I found a problem with our ASAs when trying to create two crypto maps from a remote ASA to two ASAs at our core site. Basically the outside Internet address of the remote ASA is being injected into the routing table from both core ASAs even though neither should even be doing this!
I am trying to figure out how to prevent these remote addresses (dynamic IPs on the remote site ASAs) from being imported into the core routing table by the core ASAs.
Since the remote ASAs are creating branch to branch tunnels to the main core site, I still need the core ASAs to be able to inject those routes for the remote site lans into the core routing tables.
The remote sites can have small subnets of these three networks so any route must get injected (imported) into the routing table at the core.
10.42.0.0 /16
192.168.0.0 /16
172.22.0.0 /16
I want to block any other route from being injected into the core routing table by the core ASAs.
I do not even know if what I am trying to do will work...so far no success....below is what I tried on my last test. I have a simulated setup to test any route-policy.
MAIN CORE SITE TEST ASA
interface Ethernet0/0
nameif outside
security-level 0
ip address 173.22.122.82 255.255.255.0
ospf cost 800
ospf authentication-key OCIS
ospf database-filter all out
ospf authentication
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 10.42.199.155 255.255.255.240
ospf cost 100
ospf authentication-key OCIS
ospf authentication
access-list OSPF-DENY standard permit any
access-list OSPF-PERMIT standard permit 10.0.0.0 255.0.0.0
access-list OSPF-PERMIT standard permit 172.22.0.0 255.255.0.0
access-list OSPF-PERMIT standard permit 192.168.0.0 255.255.0.0
route-map OSPF permit 10
match ip address OSPF-PERMIT
match ip next-hop OSPF-PERMIT
!
route-map OSPF deny 20
match ip address OSPF-DENY
match ip next-hop OSPF-DENY
!
router ospf 100
router-id 10.42.199.155
network 10.0.0.0 255.0.0.0 area 0
log-adj-changes
redistribute static metric 111 route-map OSPF
ANY IDEAS would be helpful...thanks!
