# Route Redistribution and Filtering

> Chapter 8 of the Courseiva ENCOR curriculum — https://courseiva.com/learn/encor/redistribution-and-route-filtering

**Official objective:** 3.4 — Configure and verify redistribution between routing protocols and route filtering using prefix-lists and route-maps

## Introduction

Route redistribution allows networks running different routing protocols to share reachability information, transforming fragmented routing domains into a single unified map of destinations. Without it, a corporate network split between OSPF and EIGRP would remain blind to each other’s subnets, breaking connectivity for half the organisation. For the 350-401 ENCOR exam, understanding redistribution and filtering is critical because enterprise networks rarely rely on just one protocol, and you must prove you can safely stitch them together while preventing routing loops and leaks.

## The Library Catalog Systems Analogy

The university library’s dual catalog databases sit on opposite sides of the main reading room, each designed for a different classification scheme. The Dewey Decimal system catalogues contemporary acquisitions, while the Library of Congress system organises the rare-book collection. A shared reader terminal, acting as the redistribution point, must translate a book’s shelf location from one scheme into the other so that students can discover any volume regardless of which database they query.

Without careful filtering, the terminal would blindly advertise every location, including restricted reference-only books that patrons cannot borrow, causing wasted trips and confusion. The librarian configuring this exchange applies a strict rule: only books with a loanable status tag make it into the other catalogue. This filtering rule is the prefix-list and route-map rolled into one—it checks each translated entry against the loanability criterion before it ever reaches the opposite database.

When the system later learns that a particular aisle is under construction, the redistribution process must be stopped quickly from advertising those inaccessible shelves that way, just as an engineer would block a flapping route. The result is a unified discovery service where each catalogue preserves its own structure but contributes a precise, filtered view of the other side.

## Core explanation

Route redistribution is the process of taking routes learned by one routing protocol and injecting them into another routing protocol. A routing protocol is a set of rules routers use to tell each other about the networks they can reach—think of OSPF, EIGRP, and BGP as different languages. Each protocol calculates a metric, which is a number representing how desirable a path is (lower is better). Because every protocol uses its own metric formula, a route entering a new protocol from redistribution must be given a seed metric—the initial cost value assigned during redistribution—otherwise the receiving protocol cannot process it.

The reason redistribution exists is that large organisations rarely standardise on one protocol. An acquisition might run EIGRP while the headquarters runs OSPF. Instead of re-addressing and reconfiguring every device, a single border router that speaks both protocols can redistribute routes between them.

Redistribution replaces manual static route entry or dual-stack address planning because it scales and adapts automatically as new subnets appear. However, it comes with risks. The most dangerous is a routing loop, where a route is advertised back into its original domain via a second redistribution point, creating a circular path that can melt a CPU. To stop loops, engineers apply route filtering.

Route filtering controls which routes are allowed in or out during redistribution. The three main tools are:


- Prefix-lists: Match IP prefixes based on network address and mask length, like fine-grained access lists designed specifically for routing updates. They process top-down and stop at the first match.
- Route-maps: A sequence of “if-then” statements that can match multiple conditions (prefix-lists, ACLs, tags) and then set actions, such as permitting/denying the route or altering its metric or next hop.
- Distribute-lists: Combine an access control list (ACL) with a routing protocol to filter routes in or out; less flexible than route-maps and largely replaced by prefix-lists in modern configs.


When configuring redistribution, you must select the source protocol with the redistribute command, define the seed metric if the destination protocol requires it (EIGRP and BGP do, OSPF has a default, but you should set it explicitly), and attach a route-map to apply filtering and attribute manipulation. On the Cisco command line, the sequence might look like: router ospf 1, then redistribute eigrp 100 subnets route-map EIGRP-TO-OSPF. The route-map itself would reference a prefix-list to permit only certain subnets and maybe set a tag. Tags are numeric markers applied to routes during redistribution so that a receiving router on the other side can identify and filter the route before re-redistributing it, thus breaking loops.

Another critical concept is administrative distance (AD). AD is a trustworthiness score a router assigns to each route source; lower is more trusted. When a router learns the same prefix from two protocols, it installs the one with the lowest AD. Redistributed external routes get a higher AD than internal ones (for example, OSPF external Type 2 routes have AD 110 internal but 110 externally? Actually OSPF external routes AD is 110, same as internal OSPF—correction: OSPF internal and external both AD 110; EIGRP internal AD 90, external 170). The exam expects you to know these values and how to manipulate them to influence path selection.

