topic EIGRP over Stateful Failover Link in Network Security

EIGRP over Stateful Failover Link

Mitchell Theriot — Tue, 12 Mar 2019 02:26:06 GMT

We have two ASA's in Active/Standby mode. We were using static routing on the ASA to reach the subnets off the inside interface but decided to switch over to EIGRP. I got EIGRP working on the active unit but when I removed the static routes from the firewall we lost connectivity to the standby unit. I added the routes back so that I could access it and I noticed that the EIGRP routes were not being learned by the standby unit. After researching this I found out this is due to us not having a stateful link configured in our failover. After configuring this link the standby unit was now seeing dynamic routes so I again attempted to remove the static routes from the active unit. Once again I lost connection to the standby because once the static was removed the standby did not populate it's routing table with the dynamic equivalent route. Here is the process I had to go through to get it to work:

1. Add the static route back to the configuration.

2.Remove the stateful failover link

3. Delete the static route.

4. Add the stateful failover liink back.

When I did this the dynamic route was in the routing table on the standby. Why does the standby unit not update its routing table properly when a stateful link is configured? If there is another static route we want to remove because of an equivalent dynamic route being in the topology table, we have to first remove the stateful link before we delete it.

EIGRP over Stateful Failover Link

Marvin Rhoads — Thu, 15 Aug 2013 16:46:31 GMT

What ASA software version are you running? Stateful failover support for dynamic routing protocols was only introduced as of 8.4(1). (Release notes)

EIGRP over Stateful Failover Link

Mitchell Theriot — Thu, 15 Aug 2013 17:41:09 GMT

We are running version 8.6 (1) 2

EIGRP over Stateful Failover Link

Marvin Rhoads — Thu, 15 Aug 2013 17:54:19 GMT

Hmm, 8.6(1) is based off the feature set in 8.4(2) so it should be supported. I don't see any open caveats published in the release notes for later versions that would apply.

I didn't ask earlier - are you running a single context?

EIGRP over Stateful Failover Link

Mitchell Theriot — Thu, 15 Aug 2013 18:36:39 GMT

Yes we are running single context mode

EIGRP over Stateful Failover Link

Marvin Rhoads — Thu, 15 Aug 2013 18:49:08 GMT

Well then all of the obvious solutions seem to be addressed. TAC time?