Solved: Re: configuring RIP between a Pix and a 4500 switch - Page 2

Kevin Melton · ‎12-29-2009

I have a 4500 switch which is in the center of one of my customers networks. The 4500 effectively routes between all the production VLAN's for the customer.

I have a PIX connected to the switch in VLAN 1. I have just configured RIP v1 as follows on the PIX:

rip outside passive version 1

rip inside passive version 1

rip inside default version 1

I used a sniffer and captured the RIP updates between the 4500 and the PIX. I see the pix sending out a RIP update for the default route. However I do not ever see the 4500 update it routing table to reflect it

It is unclear to me why the 4500 wont update it route table with the default route from the PIX. I want this to be a secondary default route in case the Main static route goes down.

Thanks

Kevin

Kevin Melton · ‎01-14-2010

This makes me want to ask then about EIGRP. I understand that it is a bit overkill for this little network, however because it is link state would it not suffice? I think that all the devices will support it on the ASA side leading to the Internet (Border Router, ASA Outside, DMZ switch which is a 3550 model, and Inside ASA?

If the Border router loses its Ethernet facing outside, then would EIGRP propogate the loss since it is a topology change down the line until it reached the Core Router?

Thanks Jon

Kevin

Jon Marshall · ‎01-14-2010

k-melton wrote:

This makes me want to ask then about EIGRP. I understand that it is a bit overkill for this little network, however because it is link state would it not suffice? I think that all the devices will support it on the ASA side leading to the Internet (Border Router, ASA Outside, DMZ switch which is a 3550 model, and Inside ASA?

If the Border router loses its Ethernet facing outside, then would EIGRP propogate the loss since it is a topology change down the line until it reached the Core Router?

Thanks Jon

Kevin

DMZ 3550 switch, if this is L2 then it doesn't need to support EIGRP. If L3 then you need EMI image on it.

You would have a default-route on the border router pointing to the next-hop ISP address and redistribute this into EIGRP. This will then be an EIGRP external route with an AD of 170 so make sure your floating static has a higher AD.

Once the route is removed from the border router then yes it will propogate all the way back to your 4500 and it will be removed and so the floating static you have configured on your 4500 to the other ASA will then be used. The only thing i'm not 100% sure about is will the route be removed if the interface goes down and i'm not sure it will because you are not receiving this route from your ISP, you are actually originating it on the border router.

So it will need testing. If i have time tomorrow i will lab it up for you.

Edit - actually if the interface goes down the route will be removed. It's more a question of what happens if the remote ISP router goes down that needs testing. What connectivity is there between your border router and the ISP router ie. is it ethernet or serial ?

Jon

Kevin Melton · ‎01-26-2010

Jon

Sorry for the delay in my response.

We have a Metro Ethernet connection to the ISP...

Is the command that I use to redistribute the static

router eigrp 100

redistribute static ( i am not sure of the rest) seems the options are route-map or metric

Thanks Jon

Kevin

Jon Marshall · ‎01-26-2010

k-melton wrote:
Jon
Sorry for the delay in my response.  
We have a Metro Ethernet connection to the ISP...
Is the command that I use to redistribute the static 
router eigrp 100
redistribute static ( i am not sure of the rest)  seems the options are route-map or metric
Thanks Jon
Kevin

Kevin

You don't need to specify a metric when you redistribute static routes into EIGRP (altho you do need a metric for redistributing everything else into EIGRP !!).

The route-map would be used if you had a number of static routes on the device and you only wanted to redistributed some of them.

So "redistribute static" should do the trick for you.

Jon

Kevin Melton · ‎01-26-2010

Because I have static routes on the Border router which point to the client inside network addresses, I had to write the following route-map and ACL

route-map static permit 10
match ip address 20

bhigw2#sho access-list 20
Standard IP access list 20
10 permit 0.0.0.0 (2 matches)
20 deny any (28 matches)

Once I did this, I could see the 0 route advertised out. What I am not seeing is the 0 route in the ASA (his EIGRP neighbor) route table. The only 0 route is the static configured on it...

thx

Kevin

Jon Marshall · ‎01-26-2010

k-melton wrote:
Because I have static routes on the Border router which point to the client inside network addresses, I had to write the following route-map and ACL
route-map static permit 10
 match ip address 20
bhigw2#sho access-list 20
Standard IP access list 20
    10 permit 0.0.0.0 (2 matches)
    20 deny   any (28 matches)
Once I did this, I could see the 0 route advertised out.  What I am not seeing is the 0 route in the ASA (his EIGRP neighbor) route table. The only 0 route is the static configured on it...  
thx
Kevin

Kevin

If you have a statically configured default route on the ASA then a default route learnt from EIGRP will not replace it or be entered into the routing table. You would need to remove the statically configured route and then the EIGRP route would be used.

