1

When a new path to an NSSA External (LSA type 7) route is brought up in the topology below, the existing path's cost to that route increments to exactly match the new path's cost. Therefore, both paths are entered into the routing table, which is NOT the desired behavior as it causes asymmetric routing. The asymmetrical traffic fails the inspection process on the ASA and we see the traffic being dropped.

I can increment the cost manually on an interface in the new path, and expected routing behavior is restored.

However, I don't understand WHY a preferable/lower cost path suddenly has it's metric increased when a separate path opens up...

Consider the following topology.

  • All links are 1 Gig, and have an OSPF metric/cost of 10.
  • Mutual route redistribution to/from BGP and OSPF is taking place on ASA1.
  • Default route is being injected from BGP into OSPF Area 10 on ASA1.
  • Link From ASA1 to R4 is currently shut.

OSPF Lab Topology

ASA1 Routing table and config:

ASA1# show route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is 172.20.10.1 to network 0.0.0.0

B*       0.0.0.0 0.0.0.0 [20/0] via 172.20.10.1, 01:29:39
O IA     10.1.0.0 255.255.255.255 [110/21] via 10.3.5.1, 00:01:29, INSIDE-1
O IA     10.1.2.0 255.255.255.252 [110/30] via 10.3.5.1, 00:01:29, INSIDE-1
O IA     10.1.3.0 255.255.255.252 [110/20] via 10.3.5.1, 00:01:29, INSIDE-1
O IA     10.1.5.0 255.255.255.252 [110/84] via 10.3.5.1, 00:01:29, INSIDE-1
O IA     10.2.0.0 255.255.255.255 [110/21] via 10.3.5.1, 00:01:29, INSIDE-1
O IA     10.2.3.0 255.255.255.252 [110/20] via 10.3.5.1, 00:01:29, INSIDE-1
O        10.3.0.0 255.255.255.255 [110/11] via 10.3.5.1, 00:01:29, INSIDE-1
O        10.3.4.0 255.255.255.252 [110/20] via 10.3.5.1, 00:01:29, INSIDE-1
C        10.3.5.0 255.255.255.252 is directly connected, INSIDE-1
L        10.3.5.2 255.255.255.255 is directly connected, INSIDE-1
O        10.4.0.0 255.255.255.255 [110/21] via 10.3.5.1, 00:01:29, INSIDE-1
O        10.4.1.0 255.255.255.252 [110/30] via 10.3.5.1, 00:01:29, INSIDE-1
O        10.4.10.0 255.255.255.252 [110/84] via 10.3.5.1, 00:01:29, INSIDE-1
O        10.4.100.0 255.255.255.0 [110/30] via 10.3.5.1, 00:01:29, INSIDE-1
O        10.5.0.0 255.255.255.255 [110/85] via 10.3.5.1, 00:01:29, INSIDE-1
B        172.20.0.0 255.255.255.255 [20/0] via 172.20.10.1, 01:29:39
B        172.20.1.0 255.255.255.255 [20/0] via 172.20.10.1, 01:29:39
C        172.20.10.0 255.255.255.252 is directly connected, OUTSIDE
L        172.20.10.2 255.255.255.255 is directly connected, OUTSIDE

ASA1# show run router
router ospf 1
 network 10.3.0.0 255.255.0.0 area 10
 network 10.4.0.0 255.255.0.0 area 10
 area 10 nssa default-information-originate metric 5 metric-type 1
 log-adj-changes
 redistribute bgp 65500 metric 5 metric-type 1 subnets
!
router bgp 65500
 bgp log-neighbor-changes
 address-family ipv4 unicast
  neighbor 172.20.10.1 remote-as 65400
  neighbor 172.20.10.1 activate
  network 10.0.0.0
  redistribute ospf 1
  no auto-summary
  no synchronization
 exit-address-family
!

