How to assign custom route Tag in ASA

[munaf shaikh]

Dear All,

On our ASA(9.18), we are running OSPF and BGP, and are redistributing BGP routes into OSPF.

We want the redistributed routes to be tagged with a custom route tag. However, on ASA there is no option to tag routes using set command under route-map config. I know this option is available on routers. 

Can someone please let me know how I can tag the redistributed routes. 

I can see an option of automatic-tag, however I believe this option will assign a random tag to routes. And I am not sure whether this automatic tag is a constant value which will remain same forever or it's a variable which might get change on its own.

We do not want the tag to be changed ever, because it will create a major impact in our environment.

We will be using this custom assigned tags on our WAN router and deny the tagged routes from being redistributed into BGP.

Please also let me know if you can think of any other way to achieve this. 

Please note : We do not want to create prefix lists as BGP routes might dynamically change.

Thank you in advance.

[MHM Cisco World]

the BGP-into-OSPF the prefix is by default tag with value same as BGP AS prefix come from. 
for example if BGP AS-100 the prefix is auto tag with tag =100

[munaf shaikh]

That's correct, but on ASA, we have two BGP neighbors with same AS number - 12076(Azure).

One BGP peer is with Azure Private cloud and another with Azure public cloud, both have same AS number.

We want the routes which are learned from public cloud neighbor to be denied from being redistributed back into the BGP at our WAN router. 

Azure--(BGP)-->ASA ---(OSPF)--->Coreswitch---(OSPF)--->WAN Router---(BGP)---->BRANCH Router

[MHM Cisco World]

BGP-into-OSPF the prefix will tag with BGP AS come from 
OSPF-into-BGP with route-map (set as-path tag) the prefix will have as-path same as tag/ AS 
now when other router receive prefix with as-path contain it AS number it drop this prefix (loop prevent). 

[munaf shaikh]

Sorry, but I have not understood the solution.

On ASA, BGP-into-OSPF will tag routes with AS number. Ok

On WAN Router, OSPF-into-BGP, add as-path tag, which will do nothing. As as-path and the tag both will be same.

Brach routers will receive this routes from WAN router because AS number of branch routers are different than route tag (as-path tag) 

Let me know if i miss anything. 

[MHM Cisco World]

only add AS to your topology and I will explain to you 

[munaf shaikh]

Here it is buddy. 

(Azure) =={BGP 12076}==(ASA)--{OSPF 1}--(Coreswitch)--{OSPF 1}--(WAN Router) - -{BGP 65521} - - (Branch Router)

Between azure and ASA, there are 2 peers with same ASN 12076

[MHM Cisco World]

one Peer Azure send prefix and you config 
BGP-into-OSPF 
OSPF-into-BGP in ASA 
you want the prefix learn from one peer never resend to other peer ? is may topology right ?

 

[munaf shaikh]

Hi Buddy,

Below is the our topology with couple of sample routes.

On ASA, 1.1.1.1 is learned from peer 1.

10.0.0.1 is learned from peer 2.

We do not want routes learned from BGP peer 1 on ASA to be advertised to Branch router.

Only the routes learned from peer 2 must be advertised to Branch router

[MHM Cisco World]

I run small lab, hope this solution for you 

[munaf shaikh]

Won't this deny routes learned from both R1 and R2?

Btw i have gone with same solution to deny routes learned from both R1 and R2 on the basis of Route tag of the AS number. And then allow routes learned from R2 on the basis of prefixes

[MHM Cisco World]

according to my topology I will assume R1 is public and you want only WAN router to advertise the route from R2 and deny the route from R1?

[MHM Cisco World]

we use route-map IN and set comm for any prefix learn from R1 
and then use the OSPF-into-BGP route-map to modify the tag to be 1000
in WAN we will deny any prefix with tag 1000