Redistribution and route manipulation
Requirement / business driver
Exchange routes between protocols or domains (mergers, migrations, multi-protocol cores) without creating loops or suboptimal routing.
The hazard
Mutual redistribution at multiple points is the classic trap: a route redistributed from protocol A into B can be learned back into A as if external, creating a loop or pulling traffic the long way. Administrative distance and metric differences make it worse.
Controls
- Route tags - tag routes as they enter a protocol; deny tagged routes from coming back. The single most reliable safeguard.
- Administrative distance manipulation - make the native source preferred over the redistributed copy.
- Route filtering / route-maps - control exactly what crosses, in which direction.
- Metric seeding - set sane seed metrics so redistributed routes don't distort path selection.
- Minimize points and direction - prefer one-way redistribution and the fewest redistribution points.
OSPF external route types (E1/E2, N1/N2)
When you redistribute into OSPF, the external route carries a metric type that decides path selection to it. Type E2 (default) advertises only the external (seed) metric - the internal cost to reach the ASBR is ignored, so every router sees the same cost and picks the nearest ASBR by tie-break, not by path. Type E1 adds the internal cost to reach the ASBR, so different routers prefer the closest exit - the right choice when you have multiple ASBRs and want least-cost egress. The NSSA equivalents are N1/N2 (type-7). Rule of thumb: E2 is fine for a single exit; use E1 when multiple redistribution points exist and traffic should take the topologically closest one.
OSPF forwarding address (third-party next hop for externals)
Type-5 (and type-7) LSAs carry a forwarding address (FA) whose job is to fix a shared-segment inefficiency (RFC 2328). The default FA = 0.0.0.0 means "forward external traffic to the ASBR" - correct when the ASBR is the real gateway, suboptimal when it is not: if the ASBR redistributes routes learned from a neighbour that sits on a multi-access segment shared with other OSPF routers, every router still detours via the ASBR even though the true next hop is directly reachable. When OSPF is enabled on that shared segment (broadcast-type, conditions per RFC 2328), the ASBR instead writes the true next hop into the FA, and every OSPF router forwards directly to it, bypassing the ASBR - OSPF's form of a third-party next hop. The design consequence is that the optimal/suboptimal flip is silent: enabling or disabling OSPF on that edge segment changes external traffic paths without any change to the redistribution configuration itself - a validate-the-design trap when external traffic "mysteriously" hairpins through the ASBR.
Redistribution is not transitive on one router
A router sitting in three routing domains cannot chain redistribution: a route redistributed from protocol A into B is not then redistributed from B into C on that same router (e.g. an EIGRP route redistributed into OSPF will not carry on from OSPF into RIP). Redistribution only ever takes a protocol's own routes, so to move prefixes across three domains you must redistribute pairwise at each boundary (A <-> B and B <-> C), each pair with its own tag-and-filter loop protection. Designers who assume one router will silently "pass through" routes between three protocols are caught out when the far domain never receives them.
Recommendation / justification
Minimize redistribution points; on any mutual redistribution, always tag-and-filter; prefer summarization or a default route over leaking large numbers of specifics. Justify each redistribution boundary by the requirement it serves and show the loop-prevention mechanism.
What would change this
- Only a default route is needed downstream -> originate a default instead of redistributing.
- Two well-run protocols meet at one point -> simple one-way redistribution may suffice without tags.
IPv6 / dual-stack note
Redistribution is per-address-family; apply the same tag/filter discipline to the v6 topology.
Related
- Route aggregation and summarization
- Securing routing protocols
- IGP selection - OSPF vs IS-IS vs EIGRP
Spaced repetition
The most reliable safeguard against loops in mutual redistribution is [...] (tag on entry, deny tagged routes back).
The most reliable safeguard against loops in mutual redistribution is route tagging (tag on entry, deny tagged routes back).
Why is mutual redistribution at multiple points dangerous?
A route redistributed A->B can be learned back into A as external, causing loops or suboptimal routing (worsened by AD/metric differences).
A good design preference over leaking many specific routes between domains is [...].
A good design preference over leaking many specific routes between domains is summarization or a default route.
OSPF external E1 vs E2 - difference and when to use each?
E2 (default) = external seed metric only (internal cost to the ASBR ignored), fine for a single exit. E1 = external metric + internal cost to the ASBR, so routers pick the closest exit - use with multiple ASBRs.
The NSSA equivalents of OSPF E1/E2 external routes are [...].
The NSSA equivalents of OSPF E1/E2 external routes are N1/N2 (type-7 externals).
Is redistribution transitive through a single router?
No - a route redistributed A->B is not redistributed B->C on the same router; redistribution only takes a protocol's own routes, so you must redistribute pairwise at each boundary (each with tag-and-filter).
What does the OSPF forwarding address do, and when is it non-zero?
Type-5/7 externals carry an FA; 0.0.0.0 means forward to the ASBR. When OSPF runs on the shared broadcast segment between the ASBR and the true next hop, the FA is set to that next hop and all routers forward directly to it, bypassing the ASBR - a third-party next hop that restores the optimal exit (and flips silently when OSPF on that segment is toggled).
Sources
- Cisco Press, Routing TCP/IP Vol I (redistribution); Optimal Routing Design.
- Cisco Press, CCNP ENARSI 300-410 OCG (Edgeworth/Lacoste) - OSPF forwarding address.