Question

A network engineer applies 'distribute-list 10 in' under the OSPF process on router R3 to prevent the 10.50.5.0/24 route (originated in area 0) from being installed. Access-list 10 correctly denies 10.50.5.0/24 and permits everything else. After the change, R3's routing table no longer shows 10.50.5.0/24, but R3's neighbors still learn and use 10.50.5.0/24 normally. However, a downstream router R4 (which relies on R3 to reach 10.50.5.0/24) now has a routing black hole. Why does R4 still install the route while R3 does not, and what causes the black hole?

Accepted Answer

The inbound distribute-list only filters route installation into R3's local RIB; it does not alter the OSPF LSDB, so LSAs still flood to all routers including R4, which continues to point at R3 as the next hop for a route R3 cannot forward.

Answer

The distribute-list removes the Type 3 summary LSA on R3, but R4 rebuilds it from its own SPF calculation, causing inconsistent databases and the black hole.

Answer

Inbound distribute-lists in OSPF filter LSAs during flooding, so R4 should not have the route; the black hole is caused by a mismatched area type between R3 and R4.

Answer

The distribute-list changes the administrative distance of the route on R3 to 255, but R4 retains AD 110, so only R4 installs it and forwards blindly.