Verifying routes are being filtered with route-maps and tagging.

[Liam Kenneally]

Hi All, 

I am looking for a redistribution wizard out there! 

I am currently studying my CCNP and have built a two-way redistribution topology with dual transit/redistribution routers. I have successfully redistributed routes from OSPF into EIGRP and visa-versa. I can verify the routes are tagged with the show ip route <NETWORK> command

The issue I am facing is how do I verify routes that I am filtering; I am using a route-map to stop routes that have been redistributed into OSPF from EIGRP bleeding back into OSPF. I am confident from the configuration my route map is doing the job; however how can I verify this. 

The show route-map <ROUTEMAPNAME> command counters will not increment as I believe these only come into play with PBR. So is thier a similar show command or even a debug I can use to verify this. For example if I walked into a production network and a route was not being seen how would I verify this. I hope this makes sence! Please see the topology and configurations below(If you are use/have used the CBT nuggets training, you may be familiar with this topology. 

Topology(Diagram)

** Cisco forums does not like google-drive urls; so I have uploaded a screenshot of the topology **

relevant config snippets

R2 

R2#sh run | s route-map
 redistribute ospf 1 route-map OSPF_TO_EIGRP
 redistribute eigrp 100 subnets route-map EIGRP_TO_OSPF
route-map EIGRP_TO_OSPF deny 5
 match tag 40
route-map EIGRP_TO_OSPF permit 10
 match ip address 1
 set metric 100
 set metric-type type-2
 set tag 10
route-map EIGRP_TO_OSPF permit 20
 match ip address 2
 set metric 200
 set metric-type type-2
 set tag 20
route-map EIGRP_TO_OSPF deny 30
 match ip address 3
route-map EIGRP_TO_OSPF permit 40
 set metric 300
 set metric-type type-2
 set tag 30
route-map OSPF_TO_EIGRP deny 5
 match tag 10 20 30
route-map OSPF_TO_EIGRP permit 10
 set metric 400 20 255 1 1500
 set tag 40
R2#sh run | s access-l 
access-list 1 permit 10.4.0.0 0.0.0.255
access-list 1 permit 10.4.1.0 0.0.0.255
access-list 2 permit 10.4.2.0 0.0.0.255
access-list 2 permit 10.4.3.0 0.0.0.255
access-list 3 permit 10.4.4.0 0.0.0.255

R2#
R2#sh run | s eigrp
router eigrp 100
 redistribute ospf 1 route-map OSPF_TO_EIGRP
 network 10.1.23.0 0.0.0.255
 network 10.1.24.0 0.0.0.255
 no auto-summary
 redistribute eigrp 100 subnets route-map EIGRP_TO_OSPF
R2#sh run | s ospf 
 redistribute ospf 1 route-map OSPF_TO_EIGRP
router ospf 1
 router-id 2.2.2.2
 log-adjacency-changes
 redistribute eigrp 100 subnets route-map EIGRP_TO_OSPF
 passive-interface default
 no passive-interface Serial0/0
 network 10.1.12.0 0.0.0.255 area 0

R3

Has exactly the same config as R2.

If you need any more info, let me know. :) 

Cheers, 

Liam

[Jon Marshall]

Liam

For example if I walked into a production network and a route was not being seen how would I verify this.

Well, you would go onto the router doing the redistribution and check the configuration.

The acls will show hits so you can see if there are any matches.

And with EIGRP and OSPF on the router doing the redistribution you can check the EIGRP topology table and the OSPF database and you should see the routes that have been redistributed.

If the routes are not in either of those tables and it is a route you want redistributed then you know something is wrong with the configuration.

If I have misunderstood what you are asking please clarify.

Jon

[Liam Kenneally]

Hi Jon, 

Thanks for your prompt reply, maybe it is my bad explanation skills. But here is what I am trying to get at.

I know my redistribution is working correctly with my route map as I can run the following command and see that my route is A) Tagged and B) got its specified seed metric from the Route-map 

R1#sh ip route 10.4.3.0 
Routing entry for 10.4.3.0/24
  Known via "ospf 1", distance 110, metric 200
  Tag 20, type extern 2, forward metric 64
  Last update from 10.1.13.3 on Serial0/1, 01:02:00 ago
  Routing Descriptor Blocks:
    10.1.13.3, from 3.3.3.3, 01:02:00 ago, via Serial0/1
      Route metric is 200, traffic share count is 1
      Route tag 20
  * 10.1.12.2, from 2.2.2.2, 01:02:00 ago, via Serial0/0
      Route metric is 200, traffic share count is 1
      Route tag 20

I can also verify that my Route-map is denying the 10.4.4.0 network as it does not appear in the routing table of R1

R1#sh ip route 
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     10.0.0.0/24 is subnetted, 9 subnets
C       10.1.13.0 is directly connected, Serial0/1
C       10.1.12.0 is directly connected, Serial0/0
C       10.1.0.0 is directly connected, Loopback0
O E2    10.4.2.0 [110/200] via 10.1.13.3, 01:03:34, Serial0/1
                 [110/200] via 10.1.12.2, 01:03:34, Serial0/0
O E2    10.4.3.0 [110/200] via 10.1.13.3, 01:03:34, Serial0/1
                 [110/200] via 10.1.12.2, 01:03:34, Serial0/0
O E2    10.4.0.0 [110/100] via 10.1.13.3, 01:03:34, Serial0/1
                 [110/100] via 10.1.12.2, 01:03:36, Serial0/0
O E2    10.4.1.0 [110/100] via 10.1.13.3, 01:03:36, Serial0/1
                 [110/100] via 10.1.12.2, 01:03:36, Serial0/0
O E2    10.1.24.0 [110/300] via 10.1.13.3, 01:03:36, Serial0/1
                  [110/300] via 10.1.12.2, 01:03:36, Serial0/0
O E2    10.1.23.0 [110/300] via 10.1.13.3, 01:03:37, Serial0/1
                  [110/300] via 10.1.12.2, 01:03:37, Serial0/0

However, If you look at my R2 config. I have under my route-maps (seq 5) a deny statement to stop OSPF routes that have been redistributed into EIGRP; then bleeding back into OSPF and causing a route loop. 

