Understanding Redistribution Profile Behavior if using Destination Filter

Environment

• Palo Alto Firewall.
• PAN-OS any.
• Route Redistribution.

Resolution

Redistribution profiles are used to redistribute routes learned from one protocol to another protocol. Please use the following articles for help in configuring Route Redistribution on Palo Alto Firewall:

Understanding Route Redistribution and Filtering

OSPF Route Summarization and Suppression on a Palo Alto Networks Firewall

When you use "Destination" as one of the filtering/matching criteria in Redistribution Profile, you should read the destination prefix as 'OR LONGER' and not 'EXACT'.

Scenario 1: Redistributing smaller prefix instead of longer prefix in OSPF:

You have the following static routes:

You wish to advertise the 10.10.0.0/16 route but not the 10.10.1.0/24, 10.10.2.0/24 and 10.10.3.0/24 .

If you just create a redistribution profile as under:

Then you will end up redistributing even 10.10.1.0/24, 10.10.2.0/24, 10.10.3.0/24 as well:

Rather use two profiles, the first for not redistributing specific routes and a second for redistributing a larger route. Use it under export rules in OSPF as under:  (Notice the priority value in the two profiles)