Presumably the default route from EIGRP is using the same next-hop as the statically configured default route on the ASA ?

Before you do this run this command on the ASA "sh eigrp topology all-links". You should see the EIGRP routes learnt from your border router and hopefully the default route will be there.

Jon

Kevin Melton · ‎01-26-2010

I ran the command "sho eigrp top all-links" as you had indicated. This showed

the learned routes just as you had indicated (way to go Jon!).

Here is a snapshot:

bhiasaop# sho eigrp top all

EIGRP-IPv4 Topology Table for AS(100)/ID(206.248.224.2)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
r - reply Status, s - sia Status

P 0.0.0.0 0.0.0.0, 0 successors, FD is Inaccessible, serno 0
        via 206.248.224.1 (33280/30720), Ethernet0/0
P 192.168.5.0 255.255.255.0, 0 successors, FD is Inaccessible, serno 0
        via 172.16.1.3 (30720/28160), Ethernet0/1
P 172.16.1.0 255.255.255.0, 1 successors, FD is 28160, serno 2
        via Connected, Ethernet0/1
P 206.248.224.2 255.255.255.255, 0 successors, FD is Inaccessible, serno 0
        via 206.248.224.1 (30720/28160), Ethernet0/0
P 206.248.224.0 255.255.255.0, 1 successors, FD is 28160, serno 3
        via Connected, Ethernet0/0

For some reason, the ASA is not propogating these routes inward towards the DMZ switch. I have tried toggling auto-summary on the ASA and receive these messages while running debug on the DMZ switch:

bhiedge#
Jan 26 16:18:59.672: %DUAL-5-NBRCHANGE: EIGRP-IPv4:(100) 100: Neighbor 172.16.1.2 (Vlan1) is down: peer restarted
Jan 26 16:19:00.140: %DUAL-5-NBRCHANGE: EIGRP-IPv4:(100) 100: Neighbor 172.16.1.2 (Vlan1) is up: new adjacency
Jan 26 16:19:01.680: EIGRP-IPv4(Default-IP-Routing-Table:100): 172.16.1.0/24 - do advertise out Vlan1
Jan 26 16:19:01.680: EIGRP-IPv4:(100): Int 206.248.224.0/24 M 28416 - 25600 2816 SM 28160 - 25600 2560
Jan 26 16:19:01.680: EIGRP-IPv4(Default-IP-Routing-Table:100): 206.248.224.0/24 routing table not updated thru 172.16.1.2
Jan 26 16:19:01.688: EIGRP-IPv4(Default-IP-Routing-Table:100): 172.16.1.0/24 - do advertise out Vlan1
Jan 26 16:19:01.688: EIGRP-IPv4:(100): Int 206.248.224.0/24 M 28416 - 25600 2816 SM 28160 - 25600 2560
Jan 26 16:19:01.700: EIGRP-IPv4:(100): Int 206.248.224.0/24 M 28416 - 25600 2816 SM 28160 - 25600 2560

What am I missing Jon?

Kevin

sachinraja · ‎01-26-2010

It is such an interesting post, and thought of barging in... i was reading the entire post for the past 20 mins and have a fair idea .. Sorry if i misunderstood something or asking questions which have already been answered here..

the dmz switch bhiedge is layer 3 ? I saw in some posts before that it was layer 2 ? are the L3 DMZ terminating on the bhiasaop firewall or the bhiedge switch (for the VLANs 172.16.1.x) ? can you please give "show ip eigrp neighbor" on the ASA bhiasaop firewall to check if it has a neighbor relation with bhiedge switch ? Why dont u have a direct eigrp neighborship with bhiasaip instead of having the switch in between (on L3) ? incase the dmz switch has eigrp configured, make sure you dont have passive interface configured for the layer 3 vlan ip subnets..

Raj

Kevin Melton · ‎01-27-2010

Raj

Dont feel like you are barging in. I welcome your help with this. John has been very gracious with his expertise on this and other posts.

To answer your questions

the dmz switch bhiedge is layer 3 ?

