Cannot establish OSPF neighbor with loopback 3.3.3.3 in ASAv

[Charlie1010]

I have established OSPF neighbors with ASAv and routers Outside, dmz_b, inside_1 and inside2.

Each router has its own loopback interface from 1.1.1.1 to 4.4.4.4 as below showed.

But 3.3.3.3 cannot establish OSPF neighbor of ASAv. But I have advertised it.

ciscoasa# show ospf nei

Neighbor ID Pri State Dead Time Address Interface
202.200.200.1 1 FULL/DR 0:00:34 202.200.200.1 outside
4.4.4.4 1 FULL/BDR 0:00:37 192.168.244.20 dmz
2.2.2.2 1 FULL/BDR 0:00:34 7.7.2.1 inside2
1.1.1.1 1 FULL/BDR 0:00:33 7.7.1.1 inside1

S* 0.0.0.0 0.0.0.0 [1/0] via 192.168.244.2, outside
O 1.1.1.1 255.255.255.255 [110/11] via 7.7.1.1, 02:58:59, inside1
O 2.2.2.2 255.255.255.255 [110/11] via 7.7.2.1, 02:56:43, inside2
O 3.3.3.3 255.255.255.255 [110/11] via 202.200.200.1, 01:01:01, outside
O 4.4.4.4 255.255.255.255 [110/11] via 192.168.244.20, 01:00:51, dmz
C 7.7.1.0 255.255.255.0 is directly connected, inside1
L 7.7.1.254 255.255.255.255 is directly connected, inside1
C 7.7.2.0 255.255.255.0 is directly connected, inside2
L 7.7.2.254 255.255.255.255 is directly connected, inside2
O 192.168.100.0 255.255.255.0
[110/30] via 202.200.200.1, 01:00:51, outside
C 192.168.244.0 255.255.255.0 is directly connected, dmz
L 192.168.244.254 255.255.255.255 is directly connected, dmz
C 202.200.200.0 255.255.255.0 is directly connected, outside
L 202.200.200.254 255.255.255.255 is directly connected, outside

Any possible reasons for it?

[balaji.bandi · Accepted solution]

If I am not wrong, you do have OSPF peer -

202.200.200.1 1 FULL/DR 0:00:34 202.200.200.1 outside

Configure the Router ID with Loopback Address if you like to see the neighbour Id as 3.3.3.3 

[Charlie1010]

Hi Balaji,

Thanks for your help. Your solution solved this issue.

May I ask a further question?

In the same topology, the 192.168.244.2 is the real network gateway. But I cannot ping it successfully from ASAv.

ciscoasa(config)# ping 192.168.244.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.244.2, timeout is 2 seconds:
?????

Another issue is below, seems like 192.168.244.140 and .30 are from real network, but I don't know where they are.

Two DRs is also abnormal.

Outside#show ip ospf nei

Neighbor ID Pri State Dead Time Address Interface
202.200.200.254 1 FULL/DR 00:00:34 202.200.200.254 Ethernet0/0
192.168.244.140 1 FULL/DR 00:00:35 192.168.244.30 Ethernet0/1

Outside#show ip inter br
Interface IP-Address OK? Method Status Protocol
Ethernet0/0 202.200.200.1 YES TFTP up up
Ethernet0/1 192.168.244.5 YES TFTP up up
Ethernet0/2 unassigned YES TFTP administratively down down
Ethernet0/3 unassigned YES TFTP administratively down down
Loopback0 3.3.3.3 YES manual up up

192.168.244.2 is even not OSPF neighbor to ASAv.

What I want to implement is ping 8.8.8.8 (Google) from inside_2, but at the current stage, I cannot even ping the gateway. Any good idea on it? Thanks.

[balaji.bandi]

I do not have any visibility of the config, so OSPF redistribute connected networks to other Peers, so ASA seeing that routes.

Sending 5, 100-byte ICMP Echos to 192.168.244.2, timeout is 2 seconds:
?????

we post the config with more information. ( did your Outside Router do NAT ?)

[Charlie1010]

Hi Balaji,

I attached the configuration files and the route.

NAT is not configured on Outside router. 192.168.244.2 is vmnet8 gateway. Vmnet8 is running in NAT mode.

Thanks for your help.

[Charlie1010]

Hi Balaji,

Another obnormal is when I try to ping 192.168.244.2 from inside_2, seems like the packets are going through port dmz, not outside.

