OSPF Route Filtering - Networking Essentials

Route Filtering at a Glance

The most important question is not “Which command do I know?” It is “Where should this route be stopped?” The answer tells you which tool to use.

Same-area topologyKeep the LSDB consistent

Between areasFilter Type 3 on an ABR

Entering OSPFFilter at redistribution

One router onlyFilter local installation

Core rule: OSPF routers in the same area must describe the same topology. Normal route policy therefore works at an area boundary, at redistribution, or during local route installation.

1. Read the Filtering Lab

R1 advertises two loopbacks from Area 10. R2 is the Area Border Router (ABR). R3 is in Area 0 and learns both prefixes as inter-area routes. Our first goal is to stop only 10.10.10.0/24 from leaving Area 10.

Area 10

R1Internal router10.10.10.0/2410.10.20.0/24

Type 3 boundary

R2 · ABRApply the area filter here

Deny 10.10.10.0/24
Permit other prefixes

Area 0

R3Receiving router10.10.20.0/24 ✓10.10.10.0/24 ✕

The filter changes the Type 3 information that R2 advertises out of Area 10. R1 and R2 still keep a complete Area 10 LSDB.

Expected before the filter: R3 has two O IA routes.
Expected after the filter: R3 loses only 10.10.10.0/24.
Neighbor impact: OSPF adjacencies remain Full because the filter does not break the area topology.

2. Choose the Correct Filtering Point

Start with the desired result. The same prefix list can support several tools, but the tools change different parts of OSPF.

Your goal	Best location	Tool	What changes
Stop an inter-area prefix	ABR	`area filter-list prefix`	Type 3 advertisement
Keep a route out of one router's table	Receiving router	`distribute-list ... in`	Local route installation only
Stop a static or BGP route entering OSPF	ASBR	Route map on redistribution	External LSA origination
Hide specific routes behind an aggregate	ABR or ASBR	`area range` or `summary-address`	Advertised level of detail

Do not begin with the command: First identify the route type with show ip route ospf. An O IA route and an O E2 route enter OSPF at different points and need different controls.

3. Capture a Clean Baseline

Prove the network works before adding policy. This separates a filtering mistake from an addressing, area, or neighbor problem.

Check the adjacency

R2# show ip ospf neighbor

Neighbor ID     State     Interface
3.3.3.3         FULL/DR   GigabitEthernet0/1

Confirm both routes on R3

R3# show ip route ospf

O IA 10.10.10.0/24 via 10.0.23.2
O IA 10.10.20.0/24 via 10.0.23.2

Confirm R2 and R3 are neighbors.
Confirm R3 learns both routes as O IA.
Test reachability to both loopbacks and save the output.

4. Filter an Inter-Area Route on the ABR

Create a prefix list on R2. The first line denies the one prefix we want to stop. The second line is essential because a prefix list has an implicit deny at the end.

Step 1 · Define the prefixes

R2(config)# ip prefix-list AREA10-OUT seq 5 deny 10.10.10.0/24
R2(config)# ip prefix-list AREA10-OUT seq 10 permit 0.0.0.0/0 le 32

Step 2 · Apply at Area 10

R2(config)# router ospf 1
R2(config-router)# area 10 filter-list prefix AREA10-OUT out

out means from Area 10: R2 blocks matching Type 3 information as it advertises Area 10 routes toward other areas.
Inside Area 10: The local Type 1 topology information remains available.
Common mistake: Omitting the permit line blocks every other prefix too.

Direction shortcut: out filters routes coming from the named area. in filters routes being advertised into the named area.

5. Filter Route Installation on One Router

Sometimes only one router must avoid installing a route. An inbound distribute list can do that without removing the LSA from the OSPF database.

Apply a local install filter

R3(config)# ip prefix-list NO-LOCAL-IN seq 5 deny 10.10.10.0/24
R3(config)# ip prefix-list NO-LOCAL-IN seq 10 permit 0.0.0.0/0 le 32
R3(config)# router ospf 1
R3(config-router)# distribute-list prefix NO-LOCAL-IN in

Prove the difference

R3# show ip ospf database summary 10.10.10.0
Summary Net Link States
  Link State ID: 10.10.10.0

R3# show ip route 10.10.10.0
% Network not in table

Key learning point: The LSA can remain in the LSDB while the route is absent from the routing table. Always check both tables before deciding that an advertisement was filtered.

6. Control External Routes Before They Enter OSPF

If R1 redistributes static routes, R1 is an Autonomous System Boundary Router (ASBR). Filter at redistribution so unwanted external LSAs are never created.

