Allowing BGP or OSPF through ASA?

[CiscoPurpleBelt]

I see on some docs such as at https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/6500-bgp-pix.html that you must configure NAT in addition to allowing port 179 to allow BGP through a FW. Basically I am just trying to confirm what all must be configured to allowed BGP or OSPF communication/peering through the FW.

[Rob Ingram]

Hi,
Probably best to use BGP, so yes you would need to allow TCP/179 through the firewall and potentially define a no-nat/nat exemption rule if you have a NAT/PAT rule which may have an undesired result and nat the return traffic.

HTH

[CiscoPurpleBelt]

Right because the peering would have issues if IP address is changing. Why is it best to use BGP if the protocol must go through the FW? What about if the FW is actually participating in OSPF or BGP?

[Richard Burts]

They are 2 significantly different situations if the ASA is participating in the dynamic routing protocol or the dynamic routing protocol passes through the ASA. If the ASA is participating in the routing protocol then the routing protocol packets are received and processed by the ASA interface. There is nothing involving address translation and no access rules (other than making sure that existing access rules do not block the routing protocol packets. OSPF, EIGRP, or BGP all work just fine in this environment. If the ASA is not participating in the routing protocol and the routing protocol packets will pass through the ASA it is quite different. In this situation the routing protocol peers are in different subnets (perhaps one peer is connected to the Inside interface while the other peer is connected to DMZ). That is no problem for BGP where BGP neighbors are frequently on remote subnets. But it is a problem for protocols like OSPF or EIGRP which will establish neighbor relationships only with devices in the same subnet.

HTH

Rick

[CiscoPurpleBelt]

Ok so if the ASA were participating you would simply for the neighborship between the ASA just as you if it were a router?

[Richard Burts · Accepted solution]

I believe that some words are missing which makes it difficult to be sure what you mean. But yes you would simply configure the ASA so that the interface does participate in the dynamic routing protocol and the neighbor relationship would be formed.

HTH

Rick