R3 Routing table and config:

R3#show ip route | exc Codes|^

Gateway of last resort is 10.3.5.2 to network 0.0.0.0

O*N1  0.0.0.0/0 [110/15] via 10.3.5.2, 00:15:05, Ethernet1/1
O        10.1.0.0/32 [110/11] via 10.1.3.1, 01:24:20, Ethernet0/1
O        10.1.2.0/30 [110/20] via 10.2.3.1, 01:24:30, Ethernet0/2
C        10.1.3.0/30 is directly connected, Ethernet0/1
L        10.1.3.2/32 is directly connected, Ethernet0/1
O        10.1.5.0/30 [110/74] via 10.1.3.1, 01:24:20, Ethernet0/1
O        10.2.0.0/32 [110/11] via 10.2.3.1, 01:24:30, Ethernet0/2
C        10.2.3.0/30 is directly connected, Ethernet0/2
L        10.2.3.2/32 is directly connected, Ethernet0/2
C        10.3.0.0/32 is directly connected, Loopback0
C        10.3.4.0/30 is directly connected, Ethernet1/0
L        10.3.4.1/32 is directly connected, Ethernet1/0
C        10.3.5.0/30 is directly connected, Ethernet1/1
L        10.3.5.1/32 is directly connected, Ethernet1/1
O        10.4.0.0/32 [110/11] via 10.3.4.2, 01:24:20, Ethernet1/0
O        10.4.1.0/30 [110/20] via 10.3.4.2, 01:16:08, Ethernet1/0
O        10.4.10.0/30 [110/74] via 10.3.4.2, 01:24:20, Ethernet1/0
O        10.4.100.0/24 [110/20] via 10.3.4.2, 01:24:20, Ethernet1/0
O        10.5.0.0/32 [110/75] via 10.3.4.2, 01:24:20, Ethernet1/0
O N1     172.20.0.0 [110/15] via 10.3.5.2, 00:15:05, Ethernet1/1
O N1     172.20.1.0 [110/15] via 10.3.5.2, 00:15:05, Ethernet1/1

R3#show run | sec ospf
router ospf 1
 area 10 nssa
 network 10.1.0.0 0.0.255.255 area 0
 network 10.2.0.0 0.0.255.255 area 0
 network 10.3.0.0 0.0.255.255 area 10

R4 routing table and config:

R4#show ip route | exc Codes|^

Gateway of last resort is 10.3.4.1 to network 0.0.0.0

O*N1  0.0.0.0/0 [110/25] via 10.3.4.1, 00:16:13, Ethernet1/0
O IA     10.1.0.0/32 [110/21] via 10.3.4.1, 01:25:28, Ethernet1/0
O IA     10.1.2.0/30 [110/30] via 10.3.4.1, 01:25:33, Ethernet1/0
O IA     10.1.3.0/30 [110/20] via 10.3.4.1, 01:25:33, Ethernet1/0
O IA     10.1.5.0/30 [110/84] via 10.3.4.1, 01:25:28, Ethernet1/0
O IA     10.2.0.0/32 [110/21] via 10.3.4.1, 01:25:33, Ethernet1/0
O IA     10.2.3.0/30 [110/20] via 10.3.4.1, 01:25:33, Ethernet1/0
O        10.3.0.0/32 [110/11] via 10.3.4.1, 01:25:33, Ethernet1/0
C        10.3.4.0/30 is directly connected, Ethernet1/0
L        10.3.4.2/32 is directly connected, Ethernet1/0
O        10.3.5.0/30 [110/20] via 10.3.4.1, 01:18:49, Ethernet1/0
C        10.4.0.0/32 is directly connected, Loopback0
C        10.4.1.0/30 is directly connected, Ethernet1/3
L        10.4.1.1/32 is directly connected, Ethernet1/3
C        10.4.10.0/30 is directly connected, Serial2/0
L        10.4.10.1/32 is directly connected, Serial2/0
C        10.4.100.0/24 is directly connected, Ethernet0/0
L        10.4.100.1/32 is directly connected, Ethernet0/0
O        10.5.0.0/32 [110/65] via 10.4.10.2, 01:26:10, Serial2/0
O N1     172.20.0.0 [110/25] via 10.3.4.1, 00:16:13, Ethernet1/0
O N1     172.20.1.0 [110/25] via 10.3.4.1, 00:16:13, Ethernet1/0

R4#show run | sec ospf
router ospf 1
 area 10 nssa
 network 10.3.0.0 0.0.255.255 area 10
 network 10.4.0.0 0.0.255.255 area 10

The cost from R3 to 0.0.0.0/0 is 15, which is what I would expect:

  • Snip from R3's route table: O*N1 0.0.0.0/0 [110/15] via 10.3.5.2, 00:15:05, Ethernet1/1
  • R3 to ASA1 is one hop, cost of 10.
  • ASA1 is injecting the default route as a Type 1 metric, with a cost of 5.