Filtering can also be applied when routes are received into a protocol. For instance, an OSPF area border router can filter inter-area summaries with a filter-list. The overall goal is to ensure the routing table contains only intentional, loop-free, optimal paths. Route redistribution and filtering together allow network engineers to merge islands of connectivity without chaos.

## Real-world context

A medium-sized retail chain acquires a competitor. The acquirer’s network uses OSPF across its headquarters and warehouse, while the acquired company’s branch offices run EIGRP. The integration project manager hands you a topology diagram on a Monday morning and asks you to make all sites reachable by Friday without redesigning either side. You decide to use mutual redistribution on a single border router that sits at the data centre where both networks meet.

First, you document all subnets. The acquired EIGRP domain has a legacy subnet 10.10.99.0/24 that is only used for an old point-of-sale LAN and must never appear in the OSPF domain because it would conflict with an addressing plan. You build a prefix-list called BLOCK-POS denying 10.10.99.0/24 and permitting all other subnets.

Next, you enter OSPF configuration and redistribute EIGRP with the command redistribute eigrp 100 subnets route-map EIGRP2OSPF. The route-map references the prefix-list and, for matching entries, sets a tag of 100 so you can recognise them later. You then mirror the configuration in EIGRP: redistribute ospf 1 metric 10000 100 255 1 1500 route-map OSPF2EIGRP, again using a prefix-list to filter only the subnets you want to advertise, and setting a tag of 200. The seed metric numbers are chosen after a careful bandwidth and delay calculation so that paths through the border router look sensible to EIGRP.

After applying the configuration, you verify with show ip route on the border and on a branch router. You spot that a branch router is learning an OSPF external route via two paths, one of which goes back into the EIGRP domain because a junior admin had enabled redistribution on another router last year without tagging. You shut down that extra redistribution, then add an inbound distribute-list on the OSPF process to block any route tagged with 200, preventing the border router from re-redistributing routes it originated. Finally, you test pings from a branch PC to a warehouse server. It works. This real-world dance of redistribution and filtering saved weeks of re-IP-addressing and let the business function on day one.

## Exam focus

The 350-401 ENCOR exam treats route redistribution and filtering as a core implementation topic. Expect multiple-choice questions, drag-and-drop items matching configuration fragments to their purpose, and simulation-style tasks where you must spot misconfigurations that cause loops or missing routes. The test writers build questions around these precise concepts.


- The default seed metric for redistributed OSPF routes (cost 20 for BGP, but for routes from other protocols into OSPF, the default is metric 20 for Type 2). Missing the seed metric for EIGRP or BGP redistribution will stop the redistribution from working, because those protocols do not have a default metric.
- Prefix-list vs ACL: exam questions will offer an ACL as a distractor when filtering routes. A prefix-list is the correct tool because it can match on subnet mask length, which a standard ACL cannot. Watch for traps where a config shows a standard ACL under a route-map for filtering—the answer will be that the prefix will not be matched correctly because the ACL lacks subnet mask checking.
- Route-map processing order: route-maps are evaluated like a programming switch-case with an implicit deny at the end. If no match clause exists, the route-map clause matches everything, but many candidates forget the implicit deny and mark an answer that routes will pass when they will actually be dropped.
- Administrative distance manipulation: you may be asked to make a router prefer a path learned via redistribution over an alternate one. You must change the distance within the routing process (e.g., distance eigrp 90 110 or distance 120 0.0.0.0 255.255.255.255 under OSPF). The exam loves to test which command changes AD for external routes only.
- Loop prevention using tags: a classic scenario shows two redistribution points. The correct answer involves setting a route tag during redistribution and then using a route-map or distribute-list with a prefix-list to deny routes carrying that tag when they arrive back at the other redistribution point.
- Filtering with prefix-lists: you must calculate the correct ge (greater than or equal to) le (less than or equal to) syntax. For example, to match a /24 subnet inside a /16 block, you need ip prefix-list PL permit 10.0.0.0/16 ge 24 le 24. Expect questions that swap ge and le values to create logical errors.


Key definitions to memorise: seed metric—the metric assigned to a route when it is redistributed into a protocol that does not have a default; route feedback—when a route enters a protocol, gets redistributed into another, and somehow returns to the original domain, creating a loop; prefix-list sequence—each entry has a sequence number and processing stops on first match; and route-map sentence—each route-map has permit/deny actions, and sequence numbers dictate order.

