Blocking an OSPF Peer

believewireless · Fri Feb 16, 2007 7:51 pm

How do we block an OSPF peer?

Here is our setup:

    --------------Switch---------------
    |                |                |
Mikrotik 1       Mikrotik 2        Mikrotik 3

We want 1 to be peered with 2 and 2 to be peered with 3. However, we don't want 1 to see 3 which is what is happening.

Any idea how we can block this since all the interfaces are connected to the same switch?

tneumann · Fri Feb 16, 2007 9:10 pm

You could install firewall filters in the input chain of router-1 and router-3 where the filters on router-1 would block traffic with a source IP of router-3 and protocol=ospf (Protocol 89) and the filters on router-3 would block packets with a source IP of router-1 and protocol=ospf.

Whether it is a good idea to mess with the topology mechanisms of OSPF in such a way you'd have to decide for yourself. What is your intention behind this?

--Tom

janisk · Mon Feb 19, 2007 10:56 am

MT1 still will be able to connect to MT3 because MT2 will anounce MT3 network to MT1 if you set redistribute connected

dritoni · Mon Feb 19, 2007 11:41 am

if mt supports it you can set ospf cost or priority i don`t remember which one it is to 0

tneumann · Mon Feb 19, 2007 1:12 pm

if mt supports it you can set ospf cost or priority i don`t remember which one it is to 0

That does only prohibit an OSPF router from becoming DR for a broadcast domain.

--Tom

tneumann · Mon Feb 19, 2007 1:18 pm

MT1 still will be able to connect to MT3 because MT2 will anounce MT3 network to MT1 if you set redistribute connected

In the sense they they will be able to pass traffic between each other, yes, sure (if that would be the issue then thats what firewall filters are for). But they will not form an OSPF adjacency, which I believe is what the original question was about. Or maybe not.

janisk · Mon Feb 19, 2007 2:51 pm

as routers are connected to one switch i do not see a difference. they will have connection but yes, they wont negiotiate with each other.

tneumann · Mon Feb 19, 2007 3:25 pm

janisk, you're right. As I wrote in my first reply I find believewireless' question rather strange and fail to see the point behind what he's trying to do. Maybe he'll enlighten us.

--Tom

Blocking an OSPF Peer

Blocking an OSPF Peer

Who is online