Now, if I no shut the interface between ASA1 and R4 that cost from R3 to ASA1 increments.

No shut the interfaces from R4 to ASA1:

ASA1# conf t
ASA1(config)# int g0/2
ASA1(config-if)# show run int g0/2
!
interface GigabitEthernet0/2
 shutdown
 nameif INSIDE-2
 security-level 100
 ip address 10.4.1.2 255.255.255.252
ASA1(config-if)# no shut

R4 sees the neighborship establish, and now sees a default route with a cost of 15:

R4#
*Sep 10 18:42:27.746: %OSPF-5-ADJCHG: Process 1, Nbr 172.20.10.2 on Ethernet1/3 from LOADING to FULL, Loading Done
R4#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is 10.4.1.2 to network 0.0.0.0

O*N1  0.0.0.0/0 [110/15] via 10.4.1.2, 00:01:31, Ethernet1/3
      10.0.0.0/8 is variably subnetted, 18 subnets, 3 masks
O IA     10.1.0.0/32 [110/21] via 10.3.4.1, 01:42:37, Ethernet1/0
O IA     10.1.2.0/30 [110/30] via 10.3.4.1, 01:42:42, Ethernet1/0
O IA     10.1.3.0/30 [110/20] via 10.3.4.1, 01:42:42, Ethernet1/0
O IA     10.1.5.0/30 [110/84] via 10.3.4.1, 01:42:37, Ethernet1/0
O IA     10.2.0.0/32 [110/21] via 10.3.4.1, 01:42:42, Ethernet1/0
O IA     10.2.3.0/30 [110/20] via 10.3.4.1, 01:42:42, Ethernet1/0
O        10.3.0.0/32 [110/11] via 10.3.4.1, 01:42:42, Ethernet1/0
C        10.3.4.0/30 is directly connected, Ethernet1/0
L        10.3.4.2/32 is directly connected, Ethernet1/0
O        10.3.5.0/30 [110/20] via 10.4.1.2, 00:01:31, Ethernet1/3
                     [110/20] via 10.3.4.1, 01:35:58, Ethernet1/0
C        10.4.0.0/32 is directly connected, Loopback0
C        10.4.1.0/30 is directly connected, Ethernet1/3
L        10.4.1.1/32 is directly connected, Ethernet1/3
C        10.4.10.0/30 is directly connected, Serial2/0
L        10.4.10.1/32 is directly connected, Serial2/0
C        10.4.100.0/24 is directly connected, Ethernet0/0
L        10.4.100.1/32 is directly connected, Ethernet0/0
O        10.5.0.0/32 [110/65] via 10.4.10.2, 01:43:19, Serial2/0
      172.20.0.0/32 is subnetted, 2 subnets
O N1     172.20.0.0 [110/15] via 10.4.1.2, 00:01:31, Ethernet1/3
O N1     172.20.1.0 [110/15] via 10.4.1.2, 00:01:31, Ethernet1/3 

R3 now sees the default route (and all other NSSA External/LSA Type 7 routes) with a cost of 25. EVEN the route directly to ASA1 which cost 15 just a moment ago!

R3#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is 10.3.5.2 to network 0.0.0.0

