topic asa interface route-map to change route metric in Network Security

asa interface route-map to change route metric

DraganSkundric87318 — Wed, 07 Feb 2024 22:01:30 GMT

hi,

can I use route map on interface to chane metric for some route? something like

route-map blabla

match some_acl

set metric 100000

interface some_interface

policy-route route-map blabla

so for some network contained in some_acl I want to change metric when it is redistributed to rest of the network via eigrp.

Re: asa interface route-map to change route metric

MHM Cisco World — Thu, 08 Feb 2024 06:16:52 GMT

I think Yes you can use route-map when you redistribute static route into eigrp.

You need to use route-map with redistrubte under bgp

And it have two lines

1- line for prefix you want to set metric

2-line for prefix that use it defualt metric

Try this way

Goodluck

MHM

Re: asa interface route-map to change route metric

liviu.gheorghe — Wed, 07 Feb 2024 22:23:01 GMT

Hello @DraganSkundric87318 ,

you can change the metric of a route using a route-map, but not in the way you wrote it.

The route-map is correct, but you will have to use it in the redistribution of a routing protocol into another routing protocol:

ciscoasa(config)# route outside 10.1.1.0 255.255.255.0 192.168.1.1
ciscoasa(config-route-map)# access-list mymap2 line 1 permit 10.1.1.0 255.255.255.0
ciscoasa(config-route-map)# route-map mymap2 permit 10
ciscoasa(config-route-map)# match ip address mymap2
ciscoasa(config-route-map)# router eigrp 1
ciscoasa(config-router)# redistribute static metric 250 250 1 1 1 route-map mymap2

The policy-route route-map interface command configures policy routing or PBR, which means routing by other rules and not by looking at the routing table.

You can find a more detailed explanation about the use of route maps here: https://www.cisco.com/c/en/us/td/docs/security/asa/asa94/config-guides/cli/general/asa-94-general-config/routes-maps.html

Re: asa interface route-map to change route metric

DraganSkundric87318 — Thu, 08 Feb 2024 05:46:15 GMT

problem is I already have redistribution route map from static to eigrp for some other routes. And I need several routes to be redistributet with modified metric. And it is not possible to have two redistristribution static to eigrp

Re: asa interface route-map to change route metric

MHM Cisco World — Thu, 08 Feb 2024 06:45:42 GMT

Use two line in route-map as I mention above

First one match prefix that you want to modify it metric with set command

Second line match any prefix without any set command

MHM

Re: asa interface route-map to change route metric

liviu.gheorghe — Thu, 08 Feb 2024 07:10:42 GMT

You will have a route-map as follows:

ciscoasa(config-route-map)# route-map mymap2 permit 10
ciscoasa(config-route-map)# match ip address mymap2
ciscoasa(config-route-map)# route-map mymap2 permit 20

The first route-map entry will match the routes you want to modify the metric and the second route-map entry will match all the rest of the routes.

Re: asa interface route-map to change route metric

DraganSkundric87318 — Thu, 08 Feb 2024 13:15:48 GMT

so, for example

route-map test permit 10
match ip addr acl_default
route-map test permit 20
match ip addr acl_250
set metric 250 250 1 1 1

redistribute static route-map mymap2

only acl_250 networks will be redistributed with changed metrics?

Re: asa interface route-map to change route metric

liviu.gheorghe — Thu, 08 Feb 2024 17:09:05 GMT

No, routes matching acl_default will be distributed with their seed metric and routes matching acl_250 will be redistributed with the change metric - the one configured with set metric.

The seed metric is the one configured with the redistribution command, 250 250 1 1 1 in my example, or configured with the seed metric command.

Re: asa interface route-map to change route metric

MHM Cisco World — Thu, 08 Feb 2024 17:20:16 GMT

this order is wrong
the subnet (you need to set metric) is always match by first route-map line
you need to SWAP the order
make line 10 match ACL_250 set metric
then line 20 match any ( in router IOS you dont need to match anyting it by default match any prefix not previous match by other UPPER line)
MHM

Re: asa interface route-map to change route metric

DraganSkundric87318 — Fri, 09 Feb 2024 08:58:23 GMT

well, this example is working ok, at least in GNS. Other side receives route for 3.3.3.3 with defaults and route for 4.4.4.4 with changed metric

interface Loopback1
ip address 2.2.2.1 255.255.255.255
!
interface FastEthernet0/0
ip address 1.1.1.1 255.255.255.252
duplex auto
speed auto
!

router eigrp 1
redistribute static route-map STATIC-TO-EIGRP1
network 0.0.0.0
no auto-summary
!
ip forward-protocol nd
ip route 3.3.3.3 255.255.255.255 Loopback1
ip route 4.4.4.4 255.255.255.255 Loopback1
!
!

ip access-list standard LISTA1
permit 3.3.3.3
ip access-list standard LISTA2
permit 4.4.4.4
!

route-map STATIC-TO-EIGRP1 permit 10
match ip address LISTA1
!
route-map STATIC-TO-EIGRP1 permit 20
match ip address LISTA2
set metric 1 10000 1 255 1500
!
!
!

UNUTRA#sh ip route 4.4.4.4
Routing entry for 4.4.4.4/32
Known via "eigrp 1", distance 170, metric 2562585600, type external
Redistributing via eigrp 1
Last update from 1.1.1.1 on FastEthernet0/0, 00:06:21 ago
Routing Descriptor Blocks:
* 1.1.1.1, from 1.1.1.1, 00:06:21 ago, via FastEthernet0/0
Route metric is 2562585600, traffic share count is 1
Total delay is 101000 microseconds, minimum bandwidth is 1 Kbit
Reliability 1/255, minimum MTU 1500 bytes
Loading 255/255, Hops 1

UNUTRA#sh ip route 3.3.3.3
Routing entry for 3.3.3.3/32
Known via "eigrp 1", distance 170, metric 409600, type external
Redistributing via eigrp 1
Last update from 1.1.1.1 on FastEthernet0/0, 00:16:52 ago
Routing Descriptor Blocks:
* 1.1.1.1, from 1.1.1.1, 00:16:52 ago, via FastEthernet0/0
Route metric is 409600, traffic share count is 1
Total delay is 6000 microseconds, minimum bandwidth is 10000 Kbit
Reliability 255/255, minimum MTU 1500 bytes
Loading 1/255, Hops 1

UNUTRA#

Re: asa interface route-map to change route metric

MHM Cisco World — Fri, 09 Feb 2024 09:06:13 GMT

it Work in previous order but each time you need to add prefix to your FW you need to include it in #match ip address LISTA1#

instead change the order make the default in end and match any
this make route-map check Line-1 ACL for prefix need to modify if not match then will check Line-2 ACL which permit any

we need to make simple to us
MHM