Yes it is L3. I have the one VLAN configured on it and it has an ip address on it that functions as the default gateway for the 4 servers in our DMZ.

Can you please give "show ip eigrp neighbor" on the ASA bhiasaop firewall to check if it has a neighbor relation with bhiedge switch ?

bhiasaop# sho eigrp nei
EIGRP-IPv4 neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO Q Seq
                                            (sec)         (ms)       Cnt Num
1   172.16.1.7              Et0/1            13     1d02h 3    200   0   44
2   172.16.1.3              Et0/1            14     1d02h 1    200   0   72
0   206.248.224.1           Et0/0            12     1d02h 6    200   0   41
bhiasaop#

Why dont u have a direct eigrp neighborship with bhiasaip instead of having the switch in between (on L3) ?

I think they are neighbors too?..

incase the dmz switch has eigrp configured, make sure you dont have passive interface configured for the layer 3 vlan ip subnets..

I dont have it configured as passive. See below:

bhiedge#sho run | begin router
router eigrp 100
network 172.16.0.0

Thanks Raj. Like I said, any input is welcome.

Kevin

sachinraja · ‎01-27-2010

Hi Kevin

Even if the DMZ switch isnt L2, it should learn the routes propagated by bhiasaop.. as Jon said, give a "no auto-summary" on the eigrp process to make sure it can support classless routing.. the outputs on asa bhiasaop looks good.. can you give us the output on bhiedge switch and bhiasaip of the EIGRP topology database ? show ip eigrp topology ? are these networks being advertised back from bhipix ??

can you make sure you have the internal network 172.16.1.0 on the switch and bhiasaip pix ? have no auto-summary on all switches and PIX running EIGRP...

lastly - you can run debug eigrp neigbor to check if the routes are being received on the dmz switch ?

note - if you want to make bhiedge a layer 3 switch, you should probably split up the broadcast domain between bhiasaop and bhiasaip... have seperate /30 networks between the switch and the firewalls, so that there are prominant eigrp neighbors defined...

Hope this helps.. all the best

Raj

Kevin Melton · ‎01-27-2010

Raj

I made sure that auto summary is turned off everywhere. Here are the outputs from bhiedge switch in the DMZ and bhiasaip (inside Firewall)

bhiedge#sho ip eigrp top all
EIGRP-IPv4 Topology Table for AS(100)/ID(172.16.1.7)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
r - reply Status, s - sia Status

P 206.248.224.0/24, 0 successors, FD is Inaccessible, serno 0
        via 172.16.1.2 (28416/28160), Vlan1
P 192.168.5.0/24, 0 successors, FD is Inaccessible, serno 0
        via 172.16.1.3 (28416/28160), Vlan1
P 172.16.1.0/24, 1 successors, FD is 2816, serno 1
        via Connected, Vlan1
bhiedge#

bhiasaip# sho ei top all

EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.10.20)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
r - reply Status, s - sia Status

P 192.168.10.0 255.255.255.0, 0 successors, FD is Inaccessible, serno 0
        via 192.168.5.1 (28416/2816), Ethernet0/1
P 192.168.11.0 255.255.255.0, 0 successors, FD is Inaccessible, serno 0
        via 192.168.5.1 (28416/2816), Ethernet0/1
P 192.168.5.0 255.255.255.0, 1 successors, FD is 28160, serno 1
        via Connected, Ethernet0/1
P 172.16.1.0 255.255.255.0, 1 successors, FD is 28160, serno 2
        via Connected, Ethernet0/0
P 198.100.100.0 255.255.255.0, 0 successors, FD is Inaccessible, serno 0
        via 192.168.5.1 (28416/2816), Ethernet0/1
P 206.248.224.0 255.255.255.0, 0 successors, FD is Inaccessible, serno 0
        via 172.16.1.2 (30720/28160), Ethernet0/0
bhiasaip#

When i turn on debugging on the Edge switch, I do not see anything happening with respect to EIGRP. No routes or anything else..

bhiedge#debug ip eigrp
IP-EIGRP Route Events debugging is on
bhiedge#debug ip eigrp top
% Incomplete command.

bhiedge#debug ip eigrp top ?
WORD Topology instance name

bhiedge#debug ip eigrp top 100
IP-EIGRP Route Events debugging is on
bhiedge#

Thanks Raj

Kevin

sachinraja · ‎01-27-2010

Hi kevin

I do see the routes for 206.248.224.0/24 on the dmz and bhiasaip firewall.... these are the routes which are propagated from the bhiasaop firewall right ? I see the following:

P 206.248.224.0 255.255.255.0, 0 successors, FD is Inaccessible, serno 0
via 172.16.1.2 (30720/28160), Ethernet0/0

can you give a show ip route on dmz and bhiasaip firewall and confirm if these routes are installed in the routing table ? are you having issues with reachability ?