However how can I verify(physically see) R2 & R3 are dropping packets I have filtered with the route-map deny statements. 

I.E 

route-map EIGRP_TO_OSPF

This route-map (seq 10) tags OSPF routes with the following as it enters EIGRP 

Set clauses:
    metric 400 20 255 1 1500
    tag 40 

As per above commands I can verify this. 

However I cannot verify (seq 5) 

route-map OSPF_TO_EIGRP, deny, sequence 5
  Match clauses:
    tag 10 20 30 

Does this make sense? 

Kind Regards,

Liam

[Jon Marshall]

Liam

Is that not what hits on your acls that you use in your route map are showing ie. matches.

Or are you looking for a specific command to say here is a list of routes that were not redistributed ?

If so I'm not aware of such a command but it doesn't mean there isn't one :-)

Jon

[Liam Kenneally]

No my ACLs will match the subnets. (Yes I agree there will be hits on here) 

But the ACLs I am using to dictate which tag is set on the route-map NOT to dictate what tags should be dropped by the route map. 

Lets take a specific route for examples sake. 

10.1.0.0 for example as it is a single loopback on in the OSPF domain. 
 

I just used 

route-map OSPF_TO_EIGRP permit 10
 set metric 400 20 255 1 1500
 set tag 40

when I apply the following

 redistribute ospf 1 route-map OSPF_TO_EIGRP
 

My OSPF routes will be redistributed into EIGRP with the 40 tag and the composite metric.

However I DO NOT want EIGRP to redistribute my 'redistributed route' BACK into OSPF

so I have the following seq 5 in place... 

route-map EIGRP_TO_OSPF deny 5
 match tag 40 

Basically the above says if you see tag 40(meaning it originated from OSPF) filter/drop the packet. 

This stops routes being indefiniotly redistributed. 

However how can I see from R2 by using a debug, show command or some sort of counters that the route-map EIGRP_TO_OSPF is in fact dropping my tag 40 traffic. 

This is where im miffed. I have NO WAY from what I can see to verify that the seq 5 on the route-map is doing its job hence dropping the routes. 

I would expect to see a debug showing route drops or a counter under a show command increment. 

But I see nothing. 

Hope my example was clearer. 

Kind Regards,

Liam

[Jon Marshall]

Liam

I see what you are saying now, should have read your original configuration more closely.

Not aware of any command to view this but I might lab it up and see if I can find one.

For me I tend to work it out based on what you see in the routing tables eg.

if none of the EIGRP or OSPF routes you were redistributing were externals then by definition your route map would be working if you didn't see any externals for the same internal route in the same routing process if that makes sense.

But obviously if there were existing externals in either routing process you would then need to start looking at topology tables and the OSPF database.

So yes, I understand the question and like I say i'll have a look when i get the chance unless someone else can provide the answer (assuming there is one).

Jon

[Liam Kenneally]

Hi Jon, 

Got there in the end :) ... 

Your explanation is very helpful in the event of no verification command. 

I will remove the deny seq in my GNS3 lab and see what external routes I get cropping up in the routing table. 

I can then look closer at the topology table and OSPF database like you mention and see how this affects the topology. 

If there is no verification, I can at least see how the topology looks with routes bleeding across. However I am assuming OSPF/EIGRP's built in loop prevention mechanisms may kick in anyway. 

But again, thanks for your feedback. 

Kind Regards,

Liam

[Jon Marshall]

Liam

No problem. my fault for not reading your question carefully enough :-)

If you do test it you would have to look in the EIGRP topology table and the OSPF database because the internal routes would always be preferred by both routing protocols so the routing table isn't really going to show you anything.

If I do get a chance to lab this up and find anything more useful I'll let you know.

Jon

[Liam Kenneally]

Ah of course! I would have looked there ;) ... Just been bashing my head against the monitor for that long trying to work out a way to verify this. 

I think I just need to walk away, take a break, get a drink. Then come back break the topology and see what happens ;) ... 

If you do play with the topology, please let me know! If you have GNS3 I will upload the configs for you in a text file. 

Cheers, 

Liam

[Jon Marshall · Accepted solution]

Liam

I know exactly what you mean, sometimes a break is all you need to see things more clearly :-).

No GNS3 but I have access to an online lab and I can pretty much work out from your configuration and diagram what you are doing so if I get the chance over the weekend I'll try it out.

Jon

[Liam Kenneally]

Thank you for your time and effort Jon! Much appreciated. 

Kind Regards,

Liam

[Liam Kenneally]

Full configs for R1, 2,3 & 4 attached. Plus screenshot.png(which is the logical topology). 

For you to have a play with in your own leisure :) 

Kind Regards,

Liam

[Jon Marshall]

Liam

I finally got around to testing this and unfortunately I could not find any command that showed you the number of matches against just the tag clause.

I think you just have to use the IP routing tables or in your case the EIGRP topology and OSPF database to see exactly what has been redistributed and what hasn't.

Jon