EIGRP Through Transparent ASA

[nick.smethurst1]

Hello,

Hoping you can help please. I'm having issues with passing traffic through a Cisco ASA 5525-x when in transparent mode.

The Transparent mode firewall has been placed in between a layer 3 switch and another ASA running in routed mode, they have an eigrp peering between the two across a port channel.

I have added access lists just as a test with 'ip any any' & 'eigrp any any' just to see if I can get this working but I'm having issues.

Looking at the MAC address table on the Transparent it has learned the MAC address correctly.

However when pinging from the switch to the routed firewall I can see from a capture that it ARP's but it fails to learn the mac address of the routed ASA firewall.  Also the EIGRP peering between the two devices has come up but it's not advertising any routes.

I gone into ASDM and done a packet tracer test which shows that the packet is allowed but it doesn't show the output interface and the Line and Link have question marks next to them, which looks odd ?

Running out of ideas, so any help would be great! Many Thanks.

Nick

[dperezoquendo]

Hello,
I don't recall an ASA in transparent mode being able to run the packet-tracer command. Are you sure it's in transparent mode? Refer to the following link for configuring in transparent mode: https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/intro_fw.html
Typically it should be configured with BVI's and have the "firewall transparent" command applied.

[Dennis Mink]

when you do  a packet capture through ASDM, do you see eigrp going out the egress interface?

[Florin Barhala]

Hi Nick,

I never used ASA in transparent still I would run a live capture on both interfaces and check the output - preferably in Wireshark.
Based on your output, I wouldn't think it's related to the Transparent FW in between:
Let's keep things simple:
- L3 switch:
+ show ip arp "ASA_EIGRP_IP"
+ show ip eigrp topology
+ show ip eigrp neigh detailed
+ show run | section router

- ASA
+ show arp | L3_EIGRP_IP
+ show run router

[nick.smethurst1 · Accepted solution]

Thank you for your suggestions.

The issue turned out to be that the BVI interface not having any IP address within the subnet in which it was filtering traffic. As we were using the physical management interface to administer the device, I didn't think this was required. Learn something every day :)