Showing results for 
Search instead for 
Did you mean: 


ASA prefer EIGRP over VPN?

I'm running 8.2 code. I'd like to have an EIGRP learned path take precedence over a backup VPN tunnel between two sites.

I ran into problems that seemed to be due to the L2L network on the VPN getting injected into the routing table as a static route. At least I think that was the source of my trouble.

Any suggestions?

Collin Clark

Are you redistributing connected on the ASA?

No redistribution on the ASA. Just a network statement for the Ethernet segment the EIGRP Neighbors are on.

Is it as simple as that? Something so obvious. I'm feeling kind of dense now.

Ok, so if the red conn is in there do the other routes still take precedence over the L2L VPN? After all, the red conn is only for local.

I've asked around about this but have yet to see something clearly defined. What's the order of operation for a packet when it hits the ASA? Sure would be nice if something clearly defined the order in which packets are processed. ie, inbound ACL, NAT, routing table, VPN ACL, outbound ACL...etc. That's probably wrong.

What you need to check is your routing. Which route is preferred? Is the other a FS? I don't know your setup but can you add delay to the link to the ASA? Can you increase the BW statement on the P2P link?

I found a link on configuring EIGRP and setting the attributes.

You can increase the delay until the P2P is preferred.

The internal EIGRP path is effectively an Ethernet connection between sites. I would expect the metrics to look pretty good on that already.

I have a concern that the VPN is putting a route in with an admin distance of 1 and the EIGRP will never get over that.

Unfortunately I'm not able to test right now since this is in production.

Check the link above, you can set the admin distance.

Content for Community-Ad