ICMP echo request from inside2:7.7.2.1 to dmz:192.168.244.2 ID=47 seq=1 len=72
ICMP echo request from inside2:7.7.2.1 to dmz:192.168.244.2 ID=47 seq=2 len=72
ICMP echo request from inside2:7.7.2.1 to dmz:192.168.244.2 ID=47 seq=3 len=72
ICMP echo request from inside2:7.7.2.1 to dmz:192.168.244.2 ID=47 seq=4 len=72

dmz ip add is 192.168.244.20/24, cannot figure out the reason.

[balaji.bandi]

192.168.244.2  - as per my understanding, this IP is your ISP Router behind IP. 

Lets do some tests here 

From Outside Router are you able to ping 8.8.8.8

By Nature ASA not allow Ping until you specific allow (not looked at the config - will go through later)

You want all these to work, On your Outside Router, you need to deploy NAT, 

You Lab ------(what ever IP range ) inside ---(Outside Router) - Outside interface 192.168.244.X/24 

[Charlie1010]

Hi  Balaji,

Thanks for your help again.

Outside Router can ping 8.8.8.8 successfully, this function is already implemented by VMware virtual network adapter.

Outside#ping 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 13/13/14 ms

Below is Outside Router interfaces configuration.

Outside#show ip inter br
Interface IP-Address OK? Method Status Protocol
Ethernet0/0 202.200.200.1 YES TFTP up up               --> connected to ASAv port outside
Ethernet0/1 192.168.244.5 YES TFTP up up               --> connected to real network (ISP) gateway
Ethernet0/2 unassigned YES TFTP administratively down down
Ethernet0/3 unassigned YES TFTP administratively down down
Loopback0 3.3.3.3 YES TFTP up up

Also make a default static route pointed to the gateway

S* 0.0.0.0/0 [1/0] via 192.168.244.2

And from ASAv Policy-map, icmp is inspected

policy-map global_policy
class inspection_default

   inspect icmp

So is there any configuration I missed?

[balaji.bandi]

On outside Router try below config and test :

interface Ethernet0/0
no shutdown
ip address 202.200.200.1 255.255.255.0
ip nat inside
!
interface Ethernet0/1
no shutdown
ip address 192.168.244.5 255.255.255.0
ip nat outside
!
ip nat inside source list internet interface Ethernet0/1 overload
!
ip access-list standard internet
permit any

[Charlie1010]

Hi Balaji,

Do I need to configure the ip nat outside? It's an incomplete command.

I configured other stuff as you pointed out.

Outside#show run | b nat
ip nat inside source list internet interface Ethernet0/1 overload

Outside#show run 
ip access-list standard internet

permit any

And the result is the same as before. ASAv cannot ping 192.168.244.2 neither 8.8.8.8

[balaji.bandi]

Do I need to configure the ip nat outside? It's an incomplete command.

Its under interface command not global command :

interface Ethernet0/1
no shutdown
ip address 192.168.244.5 255.255.255.0
ip nat outside
!

same for inside  :

interface Ethernet0/0
no shutdown
ip address 202.200.200.1 255.255.255.0
ip nat inside
!

Once this is done, 

Try ping  from router using inside interface

ping 8.8.8.8 source ethe 0/0 ( you should able to get reply success)

if not post router config again after changing.

[Charlie1010]

Hi Balaji,

After configured, ping 8.8.8.8 source eth 0/0 is successful.

But ping 8.8.8.8 from ASAv is still unsuccessful. Thanks.

[balaji.bandi · Accepted solution]

I need to review your ASA config - I will do it later when I get the chance today. in detail.

on ASA you do not need NAT since you already doing an uplink router until you have a different purpose.

Are you trying ping from ASA router, how about behind ASA inside network ?  is that works ?

high level ASA route wrong. it should be next hop, 

no route outside 0.0.0.0 0.0.0.0 192.168.244.2 1

route outside 0.0.0.0 0.0.0.0 202.200.200.1 1

[Charlie1010 · Accepted solution]

Hi Balaji,

Much appreciated.

After 

no route outside 0.0.0.0 0.0.0.0 192.168.244.2 1

route outside 0.0.0.0 0.0.0.0 202.200.200.1 1

Inside router can ping 8.8.8.8 successfully.

May I know why this works?

I will research the solution carefully.

Thanks again.

[balaji.bandi · Accepted solution]

ASA do not know how to reach 192.168.244.2 its not the next hop,. the route should be always the next Hop when you using a Static route.

OSPF should also learn the route and make it possible to route as an exit point, but a static route takes precedence always.

If all good make it resolve or solution, so it is useful for other community users.