ASA Multi Context and BGP

Daniel Smith — Tue, 12 Mar 2019 09:19:57 GMT

We need to run BGP with a third party (their requirement), so that we will dynamically lose their routes over a link if some component fails. From what I have seen, it is necessary to configure router bgp NN in the system context, then in the admin context; and finally in the specific context where it is needed. I may be wrong on needing it in the admin context, that just happened to be the example that I found online. At any rate, having configured the protocol, I notice that the neighbor never goes Active, always remaining in Idle mode. Further checking indicates that the firewall is not listening on tcp/179 for BGP:

FW26-multiple/fw26tsnfw3/act# show asp table socket

Protocol Socket State Local Address Foreign Address
TCP 00031008 LISTEN 10.41.11.36:22 0.0.0.0:*

Here is the config in the actual fw context where it is needed (this is lab set up):

!
router bgp 26
bgp router-id 10.1.1.1
address-family ipv4 unicast
neighbor 10.41.78.11 remote-as 11
neighbor 10.41.78.11 activate
neighbor 10.41.78.11 prefix-list routesfromxxx in
no auto-summary
no synchronization
exit-address-family
!
FW26-multiple/fw26tsnfw3/act#

I wonder if I am missing some magic configuration to turn this on?

Try following command

Ashish Jhaldiyal — Mon, 08 May 2017 18:46:22 GMT

Try following command

router bgp 26
address-family ipv4 unicast
neighbor 10.41.78.11 ebgp-multihop 5

Thanks for the suggestion,

Daniel Smith — Mon, 08 May 2017 19:41:24 GMT

Thanks for the suggestion, although not the exact problem, I realized I had the wrong third octet in my neighbor statement. So, with no connected network in the incorrect neighbor subnet, must have kept the ASA from enabling BGP at all. Nice.

Did you actually test this,

abdulhmalik — Mon, 15 May 2017 15:41:08 GMT

Did you actually test this, Ashish?

topic Thanks for the suggestion, in Network Security

ASA Multi Context and BGP

Try following command

Thanks for the suggestion,

Did you actually test this,