O*N1  0.0.0.0/0 [110/25] via 10.3.5.2, 00:03:16, Ethernet1/1
                [110/25] via 10.3.4.2, 00:03:16, Ethernet1/0
      10.0.0.0/8 is variably subnetted, 18 subnets, 3 masks
O        10.1.0.0/32 [110/11] via 10.1.3.1, 01:44:22, Ethernet0/1
O        10.1.2.0/30 [110/20] via 10.2.3.1, 01:44:32, Ethernet0/2
                     [110/20] via 10.1.3.1, 01:44:22, Ethernet0/1
C        10.1.3.0/30 is directly connected, Ethernet0/1
L        10.1.3.2/32 is directly connected, Ethernet0/1
O        10.1.5.0/30 [110/74] via 10.1.3.1, 01:44:22, Ethernet0/1
O        10.2.0.0/32 [110/11] via 10.2.3.1, 01:44:32, Ethernet0/2
C        10.2.3.0/30 is directly connected, Ethernet0/2
L        10.2.3.2/32 is directly connected, Ethernet0/2
C        10.3.0.0/32 is directly connected, Loopback0
C        10.3.4.0/30 is directly connected, Ethernet1/0
L        10.3.4.1/32 is directly connected, Ethernet1/0
C        10.3.5.0/30 is directly connected, Ethernet1/1
L        10.3.5.1/32 is directly connected, Ethernet1/1
O        10.4.0.0/32 [110/11] via 10.3.4.2, 01:44:22, Ethernet1/0
O        10.4.1.0/30 [110/20] via 10.3.5.2, 00:03:16, Ethernet1/1
                     [110/20] via 10.3.4.2, 01:36:10, Ethernet1/0
O        10.4.10.0/30 [110/74] via 10.3.4.2, 01:44:22, Ethernet1/0
O        10.4.100.0/24 [110/20] via 10.3.4.2, 01:44:22, Ethernet1/0
O        10.5.0.0/32 [110/75] via 10.3.4.2, 01:44:22, Ethernet1/0
      172.20.0.0/32 is subnetted, 2 subnets
O N1     172.20.0.0 [110/25] via 10.3.5.2, 00:03:16, Ethernet1/1
                    [110/25] via 10.3.4.2, 00:03:16, Ethernet1/0
O N1     172.20.1.0 [110/25] via 10.3.5.2, 00:03:16, Ethernet1/1
                    [110/25] via 10.3.4.2, 00:03:16, Ethernet1/0

As I said above, I can force the traffic over to my preferred path (R3 to ASA1) by manually setting the cost on R4's link to ASA1 higher:

R4#show run int eth1/3
Building configuration...

Current configuration : 90 bytes
!
interface Ethernet1/3
 description ASA1-Gi0/2
 ip address 10.4.1.1 255.255.255.252
end

R4#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R4(config)#int eth1/3
R4(config-if)#ip ospf cost 20

Now R3 sees the cost to 0.0.0.0/0 via R4 at 35, and drops it from the route table in favor of it's direct path to ASA1.

BUT it doesn't decrement the cost back to 15!

R3#show ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
  Known via "ospf 1", distance 110, metric 25, candidate default path, type NSSA extern 1
  Last update from 10.3.5.2 on Ethernet1/1, 00:09:23 ago
  Routing Descriptor Blocks:
  * 10.3.5.2, from 172.20.10.2, 00:09:23 ago, via Ethernet1/1
      Route metric is 25, traffic share count is 1

Finally, I can shutdown the link between R4 and ASA1 again, and the cost between R3 and ASA1 decrements back to 15.

ASA1# show run int g0/2
!
interface GigabitEthernet0/2
 nameif INSIDE-2
 security-level 100
 ip address 10.4.1.2 255.255.255.252
ASA1# conf t
ASA1(config)# int g0/2
ASA1(config-if)# shut

Voila...

R3#show ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
  Known via "ospf 1", distance 110, metric 15, candidate default path, type NSSA extern 1
  Last update from 10.3.5.2 on Ethernet1/1, 00:00:49 ago
  Routing Descriptor Blocks:
  * 10.3.5.2, from 172.20.10.2, 00:00:49 ago, via Ethernet1/1
      Route metric is 15, traffic share count is 1

____    __    ____  __    __  ____    ____  __   ______   
\   \  /  \  /   / |  |  |  | \   \  /   / |  | |      \  
 \   \/    \/   /  |  |__|  |  \   \/   /  |  | `----)  | 
  \            /   |   __   |   \_    _/   |  |     /  /  
   \    /\    /    |  |  |  |     |  |     |__|    |__|   
    \__/  \__/     |__|  |__|     |__|     (__)     __    
                                                   (__)  
  • What version of ASA? – Ron Trunk Sep 10 '17 at 19:12
  • @RonTrunk 9.8(1)7 – Brett Lykins Sep 10 '17 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.