Cisco ASA 5506x OSPF Issue ASA 9.14

[ashley_dew]

Hi,

I am having an issue with a Cisco ASA 5506X and ospf routing and running ASA 9.14.

The Cisco ASA is connected to edge router and learning default route from the edge router.

The adjacency is established between the router and the ASA in full and routes are learnt in the ospf database and populated but not installed in the routing table

 sh ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
x.x.x.x 1 FULL/BDR 0:01:59 x.x.x.x outside

I also see the default route in the ospf database

Type-5 AS External Link States

Link ID ADV Router Age Seq# Checksum Tag
0.0.0.0 x.x.x.x 2019 0x80001a82 0x80fa 1

But the routing table never show this default route.

For information the link between the Edge Router and the firewall is in area 1.

The Edge router also receives the default route from an OSPF domain in area 0.

May be the issue is with area configuration. The firewall needs to be connected to area0 to receive the routes.

Another point the edge router advertises the default route and some 100 routes.

Is possible that the ASA 5506X has some restrictions in terms of routing table capacity as the adjacency seems to take 5 minutes to form.

Can you please help?

Thanks and Regards,

[Richard Burts]

There are things that we do not know and these might impact our answers. But based on what we know so far this is my best guess at the explanation. You do tell us that the default route learned via area 1 is external. You tell us the ASA also learns a default route via area 0. I am guessing that this default route from area 0 is an internal route. OSPF will always prefer an internal route over an external route.

[MHM Cisco World]

ASA-Edge router-SP Router

I think the SP Core is MPLS not IP Core.

Edge router -area 0-SP

ASA-area1-Edge router 

I think the problem is you config default route toward edge router.

static prefer than OSPF because of AD.
please confirm that.

[ashley_dew]

Hi,

I finally found the issue. The edge router was configured as ospf point to mulitpoint. ASA does not support that type of network. Changing the network to broadcast type on the Edge router enabled router to be injected.

Thanks and Regards,

[Richard Burts]

Thanks for the update letting us know that you have solved your own problem. And thanks for telling us what the problem was. I believe that this might be helpful to other participants in the community.