7

We have set up OSPF between our 2 ASA 5540 running in Active/Passive and our Internet provider's Juniper routers. We would like to advertise routes based on the content of an ACL through a route-map :

router ospf 1
router-id X.X.X.A
network X.X.X.B 255.255.255.248 area 0
area 0 authentication message-digest
log-adj-changes
redistribute static metric 10 subnets route-map annonce_ospf_isp

route-map annonce_ospf_isp permit 1
match ip address redistribute_isp

access-list redistribute_isp standard permit Y.Y.Y.C 255.255.255.252

If I advertise a /30, no problem : it shows up in the ospf database and the route is inserted in other routers.

However if I advertise a /32 then nothing happens: it's not in the database, it's not advertised :

access-list redistribute_neo standard permit host Y.Y.Y.D

What is the problem?

  • Try writing the access list with a mask instead of the word 'host'. – Ron Trunk Feb 19 '14 at 13:59
  • actually that's what I do but ASA always replaces it with "host". Thanks – simsaull Feb 19 '14 at 14:02
  • Try a prefix list instead of an access list. See: brandonfarmer.com/2013/10/19/… – Ron Trunk Feb 19 '14 at 14:11
  • Thanks Ron. Unfortunatly prefix-list seems to be a feature available with ASA 8.3, and we are running 8.2... – simsaull Feb 19 '14 at 14:43
  • well actually it's weirder than that : i can create a prefix-list : prefix-list PF-test-ospf seq 1 permit Y.Y.Y.D/32. However I cannot use it in my route-map : (config-route-map)# match ip address ? route-map mode commands/options: WORD Access-list name – simsaull Feb 19 '14 at 14:48
2

You should have a static /32 route in your routing table towards for Y.Y.Y.D in order to be able to redistribute it from static to OSPF.

0

Try add a host static route. doing so it would add the route in the routing table. See if your initial redistribute command works after that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.