Build the redistribution policy

R1(config)# ip prefix-list STATIC-TO-OSPF seq 5 permit 172.16.50.0/24
R1(config)# route-map STATIC-TO-OSPF permit 10
R1(config-route-map)# match ip address prefix-list STATIC-TO-OSPF

Apply the route map

R1(config)# router ospf 1
R1(config-router)# redistribute static subnets route-map STATIC-TO-OSPF

R1# show ip ospf database external

Only prefixes permitted by the route map become OSPF external routes.
A route not permitted by the route map remains in the source routing table but is not injected into OSPF.
Use explicit policy during redistribution. Accidentally importing a large route table can create a serious outage.

7. Use Summarization When the Address Plan Supports It

Summarization is not a deny filter, but it reduces route detail. Use it only when the component networks form a clean, continuous block and the summarizing router can reach them correctly.

Summarize inter-area routes

R2(config)# router ospf 1
R2(config-router)# area 10 range 10.10.0.0 255.255.0.0

Expected route on R3

R3# show ip route ospf
O IA 10.10.0.0/16 via 10.0.23.2

R2# show ip route 10.10.0.0
O    10.10.0.0/16 is a summary, Null0

Avoid a black hole: Do not advertise a summary for addresses that the ABR cannot actually reach. Test every important component prefix and its return path.

8. Verify and Troubleshoot the Result

Move from control plane to data plane. First check the policy, then the LSDB, then the route table, and finally real traffic.

1

Read the policy

Check sequence order, exact prefix length, and the final permit statement.

2

Inspect the LSDB

Decide whether the Type 3 or Type 5 LSA still exists.

3

Inspect routes

Check whether the route was installed and which next hop it uses.

4

Test forwarding

Test one denied prefix, one permitted prefix, and the return path.

Check policy and advertisements

show ip prefix-list
show ip ospf database summary
show ip ospf database external

Check routes and forwarding

show ip route ospf
show ip route 10.10.10.0
ping 10.10.10.1 source 3.3.3.3
traceroute 10.10.20.1

What you see	Likely meaning	Next check
LSA absent and route absent	Advertisement or origination was filtered	ABR/ASBR policy and direction
LSA present but route absent	Local installation was filtered, or a better route exists	Distribute list and routing table
All routes disappear	Implicit deny matched everything	Final prefix-list permit entry
Route exists but ping fails	Forwarding or return-path problem	Next hop, ACLs, and reverse route

9. Guided Practice Lab

Complete one task at a time. Save the before-and-after output so you can explain the result rather than only repeat the commands.

Task 1: Filter One Inter-Area Prefix

Build the three-router topology shown above.
Advertise two R1 loopbacks in Area 10.
Confirm R3 learns both as O IA.
Apply AREA10-OUT on R2.
Prove only 10.10.10.0/24 disappears from R3.

Expected result: The neighbor stays Full, the permitted route remains usable, and the denied Type 3 route is absent from Area 0.

Task 2: Compare LSDB and Route-Table Filtering

Remove the ABR filter and restore both routes.
Apply the inbound distribute list on R3.
Check the summary LSA on R3.
Check R3's route table for the same prefix.
Explain why the two results differ.

Expected result: The summary LSA remains visible, but the matching route is not installed locally.

Task 3: Control Redistribution Safely

Create two static routes on R1 in an isolated lab.
Permit only one route in STATIC-TO-OSPF.
Redistribute static routes with the route map.
Inspect external LSAs on R1 and R3.
Test the permitted and denied destinations.

Expected result: Only the permitted static prefix appears as an external OSPF route.

10. Frequently Asked Questions

Can I filter Type 1 and Type 2 LSAs between routers in the same area?

Not as a normal route-policy design. Routers in one area need a consistent topology database. Place policy at an area boundary, during redistribution, or during local route installation.

What is the difference between an area filter and a distribute list?

An area prefix filter on an ABR controls Type 3 advertisements between areas. An inbound distribute list controls whether a router installs a route locally; the underlying LSA may remain in its LSDB.

Why did my prefix list block every route?

Prefix lists end with an implicit deny. After a specific deny entry, add an explicit permit for the remaining prefixes when that matches your policy.

Does route filtering reset OSPF neighbors?

A correctly applied route policy should not reset a healthy adjacency. If neighbors drop, check area settings, timers, authentication, network type, MTU, and interface state separately.

How do I prove where a route was filtered?

Check the source route, the originating LSA, the receiving LSDB, and the receiving routing table in that order. The first point where the prefix disappears identifies the policy stage to inspect.

OSPF Route Filtering: Control the Right Route in the Right Place