For the configuration simulation questions, the correct approach always involves: (1) enable redistribution under the receiving process, (2) set the seed metric if needed, (3) attach a route-map that references a prefix-list to filter desired routes, (4) optionally set a tag, and (5) verify with show ip route and show ip protocols.

## Step by step

1. **Choose the border router and identify redistribution points** — Select routers that speak both routing protocols. Document which subnets should be shared and which must stay local. This prevents accidental leaking of sensitive or duplicate subnets later.
2. **Build prefix-lists to define the allowed route set** — Create one or more ip prefix-list entries that explicitly permit the exact network ranges you intend to advertise, using ge and le to control mask length. A final deny all is implicit.
3. **Configure route-maps referencing the prefix-lists** — Under route-map statements, use match ip address prefix-list commands to tie permit/deny logic to the prefix-list. Add set tag operations at this stage to ease later loop filtering.
4. **Enable redistribution with the seed metric and route-map** — Inside the receiving routing protocol’s configuration mode, use the redistribute command. For EIGRP, specify bandwidth, delay, reliability, load, and MTU; for OSPF, use the subnets keyword and optionally set metric. Attach the route-map with the route-map parameter.
5. **Apply loop-prevention filters on the opposite redistribution point** — On the matching router facing the opposite protocol, create an inbound distribute-list or route-map that denies routes carrying the tag you set earlier. This ensures routes do not boomerang back into their original domain.
6. **Verify and test with show commands** — Use show ip route on key routers to confirm no missing or duplicate subnets. Check show ip protocols for redistribution status and show route-map to see hit counts, confirming your filtering is working.

## Comparisons

### Prefix-List vs Standard ACL for Route Filtering

**Prefix-List:**
- Matches network and subnet mask
- Supports ge and le operators
- Stops at first match

**Standard ACL for Route Filtering:**
- Matches only network address
- No mask length control
- Can produce unintended matches

### Route-Map vs Distribute-List

**Route-Map:**
- Can set metrics, tags, next-hop
- Multiple match criteria per clause
- Implicit deny at end

**Distribute-List:**
- Only permits or denies routes
- Single ACL or prefix-list only
- Applied directly under protocol

### EIGRP Redistribution vs OSPF Redistribution

**EIGRP Redistribution:**
- Requires explicit seed metric
- Uses bandwidth, delay, reliability, load, MTU
- External routes get AD 170

**OSPF Redistribution:**
- Default metric 20 for external Type 2
- Metric based on cost
- External routes AD 110 (same as internal)

### Route Redistribution vs Route Summarisation

**Route Redistribution:**
- Exchanges routes between different routing protocols
- May increase routing table size
- Requires filtering to prevent loops

**Route Summarisation:**
- Creates a single summary prefix within one protocol
- Reduces routing table size
- Helps contain route flapping

## Diagram

_Mutual redistribution filtering flow with route-map and prefix-list loop prevention._

```mermaid
flowchart LR
  EIGRP_Domain[EIGRP Domain] -->|redistribute EIGRP| BorderRouter[Border Router]
  OSPF_Domain[OSPF Domain] -->|redistribute OSPF| BorderRouter
  BorderRouter --> RouteMap[Route-Map EIGRP-TO-OSPF]
  RouteMap --> PrefixList[Prefix-List: Permit Only Allowed Subnets]
  PrefixList --> SetTag[Set Tag 100]
  SetTag --> Advertise[Advertise into OSPF]
  BorderRouter2[Second Border Router] -->|Inbound Filter Deny Tag 100| LoopPrevent[Loop Prevention]
  LoopPrevent --> RouteTable[Stable Routing Tables]
```

