topic Re: FlexConfig-EIGRP help needed in Network Security

FlexConfig-EIGRP help needed

cathy_shehorn — Tue, 15 Nov 2022 19:07:11 GMT

Working on a FlexConfig for EIGRP, have managed to work my way through most of the configuration.

Still having issues with a couple commands....

1. passive-interface $outside

2. distribute-list $acl out

when i try and deploy, the failure log always shows the fail on the first words, almost like these commands are not even compatible. I am running FMC vs 7.0.4 with this being deployed on a FPR-1010

any help would be greatly appreciated

Re: FlexConfig-EIGRP help needed

Rob Ingram — Tue, 15 Nov 2022 19:31:13 GMT

@cathy_shehorn can you provide a screenshot of the exact error please?

You could just attempt to use the exact ASA commands and define them in the flexconfig, instead of using a variables.

Example:

router eigrp 1
 distribute-list FILTER in
 passive-interface default
 no passive-interface INSIDE

FYI, from FMC version 7.2 - you can configure EIGRP natively in the FMC GUI, without having to use FlexConfig.

Re: FlexConfig-EIGRP help needed

cathy_shehorn — Tue, 15 Nov 2022 19:46:47 GMT

@rob_ingram, thanks for the reply...during my searches i did see where it would be much easier to configure if we upgraded, however it is not solely up to me to do so 😞

When i run the "preview" it looks like everything should work fine

however, when i deploy it i get the following:

Re: FlexConfig-EIGRP help needed

Rob Ingram — Tue, 15 Nov 2022 19:58:07 GMT

@cathy_shehorn it looks like you are just configuring passive-interface on a single interface, I think you need also need to configure "no passive-interface default" so all other interfaces are not in a passive interface state. Make sure that command is defined above the explictly configured "passive-interface <interfacename>"

Or do the opposite, explictly configure "passive-interface default" and then disable passive-interfaces on the required interfaces.

Re: FlexConfig-EIGRP help needed

cathy_shehorn — Tue, 15 Nov 2022 20:06:09 GMT

@rob_ingram - sorry i thought i sent this screen shot also...but it does not look like it got sent

Re: FlexConfig-EIGRP help needed

MHM Cisco World — Wed, 16 Nov 2022 08:34:17 GMT

you config distribute-list using interface KDDI-to-Koito
then you passive-interface KDDI-to-Koito

that not relate to FMC it relate to EIGRP protocol, the passive interface meaning the interface will not establish EIGRP with neighbor and not send receive prefix update through that interface
but you config distribute list that filter the prefix update !!!
you need one of them either make interface not passive and config distribute list
OR
config passive and remove distribute list