Route not redistributing

[NetworkMonkey101]

Routes 213.251.59.0/29(MCR-Systems-Tills)  , 81.136.231.141/32 and 82.152.31.5/32 (TelephoneTechnology) are not being redistributed

The static entries exist in the routing table and are included in the route-map but don’t seem to behave in the same way as 192.168.208.0/24 which is being redistributed.

Below is the configuration from the CLI of the FTD

route-map STATIC_INTO_OSPF permit 10
match ip address prefix-list SecureBoundary_DC1

!
route-map STATIC_INTO_OSPF permit 20
match ip address prefix-list HIN_VPN_Clients

!
route-map STATIC_INTO_OSPF deny 30
match ip address prefix-list Planet_FM

!
route-map STATIC_INTO_OSPF permit 40
match ip address prefix-list Parking
set metric 110
set metric-type type-2

!
route-map STATIC_INTO_OSPF permit 50
match ip address prefix-list GE_Support

!
route-map STATIC_INTO_OSPF permit 60
match ip address prefix-list MCR-Systems-Tills
set metric 100
set metric-type type-2

!
route-map STATIC_INTO_OSPF permit 70
match ip address prefix-list TelephoneTechnology
set metric 100
set metric-type type-2

!
router ospf 1
router-id 192.168.250.94
network 46.254.185.248 255.255.255.248 area 0
network 192.168.90.0 255.255.255.0 area 0
network 192.168.208.0 255.255.255.0 area 0
network 192.168.236.0 255.255.255.0 area 0
network 192.168.254.0 255.255.255.0 area 0
no nsf Cisco helper
no nsf ietf helper
no capability opaque
no capability lls
no compatible rfc1583
log-adj-changes
redistribute static route-map STATIC_INTO_OSPF

Why are the MCR System and TelephoneTechnology routes not being advertised?

static routes configured as a workaround with admin distance of 254 so they’d be superseded by a route from OSPF if one existed.

[David Ruess]

Hello,

Can you supply the Prefix list config and the Static route config here?

[NetworkMonkey101]

prefix-list GE_Support seq 5 permit 150.2.0.0/16
!
prefix-list HIN_VPN_Clients seq 5 permit 192.168.208.0/24
prefix-list HIN_VPN_Clients seq 10 deny 192.168.208.0/24 le 32
!
prefix-list MCR-Systems-Tills seq 5 permit 213.251.59.0/29
!
prefix-list Parking seq 5 permit 81.134.40.176/32
prefix-list Parking seq 10 permit 81.141.198.226/32
!
prefix-list Planet_FM seq 5 permit 217.72.254.97/32
prefix-list Planet_FM seq 10 permit 85.133.123.97/32
!
prefix-list SecureBoundary_DC1 seq 5 permit 10.121.0.3/32
!
prefix-list TelephoneTechnology seq 5 permit 81.136.231.141/32
prefix-list TelephoneTechnology seq 10 permit 82.152.31.5/32

route Outside 81.136.231.141 255.255.255.255 46.254.185.249 1
route Outside 82.152.31.5 255.255.255.255 46.254.185.249 1

route Outside 213.251.59.0 255.255.255.248 46.254.185.249 1
!

[paul driver]

Hello
Try change the Rm to accommodate the most specific stanza first and also combining the PF entries

Example

route-map STATIC_INTO_OSPF permit 10
match ip address prefix-list (Parking & TelephoneTechnology)
set metric 110
set metric-type type-2

route-map STATIC_INTO_OSPF permit 20
match ip address prefix-list (SecureBoundary_DC1  &  HIN_VPN_Clients  & GE_Support)

router opsf
redistribute static route-map STATIC_INTO_OSPF subnets

[Giuseppe Larosa]

Hello @NetworkMonkey101 ,

>> Below is the configuration from the CLI of the FTD <>>>>>>>>>>>>>>>>

take a long bresth .

until vey shirt ttime ago OSPF was still performed on the CLI.

Use a gradual approach :start by advertising subnets direcly connnected.

then addding a static routed see .

all interfaces are/may associated to zones.

if you want the OSPF adiaceynces to need to allow them Bidir betwwen selected pirs of interfaces.

I woud advice to study first;;;;;;;;;;; Before sending a similar Anaconda posts

Edit:

In the past I was able to use muplipe OSPFv2 prcoesses in a multii context with AS5500X in Ha pir

Hope to help

Giuseppe

[NetworkMonkey101]

I have checked the prefix and route map and all is OK, there is a slight difference in the OSPF setup on my new FTD compared to the ASA whereas the FTD states the OSPF role is in "ASBR" and I cannot find that same statement within the ASA/ASDM.. could this be the cause and where is this setting in ASDM

Also the static route names did not match the prefix/route map names for the network and were only using the IPs as naming. I have amended the static routes to use the same name as the prefix and route map..

I have also noticed the Interfaces within the OSPF setup were only using inside which is where the VPN client subnet resides. The MD5 auth was set but nothing for outside where the MCR and TelephoneTechnology subnets are.. I have added these even though there is no auth. They are just defined on the old ASA/ASDM so now that matches.. would this cause the issue?

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107196-ASA8-OSPF.html

There is no command to config asa as asrb' the asa is become asbr when it redistrubte any external prefix into ospf 

MHM

[MHM Cisco World]

FYI' I see in fmc you can config ftd role as abr or asbr...etc. 

But for asdm I will make double check 

Thanks 

MHM

[Cristian Matei]

Hi,

    None of the changes you're mentioning are required for this to work. Do I understand correctly that now it works? Regardless, can you post the current OSPF config and outputs of "show route static" as well as "show ospf database external"?

Best,

Cristian.

[NetworkMonkey101]

Still not working, I am having to add static routes as it is not being learned via redistribution. 

[Cristian Matei · Accepted solution]

Hi,

    Reason why none of the static routes ar being redistributed into OSPF (except 192.168.208.0/24) is because you failed to enabled the "subnets" option upon redistribution of static routes into OSPF.

Best,

Cristian.

[NetworkMonkey101]

You are right, I was just starting to think this may be the issue.

[MHM Cisco World]

Sorry what is ftd ver you have 

Thanks 

MHM

[NetworkMonkey101]

7.2.7. The option is on ASDM but I did not see it.

[MHM Cisco World]

I am little sure I see prefix in your RIB you share with not classful mask.

Anyway check subnet keyword and update me about result 

If not work share show ip opsf db external <prefix not seen>

MHM