## Common misconceptions

- **Misconception:** You can just redistribute everything and the routing table will sort it out automatically. **Reality:** Redistribution without filtering often causes routing loops, suboptimal paths, and accidental leaks of internal routes that should remain hidden. Filtering is mandatory in production. (Beginners see the redistribute command as a simple mirror that copies routes between protocols and assume the protocols will handle conflicts, not realising that metrics and administrative distances interact unpredictably without control.)
- **Misconception:** A standard access control list is fine for filtering prefixes in a route-map. **Reality:** A standard ACL cannot match on subnet mask length, so it would match a /24 the same as a /16 if the network address is the same. You must use a prefix-list to filter routes accurately. (ACLs are the first filtering tool many learners encounter, and they try to reuse them for route filtering. Routing updates demand mask-aware matching, which ACLs lack.)
- **Misconception:** Once you set a route-map with a match statement, routes that don't match are still allowed through. **Reality:** Route-maps have an implicit deny at the end, so any route not matched by a permit clause is silently dropped. You need an explicit permit clause at the end if you want to allow other routes. (People assume route-maps behave like standard configuration blocks where unspecified traffic is permitted, confusing them with simple ACL-style logic.)
- **Misconception:** Redistributing between two protocols automatically uses the same metric value from the source protocol. **Reality:** Each protocol measures cost differently (bandwidth vs. cumulative cost vs. AS path length), so when you redistribute, you must manually define a seed metric or rely on a protocol-specific default that often renders the route unattractive. (The concept of a universal metric seems natural, but metrics are protocol-specific scales. Without explicit configuration, the router either rejects the redistribution or assigns a default that might break path selection.)
- **Misconception:** Administrative distance is a fixed value; you cannot change it. **Reality:** You can adjust AD per routing protocol, per prefix, or per route source using the distance command under the routing process, which lets you influence which route gets installed. (Newcomers learn the default AD table and treat it as law, unaware that Cisco devices allow fine-grained override to solve redistribution path selection problems.)

## Key takeaways

- Redistribution injects routes from one routing protocol into another, but always requires a defined seed metric for protocols like EIGRP and BGP that have no default.
- Prefix-lists are the primary tool for filtering IP prefixes because they can match on both network address and subnet mask length, unlike standard ACLs.
- Route-maps process clauses sequentially with an implicit deny at the end; a route that matches no permit clause is dropped.
- Mutual redistribution between two protocols demands a loop-prevention strategy, typically using route tags to block re-advertisement of routes back into their original domain.
- The administrative distance of external routes is often higher than internal routes (e.g., EIGRP internal 90, external 170) to ensure stability, but you can tune AD with the distance command.
- Tagging a route during redistribution and then filtering on that tag at another distribution point is the canonical method to stop routing loops without hard-coding every prefix.
- Configuration verification with show ip route, show ip protocols, and show route-map is essential; a missing seed metric or a route-map with no final permit clause are silent failures.

## FAQ

**What is the difference between a route-map and a distribute-list?**

A distribute-list applies a simple access list or prefix-list directly to filter routes entering or leaving a routing process. A route-map is a sequence of if-then clauses that can match multiple conditions and perform actions like modifying metrics and tags.

**Why do I need to specify a seed metric when redistributing into EIGRP?**

EIGRP uses a composite metric based on bandwidth, delay, reliability, load, and MTU. Unlike OSPF, it cannot derive a meaningful default from another protocol, so you must supply a complete metric or the redistribution will fail.

**How do I stop mutual redistribution from creating routing loops?**

Tag routes during initial redistribution with a route-map. On the opposite border router, deny any route carrying that tag using a distribute-list or route-map, so the route cannot be re-injected into the original domain.

**Can I filter routes without a route-map?**

Yes, you can use a distribute-list with an ACL or prefix-list directly under the routing process, or use a prefix-list with the match ip next-hop prefix-list command in some contexts. Route-maps offer more control when you need to set attributes.

**What is the administrative distance of an OSPF external type 2 route?**

Both OSPF internal and OSPF external routes use an AD of 110. The type 1 or type 2 metric calculation differs, but the trustworthiness ranking remains the same.

**Do I need to filter both directions in mutual redistribution?**

You must apply filtering on each redistribution point to prevent routes from leaking back. Typically you set tags on both sides and deny those tags on the opposite redistribution so that routes never circle back.

## Check your understanding

1. **What is the correct command to redistribute OSPF routes into EIGRP with a metric of 10000 bandwidth, 100 delay, 255 reliability, 1 load, and 1500 MTU?**

   Answer: Router(config-router)# redistribute ospf 1 metric 10000 100 255 1 1500.

2. **A route-map clause has no match statement but a permit action. How does it affect the redistribution?**

   Answer: It matches all routes, so the route-map will permit every route that reaches that clause, unless a previous clause with a deny has already matched.

3. **Why would you set a route tag during redistribution?**

   Answer: To mark routes so that another router's inbound filter can easily identify and deny them, preventing routing loops in mutual redistribution scenarios.

4. **Which prefix-list entry permits a /24 subnet within 172.16.0.0/12 while rejecting any /16 summary?**

   Answer: ip prefix-list ALLOW24 permit 172.16.0.0/12 ge 24 le 24.

5. **What is the default seed metric for OSPF external Type 2 routes when redistributing from BGP?**

   Answer: 20.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/encor/redistribution-and-route-filtering