How to EIGRP create & distribute a return route for L2L VPN traffic?

[MicJameson1]

Hello.

I need to create and

EIGRP distribute a return route 

for L2L VPN traffic with remote tunnel destination 172.16.33.0/24.

It makes sense to source and

distribute

this route from the ASA that is the L2L endpoint.

The inside interface of the ASA is 172.16.1.5

I decided to create a

static router

in the ASA, then

redistribute it via EIGRP.

There is something basic I'm not understanding in the config, because I appreciate that here I'm trying to create a route that is not needed in the ASA itself. Behold output...

ASA1120(config)# route inside 172.16.33.0 255.255.255.0 172.16.1.5
ERROR: Invalid next hop address 172.16.1.5, it matches our IP address

My intent is to tell the LAN to send the packets to this ASA (so the ASA will send the packets over the tunnel). What is the best way to enable my intent of creating then

EIGRP distributing a return route

for L2L VPN traffic with remote destination 172.16.33.0.?

Thank you.

[Giuseppe Larosa]

Hello @MicJameson1 ,

you can try to use a

static route

pointing to the external interface the one with the crypto map applied so that the

static route

provides the same path as the crypto map. Traffic will be encrypted.

A static route

to inside looks like not the better choice as it would route to the internal network .

Then you advertise the

static route into EIGRP by using redistribute static + route map

Hope to help

Giuseppe

[MicJameson1]

I adjusted the route next hop to the IP address of the external interface of the ASA, but i receive same error...

ERROR: Invalid next hop address 1.2.3.4, it matches our IP address

[Giuseppe Larosa · Accepted solution]

Hello  @MicJameson1 ,

the next-hop must be the gateway on the external interface this is the reason why you get the error, you need to specify the actual next-hop and it cannot be the ASA address on the external interface.

By the way, if your ASA is injecting a

default route into EIGRP routing

domain you even don't need to add this specific route.

Hope to help

Giuseppe