topic Re: EIGRP Issue in Network Security

EIGRP Issue

Cormac Champion — Tue, 12 Mar 2019 14:12:56 GMT

Hi all,

I have an FMC managing a HA Pair of FTD2110's. I am using multiple interfaces on the FTD and configured each interface as a /30 point to point link since I don't want to have the GW's on the FTD. The interface to my outside network is running EIGRP.

The EIGRP neighbour is UP and I am learning all routes from my outside interface - all perfect so far.

So I have added static routes pointing to the networks on the inside, via the /30 interfaces. From the FTD, I can ping the various subnets on the inside. However, since the Static Routes are configured with IP's rather than interfaces, the subnets are not being advertised out via EIGRP.

So I added the subnets as "Null0" subnets, which advertised them perfectly, except that I need the Static Routes on the FTD's too. It would not allow both with the same metric.

Can anyone suggest a solution please ?

Re: EIGRP Issue

balaji.bandi — Wed, 09 Jan 2019 21:08:39 GMT

what is the code version, still some of the features still have some bug in FTD area, Cisco TAC start fixing, have you contact TAC, they very helpfull and jump over webex and start fixing for you.

Re: EIGRP Issue

Cormac Champion — Wed, 09 Jan 2019 22:25:15 GMT

I'm on 6.2.2 - ready to upgrade to 6.3.0.

However, I have two complete sets of FTD's and FMC's and BOTH are now stuck with "deployment failed due to ongoing previous deployment".

Waiting for TAC to contact me back after raising case online.

Re: EIGRP Issue

balaji.bandi — Wed, 09 Jan 2019 22:30:57 GMT

i am doing some testing 6.3.0 it is much better version.

Re: EIGRP Issue

Cormac Champion — Wed, 09 Jan 2019 22:43:22 GMT

And to specifically solve my problem - how is the best way to advertise my inside subnets to my outside network, while also having static routes on the FTD's giving the direction of each of the inside subnets ?

Re: EIGRP Issue

Rob Ingram — Wed, 09 Jan 2019 22:57:41 GMT

Would "redistribute static" configured via FlexConfig achieve what you need?

Re: EIGRP Issue

Cormac Champion — Wed, 09 Jan 2019 23:12:49 GMT

I would think so. Is that option in there somewhere as a template in 6.3.0 ? I certainly do not see it in 6.2.2

Re: EIGRP Issue

Rob Ingram — Wed, 09 Jan 2019 23:12:39 GMT

There are predefined objects, reference here.

HTH