topic Re: Passing EIGRP through a PIX in Network Security

Passing EIGRP through a PIX

m-raft — Fri, 21 Feb 2020 06:32:26 GMT

Is it possible to pass EIGRP through a PIX. I know that the PIX will not pass multicast packets and EIGRP uses multicast. I have read that you can use the neighbor command on the routers to send unicast instead of multicast. If i set this up and permit eigrp on an access list on the PIX between the 2 routers will that allow the routing updates to occur between the 2 routers? In this scenario I would have one router on a DMZ interface and the other router on the inside interface.

Thanks

MIke

Re: Passing EIGRP through a PIX

steve.barlow — Tue, 04 Feb 2003 16:13:36 GMT

Yes, you shoudl be able to do it (eigrp over pix). But not sure you would want to do it from a security point of view.

Although the neighbor command is accepted by the Cisco IOS under EIGRP, it should not be used. The neighbor statement does not behave as intended and can have a negative effect on EIGRP neighbors. See bug CSCdv19648 for more information.

The best way to accomplish this would be to set-up a GRE tunnel between the routers and open the PIX access-lists to allow gre between the routers.

eg.

hostname R1

interface Loopback0

ip address 10.1.1.1 255.255.255.0

interface Tunnel0

ip address 192.168.1.1 255.255.255.0

tunnel source Loopback0

tunnel destination 10.3.3.3

router eigrp 1

network 10.1.1.0 0.0.0.255

network 192.168.1.0

network y.y.y.y

no auto-summary

hostname R3

interface Loopback0

ip address 10.3.3.3 255.255.255.0

interface Tunnel0

ip address 192.168.1.3 255.255.255.0

tunnel source Loopback0

tunnel destination 10.1.1.1

router eigrp 1

network 10.3.3.0 0.0.0.255

network 192.168.1.0

network x.x.x.x

no auto-summary

The PIX would look something like this (minus the static/NAT/global commands):

access-list 101 permit gre host 10.3.3.3 host 10.1.1.1 (if no nat used, if nat used the nat'ed IP would be used instead of 10.1.1.1)

access-group 101 in interface outside

Hope it helps.

Steve

Re: Passing EIGRP through a PIX

kdarmstrong — Mon, 10 Feb 2003 15:18:09 GMT

Steve,

Would this work with RIPv2?

and ..

do you know if we can set up a GRE tunnel between Cisco and Bay networks?

thanks

Ken

Re: Passing EIGRP through a PIX

steve.barlow — Mon, 10 Feb 2003 20:28:34 GMT

Yes it will work with RIPv2 as it uses a multicast address (224.0.0.9). And as for GRE between Cisco and Bay, sorry I have no idea, but I would guess yes as GRE uses protocol 47 (not proprietary to either company).

Steve