1

I've two cisco ASA configured in active/active HA. ASA is connected to switch with port-channel. Switch configuration:

interface Port-channel47
 description ASA2
 switchport mode trunk
 switchport nonegotiate
 spanning-tree portfast
 spanning-tree bpdufilter enable
interface Port-channel48
 description ASA1
 switchport mode trunk
 switchport nonegotiate
 spanning-tree portfast
 spanning-tree bpdufilter enable

Context system configuration:

interface GigabitEthernet0/0
 channel-group 1 mode on
!
interface GigabitEthernet0/1
 channel-group 1 mode on
interface Port-channel1
 lacp max-bundle 8
!
interface Port-channel1.99
 description Aggregation
 vlan 99
!
interface Port-channel1.300
 description 300
 vlan 300
!
interface Port-channel1.302
 description 302
 vlan 302


context CTX1
  allocate-interface Port-channel1.99
  allocate-interface Port-channel1.302
  config-url disk0:/CTX1
  join-failover-group 1

context CTX2
  allocate-interface Port-channel1.99
  allocate-interface Port-channel1.300
  config-url disk0:/CTX2
  join-failover-group 1

failover group 1
  preempt 100
failover group 2
  secondary
  preempt 100

CTX-1

ospf configuration
interface Port-channel1.302
 nameif 302
 security-level 50
 ip address x.x.x.1 255.255.255.0 standby x.x.x.2
!
interface Port-channel1.99
 nameif 99
 security-level 0
 ip address y.y.y.1 255.255.255.0 standby y.y.y.2

router ospf 1
 network y.y.y.0 255.255.255.0 area 0
 log-adj-changes

CTX2

interface Port-channel1.300
 nameif servers
 security-level 60
 ip address z.z.z.1 255.255.255.0 standby z.z.z.2
!
interface Port-channel1.99
 nameif outside
 security-level 0
 ip address y.y.y.3 255.255.255.0 standby y.y.y.4

router ospf 1
 network y.y.y.0 255.255.255.0 area 0
 log-adj-changes

Issue I've encountered is that they won't become neighbours. I can ping CTX2 from CTX1:

CTX-FW(config)# ping y.y.y.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to y.y.y.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

show ospf 1

 Routing Process "ospf 1" with ID y.y.y.1
 Start time: 1d22h, Time elapsed: 00:04:24.090
 Supports only single TOS(TOS0) routes
 Supports opaque LSA
 Supports Link-local Signaling (LLS)
 Supports area transit capability
 Event-log enabled, Maximum number of events: 1000, Mode: cyclic
 Router is not originating router-LSAs with maximum metric
 Initial SPF schedule delay 5000 msecs
 Minimum hold time between two consecutive SPFs 10000 msecs
 Maximum wait time between two consecutive SPFs 10000 msecs
 Incremental-SPF disabled
 Minimum LSA interval 5 secs
 Minimum LSA arrival 1000 msecs
 LSA group pacing timer 240 secs
 Interface flood pacing timer 33 msecs
 Retransmission pacing timer 66 msecs
 Number of external LSA 0. Checksum Sum 0x0
 Number of opaque AS LSA 0. Checksum Sum 0x0
 Number of DCbitless external and opaque AS LSA 0
 Number of DoNotAge external and opaque AS LSA 0
 Number of areas in this router is 1. 1 normal 0 stub 0 nssa
 Number of areas transit capable is 0
 External flood list length 0
 IETF NSF helper support enabled
 Cisco NSF helper support enabled
 Reference bandwidth unit is 100 mbps
    Area BACKBONE(0) (Inactive)
        Number of interfaces in this area is 1
        Area has no authentication
        SPF algorithm last executed 00:04:00.600 ago
        SPF algorithm executed 1 times
        Area ranges are
        Number of LSA 1. Checksum Sum 0x6099
        Number of opaque link LSA 0. Checksum Sum 0x0
        Number of DCbitless LSA 0
        Number of indication LSA 0
        Number of DoNotAge LSA 0
        Flood list length 0

debug ospf showing that hello being sent but other side won't receive it.

show ospf interface outside

outside is up, line protocol is up
  Internet Address y.y.y.1 mask 255.255.255.0, Area 0
  Process ID 1, Router ID y.y.y.1, Network Type BROADCAST, Cost: 10
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) y.y.y.1, Interface address y.y.y.1
  No backup designated router on this network
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 0:00:06
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/1, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 0, maximum is 0
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 0, Adjacent neighbor count is 0
  Suppress hello for 0 neighbor(s)

Weird thing is that other context has not receiving any hellos as per show ospf traffic:

    OSPF packets received/sent

  Type          Packets              Bytes
  RX Invalid                       0 0
  RX Hello                         0 0
  RX DB des                        0 0
  RX LS req                        0 0
  RX LS upd                        0 0
  RX LS ack                        0 0
  RX Total                         0 0

  TX Failed                        0 0
  TX Hello                        71 3976
  TX DB des                        0 0
  TX LS req                        0 0
  TX LS upd                        0 0
  TX LS ack                        0 0
  TX Total                        71 3976

I've added access-group and access-list allowing ospf traffic:

access-list OUTSIDE extended permit ospf any4 any4
access-list OUTSIDE extended permit ip any4 any4
access-group OUTSIDE in interface outside

Is there any limitation with OSPF on Cisco ASA contexts? Any idea why multicast has not been received by other context?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 9:15
  • Ron unfortunately there wasn't any correct answer. – Datagram.Network Feb 19 '19 at 9:45
-2

You'll need to unicast the OSPF hellos instead of multicasting them. Multicast doesn't work inter-context.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.