Regards

Raj

Kevin Melton · ‎01-28-2010

No issues with reachability Raj. I have static routes configured for all networks everywhere. This is a milestone as I am

attempting for the first time to implement some dynamic routing on the network in order to facilitate the ability to failover to a different route to 0.0.0.0 if the main Internet connection fails. This is pretty well documented within the earlier parts of this chain between John and I.

I am simply trying to get the 0.0.0.0 route advertised by the Border Router to propogate down the line via EIGRP until it makes it into our Core Router.

I can post the route tables when I get onsite tomorrow if necessary. But the main focus and next step should be why the 0 route is not making it from the bhiasaop device to the bhiedge switch, as EIGRP ought to be shipping it to the switch from the Firewall. I am not sure why this is not happening.

Thanks

Kevin

Jon Marshall · ‎01-28-2010

k-melton wrote:

Raj

I made sure that auto summary is turned off everywhere. Here are the outputs from bhiedge switch in the DMZ and bhiasaip (inside Firewall)

bhiedge#sho ip eigrp top all
EIGRP-IPv4 Topology Table for AS(100)/ID(172.16.1.7)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
r - reply Status, s - sia Status

P 206.248.224.0/24, 0 successors, FD is Inaccessible, serno 0
        via 172.16.1.2 (28416/28160), Vlan1
P 192.168.5.0/24, 0 successors, FD is Inaccessible, serno 0
        via 172.16.1.3 (28416/28160), Vlan1
P 172.16.1.0/24, 1 successors, FD is 2816, serno 1
        via Connected, Vlan1
bhiedge#

bhiasaip# sho ei top all

EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.10.20)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
r - reply Status, s - sia Status

P 192.168.10.0 255.255.255.0, 0 successors, FD is Inaccessible, serno 0
        via 192.168.5.1 (28416/2816), Ethernet0/1
P 192.168.11.0 255.255.255.0, 0 successors, FD is Inaccessible, serno 0
        via 192.168.5.1 (28416/2816), Ethernet0/1
P 192.168.5.0 255.255.255.0, 1 successors, FD is 28160, serno 1
        via Connected, Ethernet0/1
P 172.16.1.0 255.255.255.0, 1 successors, FD is 28160, serno 2
        via Connected, Ethernet0/0
P 198.100.100.0 255.255.255.0, 0 successors, FD is Inaccessible, serno 0
        via 192.168.5.1 (28416/2816), Ethernet0/1
P 206.248.224.0 255.255.255.0, 0 successors, FD is Inaccessible, serno 0
        via 172.16.1.2 (30720/28160), Ethernet0/0
bhiasaip#

When i turn on debugging on the Edge switch, I do not see anything happening with respect to EIGRP. No routes or anything else..

bhiedge#debug ip eigrp
IP-EIGRP Route Events debugging is on
bhiedge#debug ip eigrp top
% Incomplete command.

bhiedge#debug ip eigrp top ?
WORD Topology instance name

bhiedge#debug ip eigrp top 100
IP-EIGRP Route Events debugging is on
bhiedge#

Thanks Raj

Kevin

I think we need to see all the routing tables from the relevant devices as Raj requested.

Can we have routing tables from border router/outside firewall (op), DMZ switch, inside firewall ip.

Also can you post relevant config from each of the above devices for any static routes that you have added.

Some routers are showing as FD inaccessible which often means that there is a better route available such as a static i think we need to see exactly what is configured on each device.

Jon

Kevin Melton · ‎01-28-2010

Jon

I can put these routing tables in later if necessary, but I can definitely tell you that all routes are configured statically at this point. This is how the network was first built. It was simple and we did not see the need to run any dynamic protocol. Now we are at a point where we can see how it would be beneficial to have the ability to fail over with respect to Internet access (we have many processes at this customer that depend on the Internet fo transactions) to keep things up.

This was not really an option before as the alternate Internet connection was a DSL connection that was only at 1 mg or some small figure. It has since been upgraded to a 10 mg pipe.

Thanks Jon

Kevin