topic Re: EIGRP with ASA in multiple context flapping in Network Security

EIGRP with ASA in multiple context flapping

dhr.tech1 — Wed, 08 May 2024 17:18:35 GMT

hi Cisco,

I am using below topology in my lab where ASA in multiple context - C1 and C2 sharing the same physical interface, in different VLANs (sub interface) is not able to establish EIGRP neighborship with 2 cisco routers (point to point). Although, the ASA can ping both routers.

##############ASA Configuration#####################

ASA(config)# sh run context

admin-context admin
context admin
config-url disk0:/admin.cfg
!

context c1
allocate-interface Ethernet1.1 inside_c1
config-url disk0:/c1.cfg
!

context c2
allocate-interface Ethernet1.2 inside_c2
config-url disk0:/c2.cfg
!

########### ASA context C1 configuration ###############

!
interface inside_c1
nameif inside
security-level 100
ip address 10.10.10.10 255.0.0.0
!

!
router eigrp 100
network 10.0.0.0 255.0.0.0
!

##################R1#######################

!
interface GigabitEthernet0/0
ip address 10.10.10.100 255.0.0.0
duplex auto
speed auto
media-type rj45
!

router eigrp 100
network 10.0.0.0
network 17.0.0.0 0.0.0.255

=================ASA context 2========================

!
interface inside_c2
nameif inside
security-level 100
ip address 11.11.11.11 255.0.0.0
hello-interval eigrp 2 12
hold-time eigrp 2 12
!

mtu inside 1500

!
router eigrp 2
neighbor 11.11.11.100 interface inside
network 11.0.0.0 255.0.0.0
!

Note: tried both options by specifying the neighbour IP address.

=================== R2==================

!
interface GigabitEthernet0/0
ip address 11.11.11.100 255.0.0.0
ip hello-interval eigrp 2 12
ip hold-time eigrp 2 12
duplex auto
speed auto
media-type rj45
!

router eigrp 2
network 11.0.0.0
neighbor 11.11.11.11 GigabitEthernet0/0
!

================= Troubleshooting done so far ===============

Manually hardcoded the MTU at both sides
Manually hardcoded the EIGRP hello and hold timer

=====================error logs============================

*May 8 17:52:30.288: %DUAL-5-NBRCHANGE: EIGRP-IPv4 2: Neighbor 11.11.11.11 (GigabitEthernet0/0) is up: new adjacency
*May 8 17:52:30.318: EIGRP-IPv4(2): table(default): 11.0.0.0/8 - do advertise out GigabitEthernet0/0
*May 8 17:52:30.328: EIGRP-IPv4(2): table(default): 11.0.0.0/8 - do advertise out GigabitEthernet0/0

*May 8 17:50:00.968: %DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 10.10.10.10 (GigabitEthernet0/0) is down: holding time expired
*May 8 17:50:05.345: %DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 10.10.10.10 (GigabitEthernet0/0) is up: new adjacency

####################ping results##########################

ASA/c2(config)# ping 11.11.11.100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 11.11.11.100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms

ASA/c1(config)# ping 10.10.10.100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/10 ms

##################### EIGRP flapping ###############

ASA/c1(config)# show eigrp neighbors
EIGRP-IPv4 neighbors for process 100
ASA/c1(config)# show eigrp neighbors
EIGRP-IPv4 neighbors for process 100
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 10.10.10.100 inside 14 00:00:00 1 2000 2 2241

Re: EIGRP with ASA in multiple context flapping

dhr.tech1 — Wed, 08 May 2024 17:25:20 GMT

Is this a bug in my lab ?

Re: EIGRP with ASA in multiple context flapping

MHM Cisco World — Wed, 08 May 2024 17:37:27 GMT

https://ipwithease.com/configuring-multiple-context-mode-in-cisco-asa/

You need to use VLAN with interface to make ASA send correct eigrp to correct peer using correct vlan tag

Or you can use two link to SW each one connect to specfic vlan instead of using trunk

MHM

Re: EIGRP with ASA in multiple context flapping

dhr.tech1 — Wed, 08 May 2024 20:44:38 GMT

yep, in the system context the sub interfaces are mapped to the VLAN

!
int e1
no sh
!
int e1.1
vlan 10

int e1.2
vlan 20
!
!

context c1
allocate-interface Ethernet1.1 inside_c1
config-url disk0:/c1.cfg
!

context c2
allocate-interface Ethernet1.2 inside_c2
config-url disk0:/c2.cfg
!

Re: EIGRP with ASA in multiple context flapping

MHM Cisco World — Wed, 08 May 2024 20:52:53 GMT

Just dont use trunk'

Use one interface for each context

And in SW this interface will connect to SW with correct VLAN

MHM

Re: EIGRP with ASA in multiple context flapping

dhr.tech1 — Thu, 09 May 2024 08:15:59 GMT

I think physical will work, but I was wondering what's wrong with the virtual / sub interfaces. I have a feeling there is something wrong in my lab setup. Thanks for your response, much appreciated.

I am sure, I did tried something similar in past.

Re: EIGRP with ASA in multiple context flapping

MHM Cisco World — Thu, 09 May 2024 08:26:29 GMT

Ok' let check what issue

Show interface trunk <-in SW

Show ip eigrp interface details

In both routers

MHM

Re: EIGRP with ASA in multiple context flapping

dhr.tech1 — Thu, 09 May 2024 14:37:53 GMT

Hi MHM,

Refer below details. I have attached the R1 configuration and switches configuration for reference.

######################Topology #################

################ output ##################

Regards,

Dhruv

Re: EIGRP with ASA in multiple context flapping

MHM Cisco World — Sat, 11 May 2024 11:13:16 GMT

I run lab not multi context and I see same issue flapping in one router
the solution was
config eigrp first in router
then config eigrp in ASA

note:- in your case the R2 interface g0/0 there is Zero Peer so it never see ASA

do above workaround

MHM

Re: EIGRP with ASA in multiple context flapping

balaji.bandi — Sun, 12 May 2024 12:25:41 GMT

As i remember last i have tried ASA 9.1 (which is available for Lab with Multi-context ) - which is not worked , so that is limitation i guess.

even i tried interface and port-channel sub-interface not worked for me.

real hardware 9.8 onwards works as per the document :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/configuration/general/asa-98-general-config/ha-contexts.html#ID-2171-0000015b

Also check some limitations :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/configuration/general/asa-98-general-config/route-eigrp.html#ID-2179-0000001b