5

I'm currently using a Cisco ASA 5512-X to establish an IKEv1 VPN with an Amazon Web Services VPC. I'm using BGP to advertise the route as per this example. So far everything is working great, my local network (172.16.2.0/24) is advertising its availability, and my AWS VPC (172.24.0.0/16) is doing the same.

The one thing I can't figure out, is how to add additional static routes to my BGP table. For example, my local network (that AWS sees) is 172.16.2.0/24. My client VPN's subnet is 172.16.252.0/24, also served by the ASA. I need to somehow tell the ASA to advertise the 172.16.252.0/24 network in it's BGP advertisements.

I've looked through the docs and haven't found anything obvious. Anyone have any experience with the newish BGP features in the ASAs?

I'm running 9.7(1) for what it's worth, here is my ASA's "router" config:

router bgp 65000
 bgp log-neighbor-changes
 timers bgp 10 30 0
 address-family ipv4 unicast
  neighbor 169.254.45.189 remote-as 7224
  neighbor 169.254.45.189 activate
  neighbor 169.254.46.229 remote-as 7224
  neighbor 169.254.46.229 activate
  network 172.16.2.0 mask 255.255.255.0
  network 172.16.252.0 mask 255.255.255.0
  redistribute static
  no auto-summary
  no synchronization
 exit-address-family

Here is the show bgp output:

# sh bgp

BGP table version is 26, local router ID is 172.16.2.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop        Metric LocPrf Weight  Path
*> 172.16.2.0/24    0.0.0.0              0         32768  i
*> 172.24.0.0       169.254.45.189     100             0  7224 i
*                   169.254.46.229     200             0  7224 i
  • The term broadcast is really an inappropriate term to use here. The correct term is advertise. – Ron Maupin Mar 5 '17 at 21:10
  • If you are using network statements to advertise your statically defined prefixes, then you don't need the redistribution statement. You should choose one or the other. The network statement will not advertise a prefix that is not in your routing table. Edit your question to include the results of a show ip route command. – Ron Maupin Mar 5 '17 at 21:15
4

I believe the feature you are looking for is "Reverse Route Injection".

Reverse route injection (RRI) is the ability for static routes to be automatically inserted into the routing process for those networks and hosts protected by a remote tunnel endpoint. These protected hosts and networks are known as remote proxy identities.

Each route is created on the basis of the remote proxy network and mask, with the next hop to this network being the remote tunnel endpoint. By using the remote Virtual Private Network (VPN) router as the next hop, the traffic is forced through the crypto process to be encrypted.

By default, an ASA will not include VPN-tunneled routes into the routing table. Since they are not technically in the routing table, BGP cannot advertise them with a network statement.

Setting a Reverse-Route allows the route to be injected into the routing table.

It is enable in the crypto map portion of the VPN.

Example:

crypto map LOCAL_TO_REMOTE_MAP 10 match address LOCAL_TO_REMOTE_ACL
crypto map LOCAL_TO_REMOTE_MAP 10 set peer 203.0.113.0.6
crypto map LOCAL_TO_REMOTE_MAP 10 set ikev1 transform-set LOCAL_TO_REMOTE_TRANSFORM_SET
crypto map LOCAL_TO_REMOTE_MAP 10 set reverse-route
crypto map LOCAL_TO_REMOTE_MAP interface OUTSIDE

More details and usage can be found here: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnav/configuration/xe-16/sec-vpn-availability-xe-16-book/sec-rev-rte-inject.html#GUID-30538C61-6729-4DEC-A7E3-3FBF1DC446B1

  • I'm using a dynamic map, but you lead me right to the answer. Allow me to sing you the song of my people: 🍺🍺🍺🍺 – danieljimenez Mar 6 '17 at 3:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.