enter image description here

This is out current setup and everything working great!!! here, now i want backup link for AWS so i have request for one more secondary link and terminated on Cisco ASA on Port-channel1.8 interface.

asa/pri/act# sh run int po1.8
interface Port-channel1.8
 description ### AWS-DX-2 ###
 vlan 8
 nameif aws_dx_2
 security-level 0
 ip address standby

asa/pri/act# sh run int po1.9
interface Port-channel1.9
 description ### AWS-DX-1 ###
 vlan 9
 nameif aws_dx
 security-level 0
 ip address standby

This is my BGP config

router bgp 65501
 bgp log-neighbor-changes
 timers bgp 10 30 0
 address-family ipv4 unicast
  neighbor remote-as 7224
  neighbor password *****
  neighbor activate
  neighbor route-map BGP-LOCAL-PREF in
  neighbor route-map BGP-AS-PREPEND out
  neighbor remote-as 7224
  neighbor password *****
  neighbor activate
  network mask
  network mask
  network mask
  distribute-list ACL-BGP-IN in
  no auto-summary
  no synchronization

My route-map

asa/pri/act# sh run route-map
route-map BGP-LOCAL-PREF permit 10

 set local-preference 90
route-map BGP-AS-PREPEND permit 10

 set as-path prepend 65501 65501 65501

So far so good till here in BGP summery

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd     4         7224 76      61            15    0    0 00:10:49  4     4         7224 286     225           15    0    0 00:41:45  4

Now problem start here, from my LAN i can't ping AWS any instance.

If i go ahead and shutdown one of link then my LAN hosts can ping AWS instance, I am trying to create redendency here and somehow its not working, Did i miss something here?

As soon as i do following it works..

neighbor shutdown

I heard we shouldn't use 169.254/16 in local-link, do you think that could be the issue here?


  Gateway of last resort is 74.XX.XX.107 to network

    S* [1/0] via 74.XX.XX.107, outside
    S [1/0] via, site1
    C is directly connected, site1
    L is directly connected, site1
    S [1/0] via, site1
    S [1/0] via, site1
    S [1/0] via, site1
    C is directly connected, dmz_ext
    L is directly connected, dmz_ext
    C is directly connected, dmz_int
    L is directly connected, dmz_int
    C is directly connected, inside
    L is directly connected, inside
    C is directly connected, pxe
    L is directly connected, pxe
    B [20/0] via, 00:50:35
    C        74.XX.XX.0 is directly connected, public
    L        74.XX.XX.10 is directly connected, public
    C        74.XX.XX.104 is directly connected, outside
    L        74.XX.XX.110 is directly connected, outside
    C is directly connected, aws_dx_2
    L is directly connected, aws_dx_2
    C is directly connected, aws_dx
    L is directly connected, aws_dx
    C is directly connected, ilo
    L is directly connected, ilo
    C is directly connected, FailoverLink
    L is directly connected, FailoverLink

If you notice i have only single BGP route in my table.

B [20/0] via, 00:58:40

Update -2

I did clear asp drop and now seeing this.

Frame drop:
  No valid adjacency (no-adjacency)                                           12
  Flow is denied by configured rule (acl-drop)                               133
  First TCP packet not SYN (tcp-not-syn)                                      54
  TCP RST/FIN out of order (tcp-rstfin-ooo)                                    4
  Slowpath security checks failed (sp-security-failed)                         1
  ICMP Inspect seq num not matched (inspect-icmp-seq-num-not-matched)         31
  FP L2 rule drop (l2_acl)                                                   270
  • Using 169.254/16 is OK. The problem is likely asymmetric traffic and the ASA is blocking it (e.g., traffic goes out VL 8 and returns VL 9. Please post the show route from the ASA – Ron Trunk Jun 22 '18 at 19:50
  • If you're using BGP, the chances are good that you're dealing with an Asymmetric path outbound vs inbound, which could play havoc with your Cisco ASA (if you aren't NAT'ing traffic). Does this sound possible? – Mike Pennington Jun 22 '18 at 19:50
  • First time i am using ASA for BGP and i did set LOCAL-PREF and PREPEND to make one of my link backup link then how come its doing Asymmetric path ?? I am not doing NATing, Can you give me clue or troubleshooting method to find out, also i have single BGP route in my table – Satish Jun 22 '18 at 20:18
  • According to your routes, VL 9 is your outbound path. You can do the same on your AWS console to see what your return path is. I assume it's VL8. You need to prepend your AS on VL 8 so VL 9 is preferred. – Ron Trunk Jun 22 '18 at 20:20
  • How do you know that Amazon has selected the same preferred egress path that you want them to? Did you talk to them and confirm that's what they've done? Ignore the concern about 169.254/16... yes, it's a strange address. No, it's not a problem... seriously, we are only the hundred-thousandth Amazon customer using such – Mike Pennington Jun 22 '18 at 20:21

I would check to see where return traffic from AWS is going. If having both links turned up causes traffic to stop flowing though your ASA then there is a good chance that you have asymmetric routing. Depending on the logging level on your ASA there should be a bunch of half formed connection errors in logging as well.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.