Advertise static route via BGP from Cisco ASA 5512-x

Question

I'm currently using a Cisco ASA 5512-X to establish an IKEv1 VPN with an Amazon Web Services VPC. I'm using BGP to advertise the route as per this example. So far everything is working great, my local network (172.16.2.0/24) is advertising its availability, and my AWS VPC (172.24.0.0/16) is doing the same.

The one thing I can't figure out, is how to add additional static routes to my BGP table. For example, my local network (that AWS sees) is 172.16.2.0/24. My client VPN's subnet is 172.16.252.0/24, also served by the ASA. I need to somehow tell the ASA to advertise the 172.16.252.0/24 network in it's BGP advertisements.

I've looked through the docs and haven't found anything obvious. Anyone have any experience with the newish BGP features in the ASAs?

I'm running 9.7(1) for what it's worth, here is my ASA's "router" config:

router bgp 65000
 bgp log-neighbor-changes
 timers bgp 10 30 0
 address-family ipv4 unicast
  neighbor 169.254.45.189 remote-as 7224
  neighbor 169.254.45.189 activate
  neighbor 169.254.46.229 remote-as 7224
  neighbor 169.254.46.229 activate
  network 172.16.2.0 mask 255.255.255.0
  network 172.16.252.0 mask 255.255.255.0
  redistribute static
  no auto-summary
  no synchronization
 exit-address-family

Here is the show bgp output:

# sh bgp

BGP table version is 26, local router ID is 172.16.2.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop        Metric LocPrf Weight  Path
*> 172.16.2.0/24    0.0.0.0              0         32768  i
*> 172.24.0.0       169.254.45.189     100             0  7224 i
*                   169.254.46.229     200             0  7224 i

Answer 1

I believe the feature you are looking for is "Reverse Route Injection".

Reverse route injection (RRI) is the ability for static routes to be automatically inserted into the routing process for those networks and hosts protected by a remote tunnel endpoint. These protected hosts and networks are known as remote proxy identities.

Each route is created on the basis of the remote proxy network and mask, with the next hop to this network being the remote tunnel endpoint. By using the remote Virtual Private Network (VPN) router as the next hop, the traffic is forced through the crypto process to be encrypted.

By default, an ASA will not include VPN-tunneled routes into the routing table. Since they are not technically in the routing table, BGP cannot advertise them with a network statement.

Setting a Reverse-Route allows the route to be injected into the routing table.

It is enable in the crypto map portion of the VPN.

Example:

crypto map LOCAL_TO_REMOTE_MAP 10 match address LOCAL_TO_REMOTE_ACL
crypto map LOCAL_TO_REMOTE_MAP 10 set peer 203.0.113.0.6
crypto map LOCAL_TO_REMOTE_MAP 10 set ikev1 transform-set LOCAL_TO_REMOTE_TRANSFORM_SET
crypto map LOCAL_TO_REMOTE_MAP 10 set reverse-route
crypto map LOCAL_TO_REMOTE_MAP interface OUTSIDE

More details and usage can be found here: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnav/configuration/xe-16/sec-vpn-availability-xe-16-book/sec-rev-rte-inject.html#GUID-30538C61-6729-4DEC-A7E3-3FBF1DC446B1