco IOS software, administrative distance is used to determine the reliability of one source of routing information from another and is a locally significant value.

Different route sources are assigned different administrative distance values. This default value in an integer between 0 and 255, with a value of 0 assigned to the most reliable source of information and a value of 255 being assigned to the least reliable source of information. Routes that are assigned an administrative distance value of 255 are considered untrusted and will not be placed into the routing table. This effectively means that if a route is assigned a default administrative distance value of 255, the route will not be installed into the routing table. With static routes, the administrative distance value can be specified using the ip route global configuration command. For dynamic routes, the distance [admin distance] [address] [wildcard-mask] [ip-standard-acl | ip-extended-acl | access-list-name] router configuration command can be used to adjust the default administrative distance value of dynamically received routes, effectively allowing routes to be filtered.

The [admin distance] is used to specify the administrative distance for the route or routes. The [address]specifies the network address the routes are learned from. This can be used with or without the [wildcard-mask]. The command can also be used with named and numbered standard or extended ACLs for more granular filtering. To demonstrate the use of this command, consider the network illustrated in Figure 4-5:

Fig. 4-5. Filtering Routes Using Administrative Distance

Figure 4-5 illustrates a basic EIGRP network. R2 is advertising several 172.16 prefixes to router R3. Assuming that EIGRP has been correctly configured between the two routers, the routing table on R3 shows the following route entries:

If you wanted to filter all routes R3 is receiving form R2, you would perform the following:

Because routes with an administrative distance value will not be installed into the IP routing table, the routes are effectively filtered as shown in the following output:

In addition, the entries are also not present in the EIGRP Topology Table as shown below:

With OSPF, however, it is important to remember that even though the routes are not installed into the routing table the LSAs are still received and are present in the LSDB. Assuming that OSPF was the routing protocol in Figure 4-5, R3 would show the route entries as follows:

The same configuration could then be applied to filter all routes received from R2 as is follows:

Using the show ip route command, we can verify that the routes are no longer in the RIB:

However, the Summary LSAs for the routes are still present in the LSDB:

It is important to understand that the distance command provides far more granularity than has been illustrated in this section. For example, the command could be used to specify filter only specific routes from a specific router. As an example, assume that there were other routers on the LAN illustrated in Figure 4-5 and you were requested to filter the even subnets, i.e. 172.16.0.0/24, 172.16.2.0/24, and 172.16.4.0/24, advertised only by R2 to R3. To accomplish this task, the following configuration would be implemented on R3:

Following this configuration, the routing table on R3 would show the following route entries:

When filtering routes from OSPF, you must specify the router ID and not the interface address. For example, assume that the same configuration was applied to OSPF as illustrated below:

Even though the configuration above instructs the router to set the administrative distance of routes received from 150.1.1.2 to 255, the routing table would still reflect the following entries:

Because the router ID has not been specified for OSPF, the routes are not filtered. In order to filter the routes, the router ID printed in the output of the show ip ospf neighbor command must be used. From R3, this command shows the following:

The distance configuration must therefore be modified as follows:

After implementing this configuration, the routing table on R3 